Backend Tech-Stack Identification
Scope
Identify server-side technologies: web servers (nginx, Apache, IIS), runtimes (Node, Python, PHP, Ruby, Java, .NET), backend frameworks (Express, Django, Flask, Rails, Laravel, Spring, ASP.NET), databases (Postgres, MySQL, Mongo, Redis), CMS (WordPress, Drupal, Magento), and API surfaces (REST, GraphQL, OpenAPI).
Signals (input)
- HTTP response headers —
Server, X-Powered-By, X-AspNet-Version, X-Drupal-*, X-Generator, etc.
- Cookies — session-name fingerprints (
PHPSESSID, JSESSIONID, _rails_session, ...)
- Error page bodies (404, 500)
- Path patterns hinting CMS (
/wp-admin/, /sites/default/)
- API subdomains and OpenAPI/Swagger/GraphQL endpoints
robots.txt directives
Inferences (output)
- Web server + version
- Runtime / language + version
- Backend framework (with implied runtime)
- CMS + version
- Database (often indirect — via ORM dependency or hosted-DB DNS)
- API style (REST/GraphQL/gRPC) and authentication scheme
Techniques
See reference/patterns.md.
When to use
- Phase 2/3 of a tech-stack OSINT engagement
- Mapping server-side attack surface (RCE, SSRF, deserialization)
- CVE matching by server + version
- Locating GraphQL / OpenAPI for follow-on api-security testing
1---2name: techstack-backend3description: Backend tech-stack identification — web servers, runtimes, languages, frameworks, databases, APIs, and CMS via HTTP headers, cookies, error pages, and API discovery.4---5
6# Backend Tech-Stack Identification
7
8## Scope
9
10Identify server-side technologies: web servers (nginx, Apache, IIS), runtimes (Node, Python, PHP, Ruby, Java, .NET), backend frameworks (Express, Django, Flask, Rails, Laravel, Spring, ASP.NET), databases (Postgres, MySQL, Mongo, Redis), CMS (WordPress, Drupal, Magento), and API surfaces (REST, GraphQL, OpenAPI).
11
12## Signals (input)
13
14- HTTP response headers — `Server`, `X-Powered-By`, `X-AspNet-Version`, `X-Drupal-*`, `X-Generator`, etc.
15- Cookies — session-name fingerprints (`PHPSESSID`, `JSESSIONID`, `_rails_session`, ...)
16- Error page bodies (404, 500)
17- Path patterns hinting CMS (`/wp-admin/`, `/sites/default/`)
18- API subdomains and OpenAPI/Swagger/GraphQL endpoints
19- `robots.txt` directives
20
21## Inferences (output)
22
23- Web server + version
24- Runtime / language + version
25- Backend framework (with implied runtime)
26- CMS + version
27- Database (often indirect — via ORM dependency or hosted-DB DNS)
28- API style (REST/GraphQL/gRPC) and authentication scheme
29
30## Techniques
31
32See [reference/patterns.md](reference/patterns.md).
33
34## When to use
35
36- Phase 2/3 of a tech-stack OSINT engagement
37- Mapping server-side attack surface (RCE, SSRF, deserialization)
38- CVE matching by server + version
39- Locating GraphQL / OpenAPI for follow-on api-security testing
transilienceai