How to know whether a site is running in ATG?

405 Views Asked by At

Is there any way to know that whether a site is running in ATG or not? For Ex: By viewing page source or something like that.

1

There are 1 best solutions below

0
On

You can start off by interrogating the Response Headers and look for the X-ATG-Version

X-ATG-Version:version=QVRHUGxhdGZvcm0vOS4yIFsgRFBTTGljZW5zZS8wIEIyQ0xpY2Vuc2UvMCAgXQ==

That normally indicates that a site is running ATG. That said, a lot of has been said about sites hiding their response headers for security purposes (as suggested in RFC2068):

Revealing the specific software version of the server may allow the server machine to become more vulnerable to attacks against software that is known to contain security holes. Implementers SHOULD make the Server header field a configurable option.

If you don't already do this, you probably should.

Beyond the Response Header, the other tell tale sign that a site is using ATG is generally looking a the source code for the ever present hidden formhandlers

<input value="" type="hidden" name="/atg/commerce/order/purchase/CartModifierFormHandler.someFormElement">