<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-technology-stack-fingerprinting
description: >-
  Fingerprint web application technology stacks including frameworks, CMS
  platforms, server software, CDNs, and third-party services through passive
  and active analysis techniques.
domain: cybersecurity
subdomain: osint-recon
tags:
  - technology-fingerprinting
  - wappalyzer
  - web-stack
  - cms-detection
  - service-enumeration
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: >-
  Wappalyzer, WhatWeb, httpx, Webanalyze, BuiltWith, Netcraft,
  Nuclei, wafw00f, retire.js, Shodan.
metadata:
  mitre-attack:
    - "T1592.004"  # Gather Victim Host Information: Client Configurations
    - "T1592.002"  # Gather Victim Host Information: Software
    - "T1595.002"  # Active Scanning: Vulnerability Scanning
---

# Analyzing Technology Stack Fingerprinting

## Overview

Technology stack fingerprinting identifies the software, frameworks, libraries,
and services powering a target's web infrastructure. This includes web servers,
CMS platforms, JavaScript frameworks, CDN providers, WAFs, analytics tools,
and third-party integrations. Accurate fingerprinting enables targeted
vulnerability research, exploit selection, and attack surface prioritization.

## Prerequisites

- httpx with tech-detect for bulk fingerprinting
- WhatWeb for detailed web technology identification
- wafw00f for WAF detection
- Nuclei with technology detection templates
- Wappalyzer CLI or browser extension
- BuiltWith API key (optional, for historical data)

```bash
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
pip install wafw00f webanalyze
sudo apt install whatweb -y
```

## Quick Reference

| Task | Command |
|------|---------|
| httpx tech detect | `httpx -l urls.txt -tech-detect -silent -json -o tech.json` |
| WhatWeb scan | `whatweb -v target.com --log-json=whatweb.json` |
| WAF detection | `wafw00f target.com -a -o waf.json -f json` |
| Nuclei tech | `nuclei -l urls.txt -t technologies/ -silent -json -o nuclei_tech.json` |
| Headers analysis | `curl -sI https://target.com \| grep -iE 'server\|x-powered-by\|x-generator'` |
| BuiltWith API | `curl -s "https://api.builtwith.com/free1/api.json?KEY=$BW_KEY&LOOKUP=target.com"` |
| Shodan lookup | `shodan host target_ip --fields hostnames,os,ports,vulns` |
| JS libraries | `retire --jspath /path/to/js --outputformat json` |

## Workflow

### Step 1: Passive Technology Identification

Identify technologies without active probing.

```bash
# BuiltWith API — historical technology data
curl -s "https://api.builtwith.com/free1/api.json?KEY=$BW_KEY&LOOKUP=target.com" \
  | jq '.Results[].Result.Paths[].Technologies[].Name'

# Shodan — banner-based identification
shodan search "hostname:target.com" --fields ip_str,port,product,version,os

# Netcraft site report (manual)
# https://sitereport.netcraft.com/?url=https://target.com

# Wappalyzer API
curl -s -H "x-api-key: $WAPPALYZER_KEY" \
  "https://api.wappalyzer.com/v2/lookup/?urls=https://target.com"
```

### Step 2: Active Fingerprinting

Directly probe targets for technology indicators.

```bash
# httpx — bulk technology detection
httpx -l urls.txt -tech-detect -status-code -title -silent -json -o httpx_tech.json

# WhatWeb — detailed fingerprinting
whatweb -v --aggression 3 target.com --log-json=whatweb.json

# HTTP response header analysis
curl -sI https://target.com | grep -iE \
  'server|x-powered-by|x-generator|x-drupal|x-aspnet|x-framework'

# Cookie analysis for framework detection
curl -sI https://target.com | grep -i set-cookie
# PHPSESSID=PHP, JSESSIONID=Java, ASP.NET_SessionId=.NET, _rails_session=Rails
```

### Step 3: WAF and CDN Detection

Identify protective infrastructure.

```bash
# wafw00f — WAF fingerprinting
wafw00f target.com -a -o waf_results.json -f json

# CDN detection via DNS
dig +short target.com CNAME
# .cloudfront.net=CloudFront, .fastly.net=Fastly, .akamai.net=Akamai

# Nuclei WAF detection
nuclei -u target.com -t http/technologies/waf-detect/ -silent -json
```

### Step 4: JavaScript and Client-Side Analysis

Enumerate front-end libraries and frameworks.

```bash
# Retire.js — vulnerable JS library detection
retire --jsrepo https://raw.githubusercontent.com/nicedoc/nicedoc/master/retirejs.json \
  --jspath ./js_files/ --outputformat json --outputpath retire.json

# Extract JS files for analysis
httpx -l urls.txt -path "/robots.txt" -silent | \
  grep -oP 'https?://[^\s]+\.js' | sort -u > js_files.txt

# Nuclei technology templates
nuclei -l urls.txt -t http/technologies/ -silent -json -o nuclei_tech.json
```

### Step 5: Compile Technology Profile

```bash
# Merge results into unified profile
node agent.js --domain target.com --full --output tech_profile.json
```

## Detection Opportunities

- Aggressive WhatWeb scans generate distinctive HTTP request patterns
- WAF fingerprinting tools send known bypass payloads
- Rapid requests to common CMS paths indicate enumeration
- Retire.js scanning downloads multiple JS files sequentially

## Verification

- [ ] Web server and application framework identified
- [ ] CMS platform and version detected (if applicable)
- [ ] WAF and CDN infrastructure mapped
- [ ] Third-party services and analytics enumerated
- [ ] JavaScript libraries and versions catalogued
- [ ] Technology stack documented with confidence levels

## References

- [Wappalyzer](https://www.wappalyzer.com/)
- [WhatWeb](https://github.com/urbanadventurer/WhatWeb)
- [httpx](https://github.com/projectdiscovery/httpx)
- [wafw00f](https://github.com/EnableSecurity/wafw00f)
- [BuiltWith](https://builtwith.com/)
- [Retire.js](https://retirejs.github.io/retire.js/)

---
v1.0 | Validated: 2026-03-17
