Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/uphiago/recon-skills --skill cms-detectionThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.
Attack SAML SSO via XSW, signature strip, metadata extract.
Use when two or more verified findings may combine into a higher-impact authorized attack path.
Showing SKILL.md
Based on SOC occupation classification
| name | cms-detection |
| description | Identify CMS, frameworks, and server technology stacks on live hosts. |
| version | 1.1.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, httpx, nuclei |
| tags | ["recon","CMS","fingerprinting","technology","WordPress","Drupal","Joomla","Magento"] |
| category | recon |
| related_skills | ["web-enumeration","wordpress-plugin-hunt","visual-recon","wp-mass-recon"] |
Identify the content management system, web framework, server software, and technology stack of every live host. Know which stack you're attacking before you attack it — a WordPress site needs different tests than a Laravel API or a Spring Boot microservice. Multi-CMS detection covers WordPress, Drupal, Joomla, Magento, Shopify, Wix, Squarespace, Laravel, Django, Express, Spring Boot, and more.
terminal with httpx, whatweb, wappalyzer, and curl.skill_view(name='visual-recon') or skill_view(name='subdomain-enumeration').# Fastest: httpx with built-in tech detection
cat alive_subs.txt | httpx -silent -tech-detect -o tech_detect.txt
# Deep: whatweb with aggressive checks
whatweb -i alive_subs.txt -a 3 -t 50 --log-brief=cms_results.txt
# httpx — fast tech detection using Wappalyzer signatures
cat alive_subs.txt | httpx -silent -tech-detect -o tech_httpx.txt
# Parse results: extract unique technologies with counts
cat tech_httpx.txt | awk -F' [' '{print $2}' | tr -d ']' | tr ',' '\n' \
| sed 's/^ *//' | sort | uniq -c | sort -rn > tech_summary.txt
# whatweb — deeper, identifies specific CMS versions
whatweb -i alive_subs.txt -a 3 -t 50 \
--log-brief=cms_results.txt \
--log-json=cms_results.json
cms_results.json | jq -r \
| -u > versioned_cms.txt
# Generator meta tag
curl --max-time 30 --connect-timeout 10 -sk "https://target.com" | grep -Eo '<meta name="generator"[^>]*content="WordPress [^"]+' | head -1
# RSS feed
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/feed/" | grep -Eo '<generator>https://wordpress.org/\?v=[^<]+' | head -1
# readme.html (often left accessible)
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/readme.html" | grep -Eo "Version [0-9.]+" | head -1
# wp-json namespace
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/wp-json/" | jq -r '.namespaces[]' 2>/dev/null
# CHANGELOG.txt (Drupal's canonical version leak)
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/CHANGELOG.txt" | head -5
# Drupal specific paths
curl --max-time 30 --connect-timeout 10 -skI "https://target.com/user/login" | grep -i "drupal\|x-generator"
curl --max-time 30 --connect-timeout 10 -skI "https://target.com/node/1"
# Joomla version files
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/administrator/manifests/files/joomla.xml" | grep -Eo '<version>[^<]+' | head -1
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/language/en-GB/en-GB.xml" | grep -Eo '<version>[^<]+'
# Meta tag
curl --max-time 30 --connect-timeout 10 -sk "https://target.com" | grep -Eo '<meta name="generator"[^>]*content="Joomla[^"]+' | head -1
# Magento version file
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/magento_version" | head -1
# Composer lock
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/composer.lock" | jq -r '.packages[] | select(.name=="magento/magento2-base") | .version' 2>/dev/null
# Laravel debug info
curl --max-time 30 --connect-timeout 10 -sk "https://target.com" | grep -Eo 'Laravel v[0-9.]+'
# Composer lock
curl --max-time 30 --connect-timeout 10 -sk "https://target.com/composer.lock" | jq -r '.packages[] | select(.name=="laravel/framework") | .version' 2>/dev/null
# Server header — often removed but check anyway
for host in $(cat alive_subs.txt); do
echo -n "$host: "
curl --max-time 30 --connect-timeout 10 -skI "https://$host" | grep -i "server:\|x-powered-by:" | tr '\n' ' '
echo
sleep 0.3
done > server_headers.txt
# Common server signatures and what they mean
# nginx → likely PHP-FPM or Node.js proxy
# Apache → shared hosting, cPanel
# IIS → Windows, ASP.NET
# LiteSpeed → shared hosting, WordPress optimized
# cloudflare → CDN/WAF in front, need origin-ip-discovery
# Microsoft-IIS/10.0 → Windows Server 2016+
# Framework detection via specific paths
# Django admin: /admin/ → redirect to /admin/login/
# Rails: /assets/application-*.js pattern
# Express: X-Powered-By: Express
# Spring Boot: /actuator/health returns {"status":"UP"}
# Next.js: /_next/static/ chunks
# Categorize hosts by CMS for targeted testing
echo "=== WORDPRESS ==="
grep -i "wordpress" tech_detect.txt
echo "=== DRUPAL ==="
grep -i "drupal" tech_detect.txt
echo "=== OTHER CMS ==="
grep -iE "joomla|magento|shopify|wix|squarespace|ghost" tech_detect.txt
echo "=== FRAMEWORKS ==="
grep -iE "laravel|django|rails|express|spring|next\.js|nuxt" tech_detect.txt
echo "=== E-COMMERCE ==="
grep -iE "woocommerce|magento|shopify|prestashop|opencart" tech_detect.txt
echo "=== NO CMS (Static/Custom) ==="
cat alive_subs.txt | httpx -silent -td \
| grep -v -iE "wordpress|drupal|joomla|magento|laravel|django|rails"
# Map detected versions to known CVEs
# WordPress: check https://wpscan.com/wordpress-security/vulnerability-database/
# Drupal: check https://www.drupal.org/security
# Magento: check https://magento.com/security/patches
# searchsploit — local ExploitDB search
searchsploit wordpress 6.5
searchsploit drupal 10.2
searchsploit joomla 5.1
# nuclei — automated CVE detection on detected CMS
nuclei -l wordpress_sites.txt -t nuclei-templates/http/cves/2024/
-a 2 (less aggressive) on protected targets./wp-admin/ for WordPress, /user/login for Drupal)./actuator/health for Spring Boot).web-enumeration — Once CMS is identified, enumerate its specific paths and endpoints.wordpress-plugin-hunt — Deep plugin version detection for WordPress targets.wp-mass-recon — Batch WordPress vulnerability scanning.visual-recon — Confirm CMS detection with visual screenshot verification.deep-invade — Run nuclei CVE scans against detected versions.