用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-info-08命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | wstg-info-08 |
| description | Fingerprint Web Application Framework |
| category | information-gathering |
| owasp_id | WSTG-INFO-08 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["recon","fingerprint","enumeration","wstg","info"] |
| tech_stack | [] |
| cwe_ids | ["CWE-200"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INFO-08
Fingerprint Web Application Framework
Web application framework fingerprinting identifies the underlying technologies, libraries, and frameworks used to build a web application. This information helps penetration testers understand the testing landscape, identify known vulnerabilities specific to detected frameworks, and tailor their testing approach. Common frameworks include WordPress, Django, Laravel, Spring, ASP.NET, and many others, each with their own security characteristics and common vulnerabilities.
# Check response headers
curl -sI https://target.com | grep -iE 'server|x-powered-by|x-aspnet|x-drupal|x-generator'
curl -sI https://target.com
| Header | Value | Framework |
|---|---|---|
| X-Powered-By | PHP/7.4 | PHP |
| X-Powered-By | ASP.NET | ASP.NET |
| X-Powered-By | Express | Node.js/Express |
| X-Drupal-Cache | HIT | Drupal |
| X-Generator | Drupal 9 | Drupal |
| X-Pingback | /xmlrpc.php | WordPress |
| Server | Werkzeug | Flask |
| Server | gunicorn | Python (often Django) |
# Check Set-Cookie headers
curl -sI https://target.com | grep -i 'set-cookie'
# Check cookies on multiple pages
for path in / /login /admin; do
echo "=== $path ==="
curl -sI "https://target.com$path" | grep -i 'set-cookie'
done
| Cookie Name | Framework |
|---|---|
| PHPSESSID | PHP |
| ASP.NET_SessionId | ASP.NET |
| JSESSIONID | Java |
| csrftoken, sessionid | Django |
| laravel_session | Laravel |
| CAKEPHP | CakePHP |
| ci_session | CodeIgniter |
| wordpress_logged_in | WordPress |
| Drupal.visitor | Drupal |
| _rails_session | Ruby on Rails |
| connect.sid | Express.js |
# Download and analyze HTML
curl -s https://target.com | grep -iE 'generator|powered|framework|cms'
# Check for meta generator tag
curl -s https://target.com | grep -i '<meta name="generator"'
# Check for framework-specific comments
curl -s https://target.com | grep -oE '<!--.*?-->' | head -20
<!-- WordPress -->
<meta name="generator" content="WordPress 6.0" />
<link rel="stylesheet" href="/wp-content/themes/theme/style.css" />
<script src="/wp-includes/js/jquery/jquery.min.js"></script>
<!-- Drupal -->
<meta name="Generator" content="Drupal 9" />
<link rel="stylesheet" href="/sites/default/files/css/..." />
<!-- Joomla -->
<meta name="generator" content="Joomla! - Open Source Content Management" />
<!-- Django -->
<input type="hidden" name="csrfmiddlewaretoken" value="..." />
<!-- Laravel -->
<meta name="csrf-token" content="..." />
<input type="hidden" name="_token" value="..." />
# Check file extensions
curl -s https://target.com/sitemap.xml | grep -oP 'https?://[^\s<]+' | grep -oP '\.[a-z]+$' | sort | uniq -c
# Test common framework paths
for path in \
/wp-admin \
/wp-login.php \
/administrator \
/admin \
/user/login \
/rails/info \
/.env \
/config.php \
/web.config; do
status=$(curl -s -o /dev/null -w "%{http_code}" "https://target.com$path")
echo "$path: $status"
done
| Extension | Technology |
|---|---|
| .php | PHP |
| .asp, .aspx | ASP.NET |
| .jsp, .jsf | Java |
| .do | Java Struts |
| .action | Java Struts 2 |
| .cfm | ColdFusion |
| .pl | Perl |
| .py | Python (rare) |
# WordPress indicators
curl -s -o /dev/null -w "%{http_code}" https://target.com/wp-content/
curl -s -o /dev/null -w "%{http_code}" https://target.com/wp-includes/
# Drupal indicators
curl -s -o /dev/null -w "%{http_code}" https://target.com/sites/default/
curl -s -o /dev/null -w "%{http_code}" https://target.com/core/
# Joomla indicators
curl -s -o /dev/null -w "%{http_code}" https://target.com/components/
curl -s -o /dev/null -w "%{http_code}" https://target.com/modules/
# Laravel indicators
curl -s -o /dev/null -w "%{http_code}" https://target.com/storage/
curl -s -o /dev/null -w "%{http_code}" https://target.com/public/
# Trigger errors to reveal framework
curl -s "https://target.com/nonexistent-page-12345"
curl -s "https://target.com/?id='"
curl -s "https://target.com/index.php?test[]=1"
| Error Pattern | Framework |
|---|---|
| "Fatal error: Uncaught" | PHP |
| "Server Error in '/' Application" | ASP.NET |
| "Whitelabel Error Page" | Spring Boot |
| "DoesNotExist at /" | Django |
| "Routing Error" | Ruby on Rails |
| "Cannot GET /..." | Express.js |
# Extract JavaScript files
curl -s https://target.com | grep -oP 'src="[^"]*\.js[^"]*"'
# Check for known libraries
curl -s https://target.com | grep -iE 'jquery|react|angular|vue|backbone'
# Look for version comments
curl -s https://target.com/js/jquery.min.js | head -5
# Basic scan
whatweb https://target.com
# Aggressive scan
whatweb -a 3 https://target.com
# Verbose output
whatweb -v https://target.com
# Multiple targets
whatweb -i targets.txt
# Install
npm i -g wappalyzer
# Scan
wappalyzer https://target.com
# JSON output
wappalyzer https://target.com --pretty
# Nikto includes framework detection
nikto -h https://target.com
| Tool | Description | Usage |
|---|---|---|
| WhatWeb | Web fingerprinting | whatweb https://target.com |
| Wappalyzer CLI | Technology detection | wappalyzer https://target.com |
| Nikto | Web scanner | nikto -h target.com |
| httpx | HTTP toolkit | echo target.com | httpx -tech-detect |
| Webanalyze | Technology detection | webanalyze -host target.com |
| Extension | Browser |
|---|---|
| Wappalyzer | Chrome, Firefox |
| BuiltWith | Chrome, Firefox |
| Retire.js | Chrome, Firefox |
| WhatRuns | Chrome |
| Service | URL |
|---|---|
| BuiltWith | builtwith.com |
| Netcraft | toolbar.netcraft.com |
| W3Techs | w3techs.com |
| SimilarTech | similartech.com |
#!/bin/bash
TARGET=$1
echo "=== FRAMEWORK FINGERPRINTING ==="
echo "Target: $TARGET"
echo ""
# Headers
echo "[+] Checking HTTP headers..."
