Tech Fingerprint

tech-fingerprint

When to Use

• Need to identify what technologies a website is running
• Discovering CMS platforms (WordPress, Drupal, Joomla)
• Finding JavaScript frameworks (React, Angular, Vue)
• Identifying web servers and their versions
• Mapping attack surface for known vulnerabilities
• Looking for outdated software with CVEs
• User asks "what is this site built with?"
• Preparing for targeted vulnerability scanning
• Building technology profiles for multiple targets

Quick Start

# Fast fingerprint with httpx
echo "https://example.com" | httpx -silent -td -sc -title

# Deep fingerprint with WhatWeb
whatweb -a 3 https://example.com

Step-by-Step Process

Phase 1: Quick Technology Detection (Httpx)

1. Basic tech detection:

   echo "https://example.com" | httpx -silent -td
   

2. With status and title:

   cat urls.txt | httpx -silent -td -sc -title
   

3. Full fingerprint output:

   cat urls.txt | httpx -silent -td -sc -title -server -json -o fingerprint.json
   

4. WordPress detection:

   cat urls.txt | httpx -silent -wp -json -o wordpress.json
   

5. CPE detection for CVE mapping:

   cat urls.txt | httpx -silent -cpe -json -o cpe.json
   

Phase 2: Deep Fingerprinting (WhatWeb)

1. Stealthy scan (single request):

   whatweb -a 1 https://example.com
   

2. Aggressive scan (version detection):

   whatweb -a 3 https://example.com
   

3. Heavy scan (full enumeration):

   whatweb -a 4 https://example.com
   

4. JSON output:

   whatweb --log-json=results.json https://example.com
   

5. Scan from file:

   whatweb -i urls.txt --log-json=whatweb.json
   

6. Verbose with plugin info:

   whatweb -v https://example.com
   

Phase 3: Combine Results

# Run both tools
cat urls.txt | httpx -silent -td -json -o httpx_tech.json
whatweb -i urls.txt --log-json=whatweb_tech.json

# Extract unique technologies
cat httpx_tech.json | jq -r '.tech[]?' | sort -u > technologies.txt

Phase 4: Filter High-Value Targets

# Find WordPress sites
cat httpx_tech.json | jq -r 'select(.tech | contains(["WordPress"])) | .url'

# Find specific framework
cat httpx_tech.json | jq -r 'select(.tech | contains(["Laravel"])) | .url'

# Find outdated Apache
whatweb -i urls.txt -a 3 | grep -i "apache/2.2"

Examples

Example 1: Quick Technology Scan

Scenario: Fast tech detection across many targets

subfinder -d example.com -silent | httpx -silent -td -sc -title

Output:

https://www.example.com [200] [Example Domain] [nginx,PHP,WordPress]
https://api.example.com [200] [API] [nginx,Node.js,Express]
https://shop.example.com [200] [Shop] [Apache,PHP,Magento]

Example 2: WordPress Detection

Scenario: Find WordPress sites and their plugins/themes

cat urls.txt | httpx -silent -wp -json | jq

Output:

{
  "url": "https://blog.example.com",
  "wordpress": {
    "version": "6.4.2",
    "plugins": ["contact-form-7", "yoast-seo", "woocommerce"],
    "themes": ["flavor"]
  }
}

Example 3: Deep Version Detection

Scenario: Get exact software versions for CVE research

whatweb -a 3 https://example.com

Output:

https://example.com [200 OK] Apache[2.4.41], Country[US], HTML5, HTTPServer[Ubuntu Linux][Apache/2.4.41 (Ubuntu)], IP[93.184.216.34], JQuery[3.5.1], PHP[7.4.3], PoweredBy[PHP/7.4.3], Script[text/javascript], Title[Example Domain], X-Powered-By[PHP/7.4.3]

Example 4: JSON Pipeline

Scenario: Structured output for further processing

whatweb -a 3 --log-json=tech.json https://example.com
cat tech.json | jq '.plugins | keys[]'

Output:

Apache
HTML5
HTTPServer
JQuery
PHP
Title

Example 5: CPE for Vulnerability Mapping

Scenario: Get CPE identifiers for CVE database lookups

echo "https://example.com" | httpx -silent -cpe -json | jq '.cpe'

Output:

["cpe:/a:apache:http_server:2.4.41", "cpe:/a:php:php:7.4.3"]

