Fingerprinting

Tech Stack Fingerprinting

Knowing it's Spring Boot 2.5 → CVE-2022-22965 candidate. Knowing it's "Java" → useless.

When to invoke

Trigger phrases:

• "what's running on X"
• "fingerprint this host"
• "tech stack of target"
• "version of framework"

What we identify

Step-by-Step Workflow

1. Quick scan with httpx

# tech-detect uses Wappalyzer logic
echo "https://app.target.com" | httpx -tech-detect -title -web-server -status-code -json | jq .

# Bulk on alive hosts:
cat live.txt | httpx -tech-detect -web-server -json | tee tech-detected.jsonl

Output sample:

{
  "url": "https://app.target.com",
  "tech": ["React", "Next.js:13.4", "Cloudflare", "Webpack"],
  "webserver": "cloudflare",
  "title": "Target App"
}

2. Deep scan with WhatWeb

# WhatWeb has wider plugin DB than httpx
whatweb -v --color=never -a 3 "https://app.target.com"

# Aggression levels:
#  1 = passive (just GET /)
#  3 = standard (default)
#  4 = heavy (lots of requests)

3. Header forensics

# Manual but precise:
curl -sI "https://app.target.com" | grep -iE "server|x-powered-by|x-aspnet|x-runtime|via|cf-ray|x-amz-|x-azure-"

# Examples of what to look for:
# X-Powered-By: PHP/7.4.3
# X-AspNet-Version: 4.0.30319
# X-Runtime: 0.045821 → Ruby on Rails
# Server: nginx/1.18.0 (Ubuntu)
# Via: 1.1 vegur → Heroku
# X-Vercel-Id → Vercel hosting
# X-Amz-Cf-Id → AWS CloudFront

4. Cookie fingerprinting

curl -sI "https://app.target.com" | grep -i "set-cookie"

# Cookie names reveal stack:
# PHPSESSID → PHP
# JSESSIONID → Java
# .AspNet.ApplicationCookie → ASP.NET
# _csrf, _session → Rails
# laravel_session → Laravel
# connect.sid → Express
# session → Flask/generic
# next-auth.session-token → Next.js + NextAuth

5. Error page fingerprinting

# Common error-page paths to fingerprint stack
for path in "/foo/bar" "/api/random-uuid" "/404-this-doesnt-exist" "/.env" "/server-status"; do
    echo "=== $path ==="
    curl -s "https://app.target.com$path" | head -30
    echo
done

# Look for:
# - "Whitelabel Error Page" → Spring Boot
# - "Application Error" + heroku → Heroku app
# - "Cannot GET /foo" → Express
# - "DEBUG = True" Django stack trace → DEBUG mode (CRITICAL bug!)
# - "Internal Server Error" + Werkzeug → Flask

6. Frontend stack from JS bundle

# Get JS file URLs
curl -s "https://app.target.com" | grep -oE 'src="[^"]+\.js"' | sed 's/src="//;s/"$//'

# Check for framework fingerprints:
# react-dom.production.min.js → React
# vue.runtime.min.js → Vue
# @angular/core → Angular
# next/router → Next.js
# nuxt → Nuxt
# svelte → Svelte
# remix-run → Remix

# retire.js — find outdated JS libs
retire --jsrepo https://retirejs.github.io/retire.js/repository/jsrepo.json --js https://app.target.com

7. Nuclei tech-detect templates

# nuclei has hundreds of tech-detect templates
nuclei -u "https://app.target.com" -tags tech -silent

# Targeted: known versionable software
nuclei -u "https://app.target.com" -t http/technologies/ -silent

# Look for version disclosure
nuclei -u "https://app.target.com" -tags version -silent

8. Cloud / CDN detection

# DNS shows CNAME → CDN/provider
dig +short "app.target.com"

# Common CNAMEs:
# *.cloudfront.net → AWS CloudFront
# *.azureedge.net → Azure CDN
# *.fastly.net → Fastly
# *.cloudflare.com → Cloudflare (often via A record + IPs in CF range)
# *.ngrok.io → ngrok (developer tunnel — interesting!)
# *.herokuapp.com → Heroku
# *.vercel.app → Vercel
# *.netlify.app → Netlify
# *.s3.amazonaws.com → S3 bucket (check ownership = takeover candidate)
# *.github.io → GitHub Pages (takeover candidate)

9. WAF detection

# wafw00f
pip install wafw00f
wafw00f "https://app.target.com"

# Manual:
# - 403 with "challenge" page → Cloudflare
# - 403 + cf-ray header → Cloudflare
# - 403 + akamai-x-cache header → Akamai
# - 406 + X-Iinfo → Imperva
# - 403 + X-Sucuri-ID → Sucuri

Output template

target: app.target.com
fingerprint_date: 2026-06-02

infrastructure:
  cdn: Cloudflare
  ip: 104.21.x.x (CF IP)
  origin_ip: unknown (CF protected)
  waf: Cloudflare WAF

web_server:
  product: nginx
  version: 1.18 (inferred from defaults)
  os: Ubuntu 20.04 LTS

backend:
  language: Node.js
  framework: Next.js 13.4
  evidence: |
    - X-Powered-By: Next.js
    - JS bundle: _next/static/
    - Headers: x-vercel-id (suggests Vercel hosting backed by Next.js)

frontend:
  framework: React 18.2
  bundler: Webpack 5
  state_mgmt: Redux Toolkit (from JS analysis)

api:
  style: REST + GraphQL
  rest_base: /api/v3
  graphql_endpoint: /api/graphql
  evidence: discovered in main.js bundle

authentication:
  type: NextAuth.js with custom OAuth provider
  cookie: next-auth.session-token
  jwt: yes (verified via JWT decoding)

cms: none

interesting_tech:
  - GraphQL endpoint exposed (introspection?)
  - NextAuth handles session — check JWT signing
  - Vercel serverless — different attack surface (cold starts, env vars)
  - WebSocket on /api/ws — possible RT data exchange

Tech → vuln class lookup

Use this to decide what to hunt next:

Cross-references

• [[asset-discovery]] — runs before this
• [[js-analysis]] — deeper JS endpoint mining
• [[content-discovery]] — fuzz paths based on tech
• [[nuclei]]-style scanning — match templates to fingerprinted stack

Common pitfalls

1. Trusting Server: header alone. It's often reverse-proxy, not the actual app.
2. Missing JS-based SPA detection. SPA = different attack surface.
3. Not checking all origin endpoints. Same domain may have multiple stacks behind path-based routing.
4. Treating Cloudflare as the app. WAF can mislead — try origin IP if findable.
5. Skipping the error pages. Stack traces > Wappalyzer fingerprints any day.

Pro tips

• Bring up devtools in the browser. Network tab shows headers + cookies in seconds.
• Note _next/, __nuxt/, _remix/ paths. They signal SSR frameworks → unique bug classes.
• Save fingerprint to loot/<target>/fingerprint.yaml. Re-use for re-tests.
• Run fingerprinting weekly on active targets. Tech stack updates create new attack windows.