Web
Fingerprinting & Tech Stack Identification
reference
- Recon
- Enumerate
- Foothold
- PrivEsc
- Lateral
- Post-Ex
whatweb · automated tech detection
whatweb http://<TARGET-IP> -a 3 -v | tee scans/whatweb.txt
whatweb https://<TARGET-IP> -a 3 -v
curl header inspection · manual but reliable
curl -sI http://<TARGET-IP>
curl -sI https://<TARGET-IP>
curl -sv http://<TARGET-IP> 2>&1 | grep -E "< |> "
nikto · vulnerability scanner + info disclosure
nikto -h http://<TARGET-IP> -o scans/nikto.txt -Format txt
nikto -h http://<TARGET-IP> -C all -o scans/nikto_full.txt
wappalyzer equivalent · builtwith via CLI
Use browser extension Wappalyzer on the target, or:
webanalyze -host http://<TARGET-IP> -crawl 2
SSL/TLS inspection (HTTPS targets)
sslscan <TARGET-IP>:443
testssl.sh <TARGET-IP>:443
nmap --script ssl-enum-ciphers -p 443 <TARGET-IP>
What to extract
- Web server (Apache, Nginx, IIS, LiteSpeed) + version
- Backend language (PHP, Python, Ruby, Java, ASP.NET)
- CMS (WordPress, Joomla, Drupal, etc.)
- Framework (Laravel, Django, Rails, Spring)
- JavaScript libraries + versions
- Cookie names (PHPSESSID = PHP, JSESSIONID = Java, ASP.NET_SessionId = .NET)