Microsoft ASP.NET
ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.
What detecting Microsoft ASP.NET tells you about a site
ASP.NET is Microsoft's server-side web stack, and its fingerprints are unusually candid. Classic giveaways: an X-AspNet-Version or X-Powered-By: ASP.NET header, an .aspx extension, an ASP.NET_SessionId cookie, or the enormous __VIEWSTATE hidden input in the HTML of Web Forms apps. Spotting it tells you the backend runs on .NET and almost certainly a Windows/IIS deployment — which in turn signals an enterprise, often Microsoft-shop organisation where C#, Active Directory integration and long support lifecycles matter more than front-end novelty.
The detail that matters for Microsoft ASP.NET
Distinguish the eras: a __VIEWSTATE field and .aspx paths mean legacy Web Forms or older MVC on .NET Framework, while a clean X-Powered-By with no ViewState and a Kestrel-style Server header points to modern, cross-platform ASP.NET Core — a very different, far more current codebase.
Microsoft ASP.NET in a real-world stack
When you find Microsoft ASP.NET, it rarely travels alone. IIS or Kestrel fronting the app, SQL Server behind it, and frequently Razor views or a Blazor/React front end.
About
ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.
Categories: Web frameworks
Quick facts
How we detect Microsoft ASP.NET
Sourcemap Explorer carries 9 fingerprint signals for Microsoft ASP.NET, spread across 5 channels — response header, cookie, html source, url pattern and dom selector. The exact patterns are listed below, and you can replay each one in Chrome DevTools to confirm a match by hand.
Each signal alone is rarely conclusive — Sourcemap Explorer cross-references all of them and weights by confidence. You can reproduce any of these checks yourself in Chrome DevTools.
Server-side fingerprint: the response header reveals the technology behind the page. Visible in DevTools → Network → response headers.
X-AspNet-Version: (.+)
X-Powered-By: ^ASP\.NET
set-cookie: \.AspNetCore
Cookies set by the platform. Visible in DevTools → Application → Cookies.
ASPSESSION
ASP\.NET_SessionId
\.ASPXAUTH
Substring or regex match against the page HTML — typically a unique class, comment marker, or asset path.
<input[^>]+name="__VIEWSTATE
The page URL itself follows a known pattern (vanity slugs, embeds, hosting URLs).
\.aspx?(?:$|\?)
A DOM selector that only this technology's pages render. Verified at runtime by the content script.
input[name*='__VIEWSTATE']
FAQ
How do I check if a website is using Microsoft ASP.NET?
Open the page in Chrome, click the Sourcemap Explorer toolbar icon, and read the Stack tab. Microsoft ASP.NET's specific fingerprints here are response header, cookie, html source, url pattern and dom selector, and the popup flags Microsoft ASP.NET whenever any combination of them is found. The same checks can be reproduced manually in DevTools — see the "How we detect" section above.
What Microsoft ASP.NET version can Sourcemap Explorer detect?
Microsoft ASP.NET ships as a hosted web frameworks rather than a bundled npm package, so version-specific detection isn't always possible. Where the platform leaks a version in response headers (`X-Powered-By`, `Server`, generator meta tags) we surface it; otherwise we report presence only.
Where can I read more about Microsoft ASP.NET?
Official site: https://www.asp.net. For Sourcemap Explorer's detection guide, see the deep-dive link below or the related guides in the cross-link section.
Detected by Sourcemap Explorer
Open the popup on any page running Microsoft ASP.NETand you'll see the exact version pulled from the bundled package.json when sourcemaps are exposed.