[meow]

You can try brute forcing common files & directories with XMLHttpRequest().

This^, looking for comments in pages unique to that CMS, looking at the robots.txt file, and finding images and checking the md5 sums of the images unique to that CMS are all common ways of fingerprinting.