web-fingerprint

name	web-fingerprint
description	Find and fingerprint web servers on a target. Use when asked to "find web servers", "fingerprint a website", "what's running on this web server", "identify web technologies", or "scan for web services".
metadata	{"author":"dspy-skills","version":"1.0"}
allowed-tools	Bash(nmap:*)

Web Server Fingerprinting Playbook

Systematically discover and identify web servers and their technologies. You must complete all steps in sequence.

When to Use This Skill

Activate this skill when the user needs to:

• Find web servers on a target or network
• Identify what web technologies are running
• Fingerprint a website or web application
• Discover CMS, frameworks, or server software

Available Scripts

Script	Purpose
fetch_page.py	Fetch a web page and extract fingerprinting info

Script usage:

python scripts/fetch_page.py <url>
python scripts/fetch_page.py 192.168.1.1 --port 8080
python scripts/fetch_page.py 192.168.1.1 --https
python scripts/fetch_page.py example.com --json

---

Step 1: Port Discovery

Goal: Find open web server ports on the target.

Run this scan:

nmap -Pn -p 80,443,8080,8443,8000,8888,3000,5000 <target>

Parse output: Look for ports showing open state. Common web ports:

• 80 (HTTP)
• 443 (HTTPS)
• 8080, 8000, 8888 (Alt HTTP)
• 8443 (Alt HTTPS)
• 3000, 5000 (Dev servers)

Next: For EACH open port found, proceed to Step 2.

---

Step 2: Service Detection

Goal: Identify what web server software is running.

Run this scan:

nmap -Pn -sV -p <open_ports> <target>

Example: If Step 1 found ports 80 and 443 open:

nmap -Pn -sV -p 80,443 192.168.1.1

Parse output: Note the SERVICE and VERSION columns. Look for:

• Apache, nginx, IIS, lighttpd
• Version numbers
• Any additional info

Next: Proceed to Step 3 for each web port.

---

Step 3: Web Page Fingerprinting

Goal: Fetch the page and identify technologies.

Run the fetch_page.py script for each web port:

For HTTP (port 80):

python scripts/fetch_page.py <target>

For HTTPS (port 443):

python scripts/fetch_page.py <target> --https

For alternate ports:

python scripts/fetch_page.py <target> --port 8080
python scripts/fetch_page.py <target> --port 8443 --https

The script returns:

• HTTP status code
• Page title
• Server headers
• Detected technologies (CMS, frameworks, libraries)
• Page content preview

Next: Proceed to Step 4 to compile findings.

---

Step 4: Compile Report

Goal: Summarize all findings in a structured report.

Report format:

## Web Fingerprint Report

### Target: <target>
### Scan Date: <date>

### Open Web Ports
- Port 80: HTTP (open)
- Port 443: HTTPS (open)

### Server Software
- Port 80: Apache/2.4.41 (Ubuntu)
- Port 443: Apache/2.4.41 (Ubuntu)

### Web Technologies Detected
- CMS: WordPress 6.0
- Framework: PHP
- Libraries: jQuery 3.6
- CDN: Cloudflare

### Page Information
- Title: "Welcome to Example Site"
- Generator: WordPress 6.0

### Headers of Interest
- Server: Apache/2.4.41 (Ubuntu)
- X-Powered-By: PHP/8.1

### Observations
- WordPress admin panel at /wp-admin
- Login page detected
- Self-signed SSL certificate

---

Quick Reference

Task	Command
Find web ports	nmap -Pn -p 80,443,8080,8443 <target>
Service versions	nmap -Pn -sV -p <ports> <target>
Fetch HTTP page	python scripts/fetch_page.py <target>
Fetch HTTPS page	python scripts/fetch_page.py <target> --https
Fetch alt port	python scripts/fetch_page.py <target> -p 8080

Example Workflow

User asks: "What web servers are running on 192.168.1.1?"

Step 1: Scan for web ports

nmap -Pn -p 80,443,8080,8443,8000,8888,3000,5000 192.168.1.1

Output shows: 80/tcp open, 443/tcp open

Step 2: Get service versions

nmap -Pn -sV -p 80,443 192.168.1.1

Output shows: Apache httpd 2.4.41

Step 3: Fingerprint each port

python scripts/fetch_page.py 192.168.1.1
python scripts/fetch_page.py 192.168.1.1 --https

Output shows: WordPress detected, jQuery, PHP

Step 4: Report findings to user

Constraints

• Always complete all 4 steps
• Scan each open web port individually in Step 3
• Some servers may not respond to fingerprinting
• Self-signed certificates are handled automatically