{
  "slug": "technology-fingerprinting",
  "title": "Technology Fingerprinting",
  "phase": "Reconnaissance",
  "description": "Identify web servers, frameworks, CMS platforms, WAFs, CDNs, and third-party services to map the target's technology stack and find version-specific vulnerabilities.",
  "difficulty": "low",
  "tags": [
    "reconnaissance",
    "fingerprinting",
    "waf",
    "cms",
    "technology-stack"
  ],
  "tools": [
    "WhatWeb",
    "Wappalyzer",
    "wafw00f",
    "CMSeeK",
    "WPScan"
  ],
  "steps": [
    {
      "id": "techfp-01",
      "title": "Analyse HTTP response headers",
      "description": "Inspect HTTP headers returned by the target to identify web server software, framework versions, caching layers, and security headers.",
      "commands": [
        "curl -sI https://target.com | grep -iE 'server|x-powered|x-aspnet|x-generator|x-drupal|via|x-cache'",
        "curl -sI https://target.com -H 'Accept: application/json' | head -30"
      ],
      "notes": "Headers like Server, X-Powered-By, and X-AspNet-Version directly reveal technology versions. Some servers strip these in production but leak them on error pages or non-standard endpoints."
    },
    {
      "id": "techfp-02",
      "title": "Run Wappalyzer and WhatWeb scans",
      "description": "Use automated fingerprinting tools to detect web technologies, JavaScript frameworks, analytics services, and server-side platforms.",
      "commands": [
        "whatweb -a 3 https://target.com --log-json whatweb-results.json",
        "whatweb -a 3 -i live-hosts.txt --log-json whatweb-bulk.json"
      ],
      "notes": "WhatWeb aggression level 3 sends additional requests for deeper detection. Use level 1 if you need to stay stealthy. Wappalyzer is best used as a browser extension during manual browsing."
    },
    {
      "id": "techfp-03",
      "title": "Detect WAF and CDN presence",
      "description": "Identify web application firewalls and content delivery networks that may filter your payloads or mask the origin server.",
      "commands": [
        "wafw00f https://target.com",
        "wafw00f -l https://target.com -a",
        "nmap --script http-waf-detect -p 443 target.com"
      ],
      "notes": "Knowing the WAF vendor (Cloudflare, Akamai, AWS WAF) helps you tailor payloads to bypass filtering rules. A CDN may also hide the origin IP, which you can sometimes recover through DNS history or email headers."
    },
    {
      "id": "techfp-04",
      "title": "Identify CMS platforms",
      "description": "Detect content management systems like WordPress, Drupal, or Joomla and enumerate plugins, themes, and version details.",
      "commands": [
        "CMSeeK -u https://target.com --batch",
        "wpscan --url https://target.com --enumerate vp,vt,u --api-token YOUR_TOKEN"
      ],
      "notes": "WordPress sites with outdated plugins are one of the most common bug bounty targets. Always enumerate plugins and themes — vulnerabilities in third-party components are frequently missed by the development team."
    },
    {
      "id": "techfp-05",
      "title": "Detect JavaScript libraries and frameworks",
      "description": "Identify client-side JavaScript libraries, their versions, and known vulnerabilities by analysing page source and loaded scripts.",
      "commands": [
        "curl -s https://target.com | grep -oE 'jquery[.-][0-9]+\\.[0-9]+\\.[0-9]+'",
        "curl -s https://target.com | grep -oE 'react|angular|vue|ember|backbone' | sort -u",
        "nuclei -u https://target.com -t technologies/ -o tech-detection.txt"
      ],
      "notes": "Outdated JavaScript libraries (especially jQuery, Angular 1.x) often have known XSS vectors. Use retire.js or Snyk to check detected versions against vulnerability databases."
    },
    {
      "id": "techfp-06",
      "title": "Fingerprint via error pages and default files",
      "description": "Trigger error responses and request default installation files to reveal technology details that normal pages hide.",
      "commands": [
        "curl -s https://target.com/nonexistent-page-xyz | head -50",
        "curl -s https://target.com/web.config",
        "curl -s https://target.com/wp-login.php",
        "curl -s https://target.com/elmah.axd"
      ],
      "notes": "Custom 404 pages may leak server software in comments or meta tags. Default files like web.config, elmah.axd, or phpinfo.php confirm specific technology stacks."
    },
    {
      "id": "techfp-07",
      "title": "Detect API technologies and documentation",
      "description": "Identify API frameworks, documentation endpoints, and schema files that reveal backend architecture and available endpoints.",
      "commands": [
        "curl -s https://target.com/swagger.json | jq '.info'",
        "curl -s https://target.com/api-docs",
        "curl -s https://target.com/graphql?query=\\{__schema\\{types\\{name\\}\\}\\}",
        "curl -s https://target.com/openapi.yaml | head -20"
      ],
      "notes": "Exposed Swagger/OpenAPI documentation is a goldmine for finding undocumented endpoints. GraphQL introspection queries can map the entire API schema if not disabled."
    }
  ],
  "references": [
    "https://github.com/urbanadventurer/WhatWeb",
    "https://github.com/EnableSecurity/wafw00f",
    "https://github.com/Tuhinshubhra/CMSeeK",
    "https://github.com/wpscanteam/wpscan",
    "https://portswigger.net/research/web-technology-fingerprinting"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-06-17"
}