How Tech Stacks Fit Together

Which layer each technology sits on, what it runs on, where its code comes from and how far a flaw reaches.

A tech stack is the set of layers an application runs on, from the physical machine at the bottom to the app people use at the top. Each layer runs on the one beneath it, and the databases sit to one side, because the app reaches them over the network.

When a new flaw is announced, the layer it sits on tells you how far it reaches and what else to check. A flaw low down reaches everything that runs on it, so a flaw in the operating system reaches every app on that machine. A front end such as nginx only passes requests on, so a flaw in it puts that traffic at risk but cannot run code in the apps behind it.

Where to Start

New to this? Read in this order.

  1. Read the layer pages, from the Application layer down.
  2. Pick a common stack below to light the layers it uses.
  3. Pick a technology to see how far a flaw in it reaches.
  4. Finish with Where the Code Comes From, on code from outside the team.

The Stack, From the Application Down to the Hardware

Pick a common stack to light the layers it uses. Then pick a technology or a source of code to open its panel and learn how far a flaw or a bad package reaches. The arrow keys move between the technologies.

  1. Application, in this stack, exposed

    The product people use, such as the intranet, the mail server or a website.

  2. Framework and Libraries, in this stack, exposed

    Ready-made building blocks the application is written with.

  3. Web and App Servers, in this stack, exposed

    Takes web requests, then runs the app or passes them to the server that does.

  4. Runtime, in this stack, exposed

    Runs the application code. Technologies here are rivals, not layers.

  5. Containers, not in this stack

    Packages an application with what it needs and runs it on a shared host.

  6. Operating System, in this stack

    Runs everything on the machine and controls its files, users and network.

  7. Virtualisation, not in this stack

    Splits one physical server into many virtual machines.

  8. Firmware, not in this stack

    Code built into the hardware that starts it and runs below the OS.

  9. Hardware, not in this stack

    The physical machine.

  • Data, in this stack, exposed

    The database where the application keeps its records.

  • Where the Code Comes From, 2 sources in this stack

    Outside code the stack runs, by where it comes from.

If Windows Server has a flaw, SharePoint, ASP.NET, IIS, .NET and SQL Server are exposed, because they run on Windows Server.

SharePoint, On Premises. You run every layer, so you patch SharePoint, ASP.NET, IIS, .NET, SQL Server and Windows yourself.

Microsoft's updates bring every layer of the farm, and custom solutions built for it add packages from NuGet.

  • In This Stack
  • Selected
  • Exposed (runs on it, or holds data it can reach)
  • Traffic at Risk (sits behind it)

Operating System

Windows Server

Microsoft's server operating system.

Microsoft

Rivals
Linux
In Stacks
Code Comes From
Vendor Updates

If It Has a Flaw

A flaw in the operating system reaches every application and service on that machine.

Exposed in This Stack

SharePointASP.NETIIS.NETSQL Server

How to Spot It

These signs show it is running, seen from outside without signing in.

Default port
3389 (Remote Desktop)
Default port
445 (SMB file sharing)
Default port
135 (RPC endpoint mapper)

Well-Known Flaws

Each CVE id is the public number of a known flaw, linked to its advisory.

Open the Full Page for Windows Server

Product names and logos are trademarks of their owners, shown only to name each product, with no endorsement implied. npm is a registered trademark of npm, Inc.

Apache, Apache HTTP Server, Tomcat and Log4j are trademarks of the Apache Software Foundation. Node.js® is a registered trademark of the OpenJS Foundation, and Kubernetes® of LF Projects, LLC.

Linux® is the registered trademark of Linus Torvalds in the U.S. and other countries. Docker and the Docker logo are trademarks or registered trademarks of Docker, Inc. in the United States and/or other countries.

MongoDB® is a registered trademark of MongoDB, Inc. Redis® is a registered trademark of Redis Ltd. Any rights therein are reserved to Redis Ltd.

PHP logo by Colin Viebrock, CC BY-SA 4.0 (opens in a new tab). Ruby logo © 2006 Yukihiro Matsumoto, CC BY-SA 2.5 (opens in a new tab). Tux by Larry Ewing, with Garrett LeSage and IFo Hancroft.

Puma logo © Evan Phoenix and contributors, CC BY-ND 3.0 (opens in a new tab). NuGet logo from NuGet's Media repository, CC BY 2.0 (opens in a new tab).

Gunicorn logo © Benoît Chesneau and Paul J. Davis, MIT licence for the Gunicorn logo (opens in a new tab). Packagist logo © 2011 Jordi Boggiano and Nils Adermann, MIT licence for the Packagist logo (opens in a new tab).

MIT Licence Notices for the Gunicorn and Packagist Logos

Gunicorn logo

2009-2024 (c) Benoît Chesneau <benoitc@gunicorn.org> 2009-2015 (c) Paul J. Davis <paul.joseph.davis@gmail.com>

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Packagist logo

Copyright (c) 2011 Jordi Boggiano, Nils Adermann

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.