4 ms·
Ask HN: Determining DB in use from HTTP?
Is there a simple way to determine what database is in use behind a website from an external HTTP request? i.e., I make an HTTP request, get back whatever data is going to come from the webserver - can I inspect any of that and reliably determine that DB in use? I am thinking not, but figured I would ask this group.
- jawngee 17y agoNo.
- jacquesm 17y agoNot directly, anyway. But some languages will leave a signature in the headers of the web server. If you see the server is IIS then you can take an educated guess that the DB is microsoft SQL server. Another way of doing it is searching for the name of the website and the name of various popular database engines, with a bit of luck you might find a blog posting by a technie or a question in some support forum by someone working for company X.
- deleted 17y ago[deleted]
- bhousel 17y agoThere's the 'ethically dubious' method of trying a bunch of SQL injection tricks against the site and seeing what works. Many attacks target only certain database vendor and version. SQL injection cheatsheet: http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/ http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/ Please don't try this unless you have permission, or it's your own site.
- astrodust 17y agocurl -I http://example.com/ http://example.com/ You can divine a bit of information from the site that way, but it is only guessing. Some sites expose information when they encounter an error, so if there's a method to trigger one, that could be useful. Many WordPress blogs, for instance, show MySQL connection errors under high load, etc.