Backend Inferencer

Backend Inferencer Skill

Purpose

Infer backend technologies by analyzing HTTP headers, cookies, error pages, DNS records, and repository data.

Input

Raw signals from Phase 2:

• http_signals - Server headers, X-Powered-By, cookies
• dns_signals - Service verification TXT records
• repository_signals - Dependencies, Dockerfiles
• html_signals - Generator meta tags, CMS patterns

Technology Categories

Web Servers

Programming Languages

Backend Frameworks

Content Management Systems

Databases (Indirect Signals)

API Technologies

Inference Logic

def infer_backend_technologies(signals):
    results = []

    # Web Server Detection
    server_header = signals.http_signals.get('Server', '')
    for server in SERVER_PATTERNS:
        if server.pattern.match(server_header):
            results.append({
                "name": server.name,
                "category": "Web Server",
                "version": extract_version(server_header, server.pattern),
                "signals": [{"type": "http_header", "value": f"Server: {server_header}"}],
                "total_weight": server.weight
            })

    # Language/Framework from X-Powered-By
    powered_by = signals.http_signals.get('X-Powered-By', '')
    for framework in POWERED_BY_PATTERNS:
        if framework.pattern in powered_by:
            results.append({
                "name": framework.name,
                "category": framework.category,
                "implies": framework.implies,
                "signals": [{"type": "http_header", "value": f"X-Powered-By: {powered_by}"}],
                "total_weight": framework.weight
            })

    # Cookie-based Detection
    for cookie in signals.http_signals.cookies:
        for pattern in COOKIE_PATTERNS:
            if pattern.name in cookie:
                results.append({
                    "name": pattern.tech,
                    "category": pattern.category,
                    "implies": pattern.implies,
                    "signals": [{"type": "cookie", "value": f"Cookie: {cookie}"}],
                    "total_weight": pattern.weight
                })

    # CMS Detection from HTML
    for cms in CMS_PATTERNS:
        score = 0
        evidence = []

        if cms.generator_pattern in signals.html_signals.generators:
            score += 40
            evidence.append("Generator meta tag")

        for url_pattern in cms.url_patterns:
            if url_pattern in signals.html_signals.script_urls:
                score += 20
                evidence.append(f"URL pattern: {url_pattern}")

        if score > 0:
            results.append({
                "name": cms.name,
                "category": "CMS",
                "signals": evidence,
                "total_weight": score
            })

    # Repository-based Detection
    if signals.repository_signals:
        for dep_file, deps in signals.repository_signals.dependencies.items():
            for dep in deps:
                if dep.name in DEPENDENCY_PATTERNS:
                    pattern = DEPENDENCY_PATTERNS[dep.name]
                    results.append({
                        "name": pattern.tech,
                        "category": pattern.category,
                        "version": dep.version,
                        "signals": [{"type": "dependency", "value": f"{dep.name}@{dep.version}"}],
                        "total_weight": pattern.weight
                    })

    return results

Output

{
  "skill": "backend_inferencer",
  "results": {
    "technologies": [
      {
        "name": "nginx",
        "category": "Web Server",
        "version": "1.18.0",
        "signals": [
          {
            "type": "http_header",
            "value": "Server: nginx/1.18.0",
            "source": "https://example.com",
            "weight": 40
          }
        ],
        "total_weight": 40
      },
      {
        "name": "Express.js",
        "category": "Backend Framework",
        "signals": [
          {
            "type": "http_header",
            "value": "X-Powered-By: Express",
            "source": "https://api.example.com",
            "weight": 40
          },
          {
            "type": "cookie",
            "value": "connect.sid session cookie",
            "source": "https://example.com",
            "weight": 30
          }
        ],
        "total_weight": 70,
        "implies": ["Node.js"]
      },
      {
        "name": "Node.js",
        "category": "Runtime",
        "signals": [
          {
            "type": "implied",
            "value": "Implied by Express.js detection",
            "weight": 0
          },
          {
            "type": "dependency",
            "value": "node version in package.json",
            "source": "github.com/example/repo",
            "weight": 35
          }
        ],
        "total_weight": 35
      },
      {
        "name": "PostgreSQL",
        "category": "Database",
        "signals": [
          {
            "type": "dependency",
            "value": "pg@8.11.0 in package.json",
            "source": "github.com/example/repo",
            "weight": 30
          }
        ],
        "total_weight": 30
      }
    ],
    "implied_technologies": [
      {
        "name": "Node.js",
        "implied_by": ["Express.js"],
        "confidence": "High"
      }
    ],
    "summary": {
      "web_server": "nginx",
      "runtime": "Node.js",
      "framework": "Express.js",
      "database": "PostgreSQL",
      "cms": null
    }
  }
}

Version Detection

From Headers

Server: nginx/1.18.0 → nginx 1.18.0
X-Powered-By: PHP/8.1.0 → PHP 8.1.0
X-AspNet-Version: 4.0.30319 → ASP.NET 4.x

From Dependencies

// package.json
"express": "^4.18.2" → Express.js 4.18.x

// requirements.txt
Django==4.2.1 → Django 4.2.1

// Gemfile
gem 'rails', '~> 7.0' → Rails 7.0.x

Error Handling

• Missing headers: Continue with other signals
• Ambiguous cookies: Include all possibilities
• Conflicting signals: Report both, flag for correlation phase