Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's say we have a random basic blog or informational website: just some pages with information, a sidebar with an overview of the archives, the normal stuff. We know of this website that it's built with a CMS. How can we get to know which CMS built this website?

So I'm looking for basic, general typicals of several much-used CMSs, so that we can get to know the working power behind any informational website or blog.

For example, a typical might be that WordPress adds such a line to the HTML:

<meta name="generator" content="WordPress 3.5.1" />
share|improve this question
I'm not sure if this is on topic here. The guys on Reverse Engineering (in private beta now) told me it's on topic here. – Camil Staps Mar 24 '13 at 18:28
The security implications would be for identifying what platform is in place to help focus attacks. Defensively, you would want to try to confuse such techniques to hide what is going on under the surface. – Eric G Mar 24 '13 at 18:48
up vote 6 down vote accepted

It sounds like you are interested in finger printing a CMS. This can be done similar to what is done with nmap. You would need to compromise a library of unique urls, etc and than scan a page to see if they exhibit these.

You can use

Here are some examples of it is use:

Some other useful/related finds:

  • Nmap Plugin to identify Drupal websites
  • Scritch seems to have a script similar to BuiltWith
  • Wapalyzer Plugin to do some detections
  • web-sorrow: a perl based scanner which includes checks for CMS
  • Blind Elephant: another scanner
  • plecost: A wordpress specific scanner
  • whatweb: yet another scanner which doesn't seem to be as actively developed
  • OWASP Favicon DB: Not quite functional on its own, but if you hash the favicons as you download and they match, could be used as one indicator.

You could also do some google hacking with the url + keywords like "Joomla" or "Wordpress" to see if the site is listed in a showcase, they asked for help on a forum for a particular CMS and listed their site, comments, code hints, search for specific strings in the url, e.g., inurl:index.php?option=com_content.

share|improve this answer
Found this pretty good article with some background and thoughts at the theory level: – Eric G Mar 24 '13 at 19:02
wpscan is also useful for wordpress sites. – rook Mar 24 '13 at 19:08
This is useful and fun, but doesn't really answer the question: I'm looking for the techniques used by these tools, not for the tools themselves. The link you provided in the comment is a better answer :-) – Camil Staps Mar 27 '13 at 15:10
There are some other pieces of advice among the links, you can also look at their source code. Do you want to make your own product, or perform a fingerprinting? – Eric G Mar 27 '13 at 23:52
I didn't see that some where open source. Now it's a very nice answer, thanks! – Camil Staps Mar 30 '13 at 14:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.