curl -sI "https://$TARGET" | grep -iE 'server|x-powered|x-generator|x-drupal|x-aspnet'
echo ""
# Cookies
echo "[+] Checking cookies..."
curl -sI "https://$TARGET" | grep -i 'set-cookie'
echo ""
# Meta tags
echo "[+] Checking meta tags..."
curl -s "https://$TARGET" | grep -i '<meta name="generator"'
echo ""
# Common paths
echo "[+] Checking framework paths..."
declare -A paths=(
["/wp-admin"]="WordPress"
["/wp-login.php"]="WordPress"
["/administrator"]="Joomla"
["/user/login"]="Drupal"
["/admin"]="Generic Admin"
["/rails/info"]="Rails"
)
for path in "${!paths[@]}"; do
status=$(curl -s -o /dev/null -w "%{http_code}" "https://$TARGET$path")
if [ "$status" != "404" ]; then
echo "Found: $path (${paths[$path]}) - Status: $status"
fi
done
echo ""
# WhatWeb
echo "[+] Running WhatWeb..."
whatweb -q "https://$TARGET"
# WordPress specific checks
curl -s https://target.com | grep -i 'wp-content\|wp-includes\|wordpress'
curl -s https://target.com/wp-json/ | head -20
curl -s https://target.com/readme.html | grep -i 'version'
curl -s https://target.com/license.txt | head -10
# WordPress version from feed
curl -s https://target.com/feed/ | grep -i 'generator'
# Enumerate WordPress users
curl -s "https://target.com/?author=1"
curl -s https://target.com/wp-json/wp/v2/users
# Drupal specific checks
curl -s https://target.com | grep -i 'drupal'
curl -s https://target.com/CHANGELOG.txt | head -20
curl -s https://target.com/core/CHANGELOG.txt | head -20
curl -s -I https://target.com | grep -i 'x-drupal\|x-generator'
# Remove X-Powered-By
Header unset X-Powered-By
# Custom Server header
ServerTokens Prod
ServerSignature Off
# Remove version
server_tokens off;
# Using headers-more module
more_clear_headers 'X-Powered-By';
more_clear_headers 'Server';
; php.ini
expose_php = Off
// PHP
session_name('CUSTOMSESSION');
// Laravel (.env)
SESSION_COOKIE=custom_session
# Django (settings.py)
SESSION_COOKIE_NAME = 'custom_session'
CSRF_COOKIE_NAME = 'custom_csrf'
// WordPress (functions.php)
remove_action('wp_head', 'wp_generator');
# Django - don't include in templates
# Apache
ErrorDocument 404 /errors/404.html
ErrorDocument 500 /errors/500.html
# Django (settings.py)
DEBUG = False
Important: Obscuring framework information is "security through obscurity" and should not be the primary defense. Focus on:
- Keeping frameworks updated
- Proper security configuration
- Regular vulnerability scanning
- Web Application Firewall (WAF)
Base Score: 5.3 (Medium)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
| Metric | Value | Description |
|---|---|---|
| Attack Vector | Network | Internet accessible |
| Attack Complexity | Low | Simple techniques |
| Privileges Required | None | No authentication |
| User Interaction | None | No interaction needed |
| Confidentiality | Low | Technology disclosure |
| Integrity | None | No integrity impact |
| Availability | None | No availability impact |
| Finding | Severity | Impact |
|---|---|---|
| Framework version visible | Low | Aids targeted attacks |
| Outdated framework detected | Medium-High | Known vulnerabilities |
| Debug mode enabled | High | Detailed error info |
| Default credentials possible | Critical | Direct access |
| CWE ID | Title | Description |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information | Technology disclosure |
| CWE-16 | Configuration | Improper configuration |
[ ] HTTP headers analyzed
[ ] Cookies examined for framework indicators
[ ] HTML source reviewed for patterns
[ ] META generator tag checked
[ ] File extensions noted
[ ] Directory structure probed
[ ] Error messages triggered and analyzed
[ ] JavaScript libraries identified
[ ] WhatWeb scan completed
[ ] Wappalyzer scan completed
[ ] Framework version determined
[ ] Known vulnerabilities researched
[ ] Technology stack documented