Is there a simple way to determine what database is in use behind a website from an external HTTP request? i.e., I make an HTTP request, get back whatever data is going to come from the webserver - can I inspect any of that and reliably determine that DB in use? I am thinking not, but figured I would ask this group.
Not directly, anyway. But some languages will leave a signature in the headers of the web server.<p>If you see the server is IIS then you can take an educated guess that the DB is microsoft SQL server.<p>Another way of doing it is searching for the name of the website and the name of various popular database engines, with a bit of luck you might find a blog posting by a technie or a question in some support forum by someone working for company X.
There's the 'ethically dubious' method of trying a bunch of SQL injection tricks against the site and seeing what works. Many attacks target only certain database vendor and version.<p>SQL injection cheatsheet: <a href="http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/" rel="nofollow">http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/</a><p>Please don't try this unless you have permission, or it's your own site.
curl -I <a href="http://example.com/" rel="nofollow">http://example.com/</a><p>You can divine a bit of information from the site that way, but it is only guessing. Some sites expose information when they encounter an error, so if there's a method to trigger one, that could be useful.<p>Many WordPress blogs, for instance, show MySQL connection errors under high load, etc.