What are the techniques of CMS fingerprinting?

CMS Fingerprinting can be done similar to what is done with nmap. You would need to compromise a library of unique urls, etc and than scan a page to see if they exhibit these.

• You can use BuiltWith.com.
  
• Here are some examples of it is use:
  
• Joomla.org being positively identified as Joomla
  
• Wordpress.org being positively identified as Wordpress
  
• Some other useful/related finds:
  
• Nmap Plugin to identify Drupal websites
  
• Scritch seems to have a script similar to BuiltWith
  
• Wapalyzer Plugin to do some detections
  
• web-sorrow: a perl based scanner which includes checks for CMS
  
• Blind Elephant: another scanner
  
• plecost: A wordpress specific scanner
  
• whatweb: yet another scanner which doesn't seem to be as actively developed
  
• OWASP Favicon DB: Not quite functional on its own, but if you hash the favicons as you download and they match, could be used as one indicator.
  

You could also do some google hacking with the url + keywords like "Joomla" or "Wordpress" to see if the site is listed in a showcase, they asked for help on a forum for a particular CMS and listed their site, comments, code hints, search for specific strings in the url, e.g., inurl:index.php?option=com_content.