1

I was bothered in knowing with whatcms.org a version can be given for drupal 8, even a minor version - no minor version, instead, when I tried with a drupal 7. Curiously enough in my case, I got a version slightly newer (just one minor version ahead), but I'm concerned anyway, should I not?

I'm thinking of every situation where a security update cannot be performed right away. I don't even know how can the version be guessed from outside. I issued a tail -f on the access log while pressing the Detect CMS button on whatcms.org, but, mysteriously, I got no log entry from there. Perhaps they cache the previous results on the same site not to perform a fetch each time the button is pressed with the same domain string input?

8
  • 3
    This question comes up over and over again, and over and over it is the same answer: There is no security through obscurity. Why should an evil bot waste ressouces with an additional version check request, if he can right away hit the vulnerable URL?
    – Hudri
    Commented Sep 27, 2020 at 17:51
  • If they were doing those checks, they would not even try to access a URL that is available from a site implemented in .NET in a Drupal site, or a WordPress URL in a Drupal site. As @Hudri said, they just try to gain access using a vulnerability; if they aren't able, they just pass to the next site.
    – apaderno
    Commented Sep 27, 2020 at 18:25
  • I'm sorry for the nth question on the same subject. Before posting I tried to find an answer, but I couldn't. I'm not knowledgeable about attacking practices, so I couldn't tell whether knowing a version number could be relevant to an attacker or not. Besides I'd be however curious about how version can be read from outside, even disregarding in my case I read a version slightly different from the real one. In the HTTP headers I read just, it's a drupal CMS. So I wonder where the other piece of information can be read withouth accessing the file system or the administration interface.
    – AppLEaDaY
    Commented Sep 27, 2020 at 18:26
  • 2
    You can know the exact version Drupal.org is using by looking at drupal.org/CHANGELOG.txt. For a Drupal 8 site, the relative path is slightly different: /core/CHANGELOG.txt. Only the Drupal 9 CHANGELOG.txt file is vague enough to make just understand the site is running Drupal.)
    – apaderno
    Commented Sep 27, 2020 at 19:57
  • 1
    Does this answer your question? How can I obscure what I am using to run my site?
    – greggles
    Commented Sep 7, 2023 at 12:31

2 Answers 2

1

If you want to hide the Drupal version then you can use the following module:

https://www.drupal.org/project/remove_http_headers

1
  • 1
    I say don't try to hide it, be proud of running Drupal dang it!
    – No Sssweat
    Commented Sep 28, 2020 at 9:48
0

whatcms.org does not seem to get the right Drupal version used on a site; for drupal.org, it reports it is using Drupal 7.92, while drupal.org is using Drupal 7.96, which is the version visible in its CHANGELOG.txt file.

While Drupal 8.x stopped to give detailed information about the changes in the recently created releases in its CHANGELOG.txt file, it is possible to understand whether a site is using Drupal 8 because that files contains the following line.

For a full list of fixes in the latest release, visit: https://www.drupal.org/8/download

Drupal 9.0.x changed that line to the following one, more generic.

For a full list of fixes in the latest release, visit: https://www.drupal.org/latest-release

There could be other publicly accessible files that can be used to understand what Drupal version is used, especially knowing which JavaScript libraries are used from each Drupal version (and which version of those JavaScript libraries). For example, the absence of the jQuery Once library, on a site that could be either be using Drupal 9 or Drupal 10, says the site is using Drupal 10 or any higher version; if the installed jQuery version is 3.6.3, the site could be using Drupal 9.5, 10.0.x, or 10.1.x, any release created after December 21, 2022.

You can alter the HTTP headers returned by a Drupal site, but sites could still gather information from the files they are still able to access, including any JavaScript or CSS file, which are necessary for a browser to correctly render Drupal pages and cannot be made inaccessible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.