I think that it's fundamental for security testers to gather information about how a web application works and eventually what language it's written in.

I know that URL extensions, HTTP headers, session cookies, HTML comments and style-sheets may reveal some information but it's still hard and not assured.

So I was wondering: is there a way to determine what technology and framework are behind a website ?

There's no way to be 100% sure if you don't have access to the server, so it's about guessing. Here are some clues:


File extensions: login.php is most likely a PHP script.
HTTP headers: they may leak some information about the language which is running on the server, and some additional details like the version: X-Powered-By: PHP/7.0.0 means that the page was rendered by PHP.
HTTP Parameter Pollution: if you managed to guess which server is running, you can refine the guess.
Language limits: maximum post data, maximum number variable in GET and POST data, etc. It may be useful if the webmaster kept the default values.
Specific input: for example, PHP had some easter eggs.
Errors: triggering errors may also leak the language. Warning: Division by zero in /var/www/html/index.php on line 3 is PHP, for example.
File uploads: libraries may add metadata if the file is being modified server-side. For example, most sites resize users' avatars, and checking for EXIF data will leak CREATOR: gd-jpeg v1.0 (using IJG JPEG v90), default quality, which may help to guess which language is used.
Default filenames: Check if / and /index.php are the same page.
Exploits: reading a backup file, or executing arbitrary code on the server.
Open source: the website may have been open-sourced and is available somewhere on Internet.
About page: the webmaster may have thanked the language community in a "FAQ" or "About" page.
Jobs page: the development team may be recruiting, and they may have detailed the technologies they're using.
Social Engineering: ask the webmaster!
Public profiles: if you know who is working on the website (check LinkedIn and /humans.txt), you can check their public repos or their skills on online profiles (GitHub, LinkedIn, Twitter, ...).




You may also want to know if the website is built with a framework or a CMS, since this will give information about the language used:


URLs: directories and pages are specific to certain CMS. For example, if some resources are located in the /wp-content/ directory, it means that WordPress have been used.
Session cookies: name and format.
CSRF tokens: name and format.
Rendered HTML: for example: meta tags order, comments.




Note that all information coming from the server may be altered to trick you. You should always try to use multiple sources to validate your guess.
