Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's say I'm in the process of planning the setup of a website. I study similar sites that offer similar services or might receive similar traffic model.

Is there a way to determine a bit the kind of setup, software and/or hardware.

Some things are obvious. If I see .php or .jsp then I already know a bit. But any ideas on how to decipher more?

Maybe where the site is hosted, hardware, platforms...

share|improve this question

Phone their admins and ask them?

share|improve this answer
This might work more often than you'd think. Even more useful is work out if they use an external company for admin services, then hire them to do your site. – womble Nov 24 '09 at 18:42
Exactly what I was thinking. You can scrape together a bit with fingerprinting and scanner, but you won't find much about the backend, and it's a bit impolite. A quick email or phonecall will be a lot more productive, and you've nothing to lose by trying. – Dentrasi Nov 24 '09 at 21:52
It's also worth looking to see if they have any job vacancies listed. Old ones will at least give you an idea of what technology is being used, current ones will give you an excuse to call up and ask questions. – kaerast May 30 '10 at 22:17

You can get hosting (or at least network) provider easily enough (traceroute), OS and server software (nmap/HTTP headers), but it really doesn't tell you squat. There's a lot more to making a useful, scalable site than picking the OS and network transit provider. In fact, you could be buying yourself a lot of problems by replicating someone else's architecture -- who knows if they have constant problems with it? You're far better off finding someone who knows how to do this sort of thing and having them work with you to understand your specific problems and how to work around them.

share|improve this answer
  1. Server header: Just like how your computer sends its OS, browsers and capabilities with an HTTP request, a server sends them also with it's response. You can use a tool like this to see a server's headers. From this I can tell is running Microsoft IIS/7.0.
  2. Check the DNS records. It can give you an idea on what services they are running and how many servers used.
  3. URLs: Tells you what kind of scripts they are using and if they are running a server application like MediaWiki or phpBB.
  4. About/faq/Copyright page: They will include here some of the software they are using and maybe how it works. This is usually the first place to check.
share|improve this answer

Examining DNS records for all related site hostnames will give you a hint a the topology of the site. You may see multiple IP addresses (which don't necessarily mean multiple physical machine, but often will) and the same or different network addresses, which may hint at how they distribute the load for redundancy or speed reasons.

Examining the HTTP headers of a site's various services will give you a possible idea of the front-end. Are they using a reverse proxy, such as nginx or Varnish, or are you hitting the web servers directly? Are requests for PHP pages coming from a different server (apache) than those for static HTML and image files (nginx,lighttpd , etc.)?

Examining SMTP headers from mails sent from a site will give you more hints.

Traceroutes and pings will yield a little more info.

Of course, much info gathered will be speculation and guessing on your part, because a well configured site will not give out too much info about its internal architecture. What you'd be doing is, in essence, much what a penetration tester would do for certain info. Just make sure to not cross the line and disrupt the site.

share|improve this answer
Also, a quick view on OS, server, language, as well as hoster and hosting history is the old favourite, "What's that site running?" on – Zayne S Halsall Nov 24 '09 at 19:25

From a client-side perspective there's almost nothing useful you could find out no, not unless the site has gone out of their way to make this easy for you - any they won't have.

share|improve this answer
While the Chopper3's response is a bit terse, it's mostly accurate. There's always some intel you can gather on a site's architecture. A clever admin, however, will leak as little info as possible. I think the down-vote was unwarranted. – Geoff Fritz Nov 24 '09 at 17:59

I totally agree with Womble, anyway ,it seems like the begining of a pen test, you may look at some of the tools and techniques mentionned here and use some scapy magick.

share|improve this answer

You're going about this completely wrong. Any web site can be achieved in a number of ways. Forget about what others do or use. Start with a definition of what you're trying to achieve. Then determine the best way to get there. Smart IT is not about copying what someone else has done. It's working out the best and most efficient way to get the job done with as little requirement for maintenance as possible. A major factor should be what you (or whoever has to maintain the beast) are comfortable working with.

share|improve this answer
What I'm interested in is what I asked: ways to find out about what makes a particular site run. I gave a fictional motivation which was obviously a mistake. – carrier Nov 24 '09 at 22:24
You may want to reword the question to make things clearer. – John Gardeniers Nov 25 '09 at 1:31

You should be able to get info about the host from DNS, although that is unlikely to help you much in figuring out the platform unless the host is something like Google.

Work through the site and study the generated HTML and script files. By comparing those to the same from sites whose hosting provenance is known, you should be able to make a lot of inferences. This will work particularly well if the site is built on something like WordPress or Movable Type. On custom-written sites (such as the SO Trilogy), it will take a bunch of digging to find breadcrumbs leading to the framework (i.e. MVC), but unless the developers have made a concerted effort to scrub them, clues are likely there.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.