Skip to content
HackIndex logo

HackIndex

HTTP Tech Fingerprinting

5 min read Apr 24, 2026

Fingerprinting runs first on any HTTP target. The output decides which wordlists to use, which CMS tooling applies, what extensions to bruteforce, and what vulnerability checks are relevant. A single curl command gives you server stack, cookies, security headers, and redirect behavior in seconds.

After fingerprinting, move to content discovery with stack-matched extensions. If a CMS is confirmed, jump directly to WordPress, Drupal, or Joomla enumeration.

Fast Baseline with curl

Pull headers without downloading the body. This is the fastest way to identify stack, cookies, and security posture:

┌──(kali㉿kali)-[~]
└─$ curl -skI http://$TARGET_IP:$PORT/ 
HTTP/1.1 200 OK
Server: Apache/2.4.18 (Ubuntu)
X-Powered-By: PHP/7.4.3
Set-Cookie: PHPSESSID=abc123; path=/
Content-Type: text/html
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allow insecure TLS connections by skipping certificate verification.
-I Send a HEAD request and fetch HTTP headers only.
http://$TARGET_IP:$PORT/ Target URL composed of the destination IP and port variables.

Look for Server, X-Powered-By, Set-Cookie, and security headers like Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options. Missing security headers are findings in themselves and feed into misconfiguration scanning.

Follow redirects and keep all headers to see where the chain lands:

┌──(kali㉿kali)-[~]
└─$ curl -skIL http://$TARGET_IP:$PORT/
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allow insecure connections; skip SSL/TLS certificate verification.
-I Send HEAD request; fetch response headers only.
-L Follow redirects automatically if the server returns a 3xx response.
http://$TARGET_IP:$PORT/ Target URL with variable host IP and port to probe.

Test whether the server routes differently by Host header. Compare response sizes:

┌──(kali㉿kali)-[~]
└─$ curl -skI http://$TARGET_IP:$PORT/ -H "Host: $DOMAIN"
Explain command
-s Silent mode; suppresses progress and error output.
-k Allow insecure TLS connections; skip certificate verification.
-I Send HEAD request; fetch response headers only.
http://$TARGET_IP:$PORT/ Target URL with variable host IP and port.
-H "Host: $DOMAIN" Set custom Host header to specify virtual host domain.

Different Content-Length, Location, or Set-Cookie between requests confirms virtual host routing. Move to virtual host enumeration.

HTTP Methods Check

OPTIONS reveals what methods the server accepts. PUT or WebDAV methods indicate an upload surface worth investigating:

┌──(kali㉿kali)-[~]
└─$ curl -sk -X OPTIONS -i http://$TARGET_IP:$PORT/ 
HTTP/1.1 200 OK
Allow: GET,HEAD,POST,OPTIONS,PUT,PROPFIND
DAV: 1,2
Explain command
-s Silent mode; suppresses progress meter and error messages.
-k Allow insecure connections; skips SSL/TLS certificate verification.
-X OPTIONS Sends an HTTP OