我们如何知道使用什么语言/技术来呈现 HTML 文档？
一般来说，Web 应用程序可以呈现它喜欢的任何 HTML。因此，理论上，任何语言都可以呈现相同的 HTML 输出。
然而，我们可以通过一些方法来推断服务器端正在运行的内容。例如，文件扩展名通常是一个致命的赠品（尽管从技术上讲它们可以是伪造的）。根据我使用 ASP.NET 的经验，我知道我们识别 ASP.NET 应用程序的一种方法是通过呈现的文档中是否存在 VIEWSTATE，尽管缺少视图状态并不一定意味着该应用程序不是 在 ASP.NET 上运行
我们可以在服务器上运行一些操作系统/服务器指纹识别，但一般来说这没有多大帮助 - 如今，甚至 Windows 服务器也可以运行相当多的应用程序平台。
还有哪些其他分析技术可以帮助我们确定服务器上正在运行的内容？某些语言还留下了哪些其他线索？
如果我们能够更好地理解应用程序留下的工件（可能很小以至于我们没有注意到它们），我们就可以通过从输出中删除它们来开始提高安全性。
In general, a web application can render any HTML it likes. Therefore, in theory, any language could render identical HTML output.
However, there are some ways we can try to deduce what is running server-side. For instance, file extensions are usually a dead giveaway (although they could technically be faked). Due to my experience with ASP.NET, I know that one way we can identify an ASP.NET application is by the presence of VIEWSTATE in the rendered document, although the lack of viewstate does not necessarily mean that the application is not running on ASP.NET
We could run some OS/server fingerprinting on the server, but in general that would not help much - these days, even Windows servers can run quite a few application platforms.
What other analysis techniques are available that can help us determine what's running on the server? What other clues do certain languages leave?
If we can better understand the artifacts our applications are leaving, perhaps so small that we haven't noticed them, we can begin to better our security by removing them from the output.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
检查 HTTP 标头是一个好的开始。
默认情况下，IIS6 和 ASP.Net 似乎会插入一个以 ASP.Net 作为值的 X-Powered-By 标头。
Checking the HTTP Headers is a good start.
IIS6 and ASP.Net by default seems to insert an X-Powered-By Header with ASP.Net as a value.
在 HTTP 标头中，您（通常但并非总是）会找到一个名为
Server的标头，它指示用于提供网页服务的 Web 服务器。有时您会发现一个名为X-Powered-By的标头，它指示 Web 服务器使用的平台/技术。In the HTTP headers, you'll (usually, but not always) find a header called
Serverwhich indicates the web server used to server the web page. Sometimes you'll find a header calledX-Powered-Bywhich indicates the platform/technology used by the web server.https://addons.mozilla.org/en-US/firefox/addon/ 2166
正如其他人提到的，您可以检查
Server和X-Powered-By标头。例如，stackoverflow 的服务器是Server: Microsoft-IIS/7.0所以我可以推断这是由 ASP 驱动的。以下是我访问的一些随机站点和一些 X-Powered-By 标头：
X-Powered-By: PHP/5.2.9。 (php 论坛)X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 2.0.3(rubyonrails.org)其他 Web 应用程序在页脚中有一个可以看到的签名，例如 Powered-By （应用程序名称）。
https://addons.mozilla.org/en-US/firefox/addon/2166
As others mentioned, you can checkout the
ServerandX-Powered-Byheaders. For example, stackoverflow's server isServer: Microsoft-IIS/7.0so I can deduce this is ASP powered.Here are a few random sites I visited and some X-Powered-By headers:
X-Powered-By: PHP/5.2.9. (php forum)X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 2.0.3(rubyonrails.org)Other web applications have a signature in the footer that can be seen, eg Powered-By ( application name ).