Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Test if a URL uses Node.js

dotheyusenode.herokuapp.com

Post reply on HN
Print view View original

21–30 of 34 posts

Re: Test if a URL uses Node.js

#21

Post by sisk »

In addition to the coffeescript / browserify detection, here are the headers it checks[0]:

  var frameworks = [
    {name: 'express.js', s: "express", h: 'x-powered-by'},
    {name: 'koa.js', s: 'koa', h: 'x-powered-by'},
    {name: 'sails.js', s: "sails", h: 'x-powered-by'},
    {name: 'ecstatic', s: 'ecstatic', h: 'server'},
    {name: 'flatiron', s: 'flatiron', h: 'x-powered-by'}
  ]
All in all, this should prove relatively inaccurate. A vanilla http server from node sets neither server nor x-powered-by headers. Many frameworks don't set them, either (Walmart's hapi, PayPal's krakenjs, etc).

Fun toy project but if you're really interesting in fingerprinting, check out the OWASP entry on the subject[1].

[0]: https://github.com/dotheyusenode/dotheyusenode/blob/ea235619...

[1]: https://www.owasp.org/index.php/Testing_for_Web_Application_...

Re: Test if a URL uses Node.js

#23

Post by wlaurance »

sisk wrote: post #21

In addition to the coffeescript / browserify detection, here are the headers it checks[0]: var frameworks = [ {name: 'express.js', s: "express", h: 'x-powered-by'}, {name: 'koa.js', s: 'koa', h: 'x-powered-by'}, {name: 'sails.js', s: "sails", h: 'x-powered-by'}, {name: 'ecstatic', s: 'ecstatic', h: 'server'}, {name: 'flatiron', s: 'flatiron', h: 'x-powered-by'} ] All in all, this should prove relatively inaccurate. A…

Yes, it is just a toy project. It is a lot more work to fingerprint successfully. OWASP looks very interesting. Thanks for the link and subsequently the white paper links!

Re: Test if a URL uses Node.js

#25

Post by wlaurance »

laumars wrote: post #19
wlaurance wrote: post #16

Earlier quoted context omitted.

I should clarify that I am using the request module to make GET requests on the url submitted. But yes, I dislike that the curl stats print by default when output is redirected :/

> I should clarify that I am using the request module to make GET requests on the url submitted. Yeah I saw (I had a browse through your source after your previous post). As a side note, I was impressed with just how readable your code was (even for someone like myself with very poor Javascript skills). I can't comment on how much credit node.js deserves for that, but I've seen people turn even the most readable of l…

Thanks! Node can thanked because it makes writing modular code painless, so separating concerns is very easy.

Re: Test if a URL uses Node.js

#27

Post by avree »

Gurrewe wrote: post #26

Does anyone know if Node.js has any "easter egg" like PHP You can simply add ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 to the URI of most PHP-sites and the server will respond with the PHP-credits [0]. [0]: http://thepiratebay.se/?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C1...

No, that would be insanity.

Re: Test if a URL uses Node.js

#29

Post by nly »

Gurrewe wrote: post #26

Does anyone know if Node.js has any "easter egg" like PHP You can simply add ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 to the URI of most PHP-sites and the server will respond with the PHP-credits [0]. [0]: http://thepiratebay.se/?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C1...

This can be turned off, even in PHP.

Re: Test if a URL uses Node.js

#30

Post by ninjakeyboard »

If your server is detected, that's a security vulnerability. You should never be able to identify the underlying technology of your stack or you open yourself to attack on any known vulnerabilities where as if your stack is unknown, then the vectors for attack are much less obvious.
Post reply on HN