ASP.NET: Application framework

What ASP.NET is

ASP.NET is Microsoft's web application framework, spanning the older .NET Framework stack and modern ASP.NET Core. Older deployments announce their exact version in response headers, which is both the clearest detection signal and a reason many operators remove them.

How DNSTrace.dev detects it

Detection reads the final HTTPS response and the first bytes of its markup. One matching signal is reported as strong evidence; two or more independent signals are reported as confirmed.

x-aspnet-version — The .NET Framework version, emitted by older configurations.
x-aspnetmvc-version — The ASP.NET MVC version, emitted by older configurations.
x-powered-by naming ASP.NET — The general framework banner.
server: Microsoft-IIS — The web server commonly in front, reported separately from the framework.

What a detection proves

The application is built on ASP.NET.

What it does not prove

That the version headers are accurate or current. They can be set manually, and their absence is common because publishing an exact framework version is discouraged as a hardening measure.

Common questions

Should a site remove x-aspnet-version?

Publishing an exact framework version narrows an attacker's search without benefiting visitors, and removing it is standard hardening guidance. DNSTrace.dev reports the header when present rather than recommending it.

Does ASP.NET Core emit these headers?

Generally not. Modern ASP.NET Core deployments are quieter, so detection often relies on the x-powered-by banner or nothing at all.