Example 6: Filter by Technology

Scenario: Find all sites running specific technology

# Find React apps
cat urls.txt | httpx -silent -td -json | jq -r 'select(.tech | contains(["React"])) | .url'

# Find PHP sites
cat urls.txt | httpx -silent -td -json | jq -r 'select(.tech | any(. | test("PHP"))) | .url'

Example 7: WhatWeb Specific Plugin

Scenario: Check only for specific technology

whatweb -p wordpress,joomla,drupal https://example.com

Output:

https://example.com [200 OK] WordPress[6.4.2]

Example 8: Comprehensive Recon Pipeline

Scenario: Full technology fingerprinting workflow

TARGET="example.com"
mkdir -p recon/$TARGET

# Discover subdomains
subfinder -d $TARGET -silent -o recon/$TARGET/subs.txt

# Probe live hosts with tech detection
cat recon/$TARGET/subs.txt | httpx -silent -td -sc -title -server -json -o recon/$TARGET/httpx.json

# Deep scan with WhatWeb on live hosts
cat recon/$TARGET/httpx.json | jq -r '.url' | whatweb -i /dev/stdin -a 3 --log-json=recon/$TARGET/whatweb.json

# Summary
echo "Technologies found:"
cat recon/$TARGET/httpx.json | jq -r '.tech[]?' | sort | uniq -c | sort -rn

Error Handling

Tool Reference

Httpx Technology Flags

WhatWeb Flags

WhatWeb Aggression Levels

Output Interpretation

Httpx JSON Output

{
  "timestamp": "2024-01-15T10:30:00Z",
  "url": "https://example.com",
  "status_code": 200,
  "title": "Example Site",
  "webserver": "nginx/1.18.0",
  "tech": ["nginx", "PHP", "WordPress", "MySQL"],
  "cpe": ["cpe:/a:nginx:nginx:1.18.0"]
}

WhatWeb JSON Output

{
  "target": "https://example.com",
  "http_status": 200,
  "plugins": {
    "Apache": { "version": ["2.4.41"] },
    "PHP": { "version": ["7.4.3"] },
    "WordPress": { "version": ["6.4.2"] },
    "JQuery": { "version": ["3.5.1"] }
  }
}

Common Technologies by Category

Advanced Techniques

Custom Fingerprint File

# Use custom fingerprint rules with httpx
httpx -u https://example.com -td -cff custom_fingerprints.json

Favicon Hash Matching

# Get favicon hash for identification
echo "https://example.com" | httpx -silent -favicon

# Match known favicon hashes
httpx -l urls.txt -favicon -mfc 1494302000  # Match specific hash

JARM Fingerprinting

# TLS fingerprint for server identification
echo "https://example.com" | httpx -silent -jarm

Certificate Analysis

# Extract tech info from TLS certificates
echo "https://example.com" | httpx -silent -tls-grab -json | jq '.tls'

Grep-Based Filtering

# WhatWeb grep for specific patterns
whatweb -g "admin" https://example.com

# Search for version patterns
whatweb -a 3 https://example.com | grep -oE "[a-zA-Z]+/[0-9.]+"

Best Practices

Recommended Workflow

1. Start with httpx - Fast tech detection across many targets
2. Filter interesting targets - WordPress, outdated software
3. Deep scan with WhatWeb - Version detection on filtered targets
4. Extract CPEs - Map to CVE database
5. Document findings - JSON output for processing

Performance Tips

• Use httpx -silent for clean pipeline output
• Set rate limits with -rl for large scans
• Use WhatWeb -a 1 for initial pass, -a 3 for follow-up
• Use -json output for programmatic processing
• Run httpx first (faster), then WhatWeb on filtered targets
• Use --no-cookies in WhatWeb for faster high-volume scans

Accuracy Tips

• WhatWeb -a 3 provides better version detection
• Combine multiple tools for comprehensive coverage
• Check both HTTP and HTTPS versions
• Some technologies only detectable via specific paths
• Favicon hashes can identify technologies missed by other methods

Integration Examples

Pipe to Nuclei

# Scan WordPress sites for WP-specific CVEs
cat urls.txt | httpx -silent -td -json | \
  jq -r 'select(.tech | contains(["WordPress"])) | .url' | \
  nuclei -t cves/wordpress/

Pipe to Searchsploit

# Find exploits for detected technologies
whatweb -a 3 https://example.com --log-brief=- | \
  grep -oE "[A-Za-z]+/[0-9.]+" | \
  while read tech; do searchsploit "$tech"; done

Export for Reporting

# Generate CSV report
cat httpx_tech.json | jq -r '[.url, (.tech | join(";"))] | @csv' > tech_report.csv

References

• Httpx GitHub
• Httpx Docs
• WhatWeb GitHub
• WhatWeb Wiki
• Wappalyzer Technologies
• CPE Dictionary