Lion Cipher Lab
Fingerprint a web app's technologies with WhatWeb
- Penetration Testing / Red Team
- Beginner
- ~35 min
- Free · no account required
Why it matters
Every web app is built from layers, a web server, maybe a framework, a content management system, JavaScript libraries, and each layer is software with a version and a public history of known bugs. Fingerprinting is how you find out which layers a site is running. For an attacker that turns a nameless website into a shopping list, known technology points straight at known vulnerabilities. For a defender the exact same report is an attack-surface inventory: it tells you what you are actually exposing, so you can ask whether it is current, whether you meant to run it, and what needs patching.…
What you'll learn
- web technology fingerprinting
- reading HTTP response headers and banners
- using WhatWeb
- understanding scan aggression levels
- mapping your own attack surface
- authorized-use discipline
Steps in this lab
- The one rule, before you fingerprint anything
- What fingerprinting, banners, and a CMS actually are
- Why fingerprinting matters, both ways
- Install WhatWeb
- Point WhatWeb at your OWN test app: the first, gentle run
- Read the report: plugins, banners, and versions
- Turn up the aggression, and understand the reality
- What you just did, and why it is recon done right