Lion Cipher Lab
Read WhatWeb fingerprints: identify the stack and turn it into an investigation plan
- Penetration Testing / Red Team
- Beginner
- ~35 min
- Free · no account required
Why it matters
Anyone can run a scanner; the job is reading what it prints. A WhatWeb report is the bridge between 'here is a website' and 'here is exactly what I should test next' — it names the server, the content-management system, the JavaScript libraries and their versions, and once you know the exact tech AND the exact version, you can look up whether it has known, already-published holes. That is the single highest-leverage move in recon, and it is a favourite interview exercise: 'here's the fingerprint output — what do you do next?' This drill hands you a realistic report and teaches you to answer…
What you'll learn
- reading a WhatWeb fingerprint report line by line
- mapping plugin=value output to the real technology stack (server, CMS, library, PHP)
- turning an identified CMS + version into a known-vulnerability lookup
- turning an outdated JavaScript library into an advisory/CVE check
- spotting revealed admin paths, cookies and WAF hints, and what is merely informational
- judging when a fingerprint is a lead vs proof, and when a banner is misleading
- understanding passive vs active scan aggression and its tradeoffs
Steps in this lab
- What a fingerprint is, and why it's the bridge from recon to testing
- Ground rule: you only fingerprint what you're authorized to test
- The report you're handed (read it once, top to bottom)
- The infrastructure lines: server, language, network — and what's just informational
- The CMS line: WordPress 5.7.1 becomes a known-vulnerability lookup
- The library line: jQuery 1.12.4 becomes an advisory check (a worked example)
- Revealed paths, cookies, and the WAF hint
- Passive vs active: why this was an -a1 scan, and the tradeoff
- Turn the whole report into an investigation plan
- The judgment rule: when a fingerprint focuses you, and when a banner lies