Technology Fingerprinting
Identify web servers, frameworks, CMS platforms, WAFs, CDNs, and third-party services to map the target's technology stack and find version-specific vulnerabilities.
Tools
Machine-readable JSON available at:
https://reconatlas.pages.dev/api/checklists/technology-fingerprintingTags
// checklist steps
techfp-01
Analyse HTTP response headers
Inspect HTTP headers returned by the target to identify web server software, framework versions, caching layers, and security headers.
curl -sI https://target.com | grep -iE 'server|x-powered|x-aspnet|x-generator|x-drupal|via|x-cache'
curl -sI https://target.com -H 'Accept: application/json' | head -30Headers like Server, X-Powered-By, and X-AspNet-Version directly reveal technology versions. Some servers strip these in production but leak them on error pages or non-standard endpoints.
techfp-02
Run Wappalyzer and WhatWeb scans
Use automated fingerprinting tools to detect web technologies, JavaScript frameworks, analytics services, and server-side platforms.
whatweb -a 3 https://target.com --log-json whatweb-results.json
whatweb -a 3 -i live-hosts.txt --log-json whatweb-bulk.jsonWhatWeb aggression level 3 sends additional requests for deeper detection. Use level 1 if you need to stay stealthy. Wappalyzer is best used as a browser extension during manual browsing.
techfp-03
Detect WAF and CDN presence
Identify web application firewalls and content delivery networks that may filter your payloads or mask the origin server.
wafw00f https://target.com
wafw00f -l https://target.com -a
nmap --script http-waf-detect -p 443 target.comKnowing the WAF vendor (Cloudflare, Akamai, AWS WAF) helps you tailor payloads to bypass filtering rules. A CDN may also hide the origin IP, which you can sometimes recover through DNS history or email headers.
techfp-04
Identify CMS platforms
Detect content management systems like WordPress, Drupal, or Joomla and enumerate plugins, themes, and version details.
CMSeeK -u https://target.com --batch
wpscan --url https://target.com --enumerate vp,vt,u --api-token YOUR_TOKENWordPress sites with outdated plugins are one of the most common bug bounty targets. Always enumerate plugins and themes — vulnerabilities in third-party components are frequently missed by the development team.
techfp-05
Detect JavaScript libraries and frameworks
Identify client-side JavaScript libraries, their versions, and known vulnerabilities by analysing page source and loaded scripts.
curl -s https://target.com | grep -oE 'jquery[.-][0-9]+\.[0-9]+\.[0-9]+'
curl -s https://target.com | grep -oE 'react|angular|vue|ember|backbone' | sort -u
nuclei -u https://target.com -t technologies/ -o tech-detection.txtOutdated JavaScript libraries (especially jQuery, Angular 1.x) often have known XSS vectors. Use retire.js or Snyk to check detected versions against vulnerability databases.
techfp-06
Fingerprint via error pages and default files
Trigger error responses and request default installation files to reveal technology details that normal pages hide.
curl -s https://target.com/nonexistent-page-xyz | head -50
curl -s https://target.com/web.config
curl -s https://target.com/wp-login.php
curl -s https://target.com/elmah.axdCustom 404 pages may leak server software in comments or meta tags. Default files like web.config, elmah.axd, or phpinfo.php confirm specific technology stacks.
techfp-07
Detect API technologies and documentation
Identify API frameworks, documentation endpoints, and schema files that reveal backend architecture and available endpoints.
curl -s https://target.com/swagger.json | jq '.info'
curl -s https://target.com/api-docs
curl -s https://target.com/graphql?query=\{__schema\{types\{name\}\}\}
curl -s https://target.com/openapi.yaml | head -20Exposed Swagger/OpenAPI documentation is a goldmine for finding undocumented endpoints. GraphQL introspection queries can map the entire API schema if not disabled.
Overview
Technology fingerprinting turns a list of live hosts into actionable intelligence. Knowing that a target runs WordPress 6.1 with the Contact Form 7 plugin tells you exactly which CVEs to check. Knowing Cloudflare sits in front tells you to look for origin IP leaks and tailor your payloads for WAF bypass.
This phase is lightweight and mostly passive. Most fingerprinting tools send only a handful of HTTP requests, making them safe to run even against targets with strict rate limits.
What to look for
Prioritise findings that lead directly to vulnerability checks:
- Specific version numbers for web servers, CMS platforms, and frameworks
- WAF/CDN presence that will affect your testing approach
- Exposed API documentation (Swagger, GraphQL introspection)
- Outdated JavaScript libraries with known CVEs
- Default installation files or error pages leaking internal paths