Test if a URL uses Node.js

[sisk]

In addition to the coffeescript / browserify detection, here are the headers it checks[0]:

  var frameworks = [
    {name: 'express.js', s: "express", h: 'x-powered-by'},
    {name: 'koa.js', s: 'koa', h: 'x-powered-by'},
    {name: 'sails.js', s: "sails", h: 'x-powered-by'},
    {name: 'ecstatic', s: 'ecstatic', h: 'server'},
    {name: 'flatiron', s: 'flatiron', h: 'x-powered-by'}
  ]

All in all, this should prove relatively inaccurate. A vanilla http server from node sets neither server nor x-powered-by headers. Many frameworks don't set them, either (Walmart's hapi, PayPal's krakenjs, etc).

Fun toy project but if you're really interesting in fingerprinting, check out the OWASP entry on the subject[1].

[0]: https://github.com/dotheyusenode/dotheyusenode/blob/ea235619...

[1]: https://www.owasp.org/index.php/Testing_for_Web_Application_...

[wlaurance]

Yes, it is just a toy project. It is a lot more work to fingerprint successfully. OWASP looks very interesting. Thanks for the link and subsequently the white paper links!

[laumars]

Pretty pointless since all this does is check the x-powered-by HTTP response header (which can be turned off[1]). If this captured other web frameworks as well (eg PHP also outputs to x-powered-by in it's default config) then this might be a little less pointless - but even then, most production sites should have those information leaks sealed anyway (you don't actually improve security, but at least it slows the attacker down a little as you're not spoon-feeding them information about your server build)

[1] http://stackoverflow.com/questions/5867199/cant-get-rid-of-h...

[wlaurance]

It checks x-powered-by and Server in some cases. https://github.com/dotheyusenode/dotheyusenode/blob/master/c...

It also tries to read through the Javascript served up to see if it uses browserify. https://github.com/dotheyusenode/dotheyusenode/blob/master/c...

But yes it is a glorified `curl -I www.foo.com | grep -i 'x-powered-by` UI

[avree]

Does node even have an x-powered-by response header by default?

I thought you need a framework (like Express.js) and then to not have turned off the header.

[dylanpyle]

Just a heads up, there's already a handful of private staging/demo server URLs @ http://dotheyusenode.herokuapp.com/cache - you may want to reconsider exposing that for the publicly available instance.

[panarky]

nodejs.org

"Maybe, but we cannot tell"

[wlaurance]

Haha yeah, for anything static not served up by a framework that leaks headers it doesn't really do very well :)

[Gurrewe]

Does anyone know if Node.js has any "easter egg" like PHP < 5.5 has?

You can simply add ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 to the URI of most PHP-sites and the server will respond with the PHP-credits [0].

[0]: http://thepiratebay.se/?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C1...

[avree]

No, that would be insanity.

[nly]

This can be turned off, even in PHP.

[pornel]

I hoped for something smarter, like testing quirks/bugs in the node's HTTP server.

[wlaurance]

Put in a PR! Currently, it is easy to do things with the Request object. Any ideas on what quirks/bugs to look into?

[randunel]

"Maybe, but we cannot tell". Great script, I could build in in node.js in 10 seconds :D

[hayksaakian]

If you can't tell if airbnb uses node, I'm note sure it works at all.

[camus2]

I guess it's just checking for some header,like express has a special header... by the way, framework authors, please refrain from doing stuffs like that. The framework i use is nobody's business but mine.

[wlaurance]

I'm not sure what they are using to serve up their site, other than nginx. But they do have this header, "X-Hi-Human: The AIRBNB SRE team added this header. Come work with us! Email [email protected]"

[meritt]

AirBNB is Ruby/RoR and Java.

[ebbv]

"Maybe but we cannot tell."

I win!

[vivekn]

What if you don't set the "Server" header?

[ninjakeyboard]

If your server is detected, that's a security vulnerability. You should never be able to identify the underlying technology of your stack or you open yourself to attack on any known vulnerabilities where as if your stack is unknown, then the vectors for attack are much less obvious.

[dmytrish]

Security through obscurity is not effective.