mirror of
https://github.com/davidalvarezp/websec-audit.git
synced 2026-06-23 11:48:28 +02:00
69 lines
1.8 KiB
Markdown
69 lines
1.8 KiB
Markdown
|
---
|
||
|
|
title: "Module 03 · Fingerprinting"
|
||
|
|
description: Technology stack detection, WAF identification and version-leaking header analysis.
|
||
|
|
---
|
||
|
|
|
||
|
|
# Module 03 · Fingerprinting
|
||
|
|
|
||
|
|
**Flag:** `--skip-fingerprint`
|
||
|
|
|
||
|
|
Identifies the technology stack, detects WAFs, and flags response headers that leak version information.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## Technology detection
|
||
|
|
|
||
|
|
Uses **WhatWeb** (aggression level 1 in normal mode, 3 in aggressive) to identify:
|
||
|
|
|
||
|
|
- Web server (nginx, Apache, IIS, LiteSpeed, Caddy)
|
||
|
|
- Programming language and framework (PHP, Django, Rails, Laravel, ASP.NET, Express)
|
||
|
|
- CMS (WordPress, Drupal, Joomla, Magento)
|
||
|
|
- JavaScript libraries and versions
|
||
|
|
- Analytics and tracking tools
|
||
|
|
- CDN and cloud provider
|
||
|
|
|
||
|
|
Output saved to `recon/whatweb.json` and `recon/whatweb_brief.txt`.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## WAF detection
|
||
|
|
|
||
|
|
Uses **wafw00f** to identify the presence and type of Web Application Firewall.
|
||
|
|
|
||
|
|
| Condition | Severity |
|
||
|
|
|---|:---:|
|
||
|
|
| No WAF detected | <span class="sev sev-low">LOW</span> |
|
||
|
|
| WAF identified | <span class="sev sev-info">INFO</span> |
|
||
|
|
|
||
|
|
A missing WAF is flagged as Low because it means there is no automatic filtering layer between the internet and the application.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## Version-leaking headers
|
||
|
|
|
||
|
|
The following response headers are checked. Any that disclose technology names or version numbers are flagged:
|
||
|
|
|
||
|
|
`Server` · `X-Powered-By` · `X-AspNet-Version` · `X-AspNetMvc-Version` · `X-Generator` · `X-CF-Powered-By` · `Via`
|
||
|
|
|
||
|
|
| Condition | Severity |
|
||
|
|
|---|:---:|
|
||
|
|
| Version-leaking header present | <span class="sev sev-low">LOW</span> |
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## Fallback
|
||
|
|
|
||
|
|
If `whatweb` is not installed, the module falls back to header-based detection using `curl`, scanning for technology names in the response headers and body.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## Output files
|
||
|
|
|
||
|
|
```
|
||
|
|
recon/
|
||
|
|
├── whatweb.json
|
||
|
|
├── whatweb_brief.txt
|
||
|
|
├── waf_detection.txt
|
||
|
|
└── basic_headers_raw.txt # fallback only
|
||
|
|
```
|