4

Let's say we have a random basic blog or informational website: just some pages with information, a sidebar with an overview of the archives, the normal stuff. We know of this website that it's built with a CMS. How can we get to know which CMS built this website?

So I'm looking for basic, general typicals of several much-used CMSs, so that we can get to know the working power behind any informational website or blog.

For example, a typical might be that WordPress adds such a line to the HTML:

<meta name="generator" content="WordPress 3.5.1" />
Improve this question
2
  • I'm not sure if this is on topic here. The guys on Reverse Engineering (in private beta now) told me it's on topic here.
    – user21287
    Commented Mar 24, 2013 at 18:28
  • 1
    The security implications would be for identifying what platform is in place to help focus attacks. Defensively, you would want to try to confuse such techniques to hide what is going on under the surface.
    – Eric G
    Commented Mar 24, 2013 at 18:48

3 Answers 3

Reset to default
7

It sounds like you are interested in finger printing a CMS. This can be done similar to what is done with nmap. You would need to compromise a library of unique urls, etc and than scan a page to see if they exhibit these.

You can use BuiltWith.com.

Here are some examples of it is use:

Some other useful/related finds:

  • Nmap Plugin to identify Drupal websites
  • Scritch seems to have a script similar to BuiltWith
  • Wapalyzer Plugin to do some detections
  • web-sorrow: a perl based scanner which includes checks for CMS
  • Blind Elephant: another scanner
  • plecost: A wordpress specific scanner
  • whatweb: yet another scanner which doesn't seem to be as actively developed
  • OWASP Favicon DB: Not quite functional on its own, but if you hash the favicons as you download and they match, could be used as one indicator.

You could also do some google hacking with the url + keywords like "Joomla" or "Wordpress" to see if the site is listed in a showcase, they asked for help on a forum for a particular CMS and listed their site, comments, code hints, search for specific strings in the url, e.g., inurl:index.php?option=com_content.

Improve this answer
6
  • Found this pretty good article with some background and thoughts at the theory level: anantshri.info/articles/web_app_finger_printing.html
    – Eric G
    Commented Mar 24, 2013 at 19:02
  • wpscan is also useful for wordpress sites.
    – rook
    Commented Mar 24, 2013 at 19:08
  • This is useful and fun, but doesn't really answer the question: I'm looking for the techniques used by these tools, not for the tools themselves. The link you provided in the comment is a better answer :-)
    – user21287
    Commented Mar 27, 2013 at 15:10
  • There are some other pieces of advice among the links, you can also look at their source code. Do you want to make your own product, or perform a fingerprinting?
    – Eric G
    Commented Mar 27, 2013 at 23:52
  • I didn't see that some where open source. Now it's a very nice answer, thanks!
    – user21287
    Commented Mar 30, 2013 at 14:53
0

In addition to the very good list given by Eric, I personnaly use Wappalyzer (a browser extension) which usually gives me the best results to fingerprint CMS during penetration tests.

Also, as far as I remember, Blind Elephant suffers from lack of updates and issues running on Kali (although it's part of the standard distro).

Improve this answer
0

There is an extension for Chrome, and probably Firefox too, that can identify the known infrastructure used in a visited site. Likely there are several plugins that do this type of analysis. In most cases, it is pretty easy to look at the source of a site and determine what CMS it is using, if any.

https://chrome.google.com/webstore/detail/builtwith-technology-prof/dapjbgnjinbpoindlpdmhochffioedbn?hl=en

Improve this answer
2
  • Can you identify the plugin you describe? You say it's easy to determine which CMS by looking at the source, could you update your answer with a few examples of this?
    – iainpb
    Commented Jan 10, 2017 at 11:58
  • chrome.google.com/webstore/detail/builtwith-technology-prof/… and for example WordPress would show a lot of wp-content and such common subdirectories in use
    – dyasta
    Commented Jan 10, 2017 at 14:11

You must log in to answer this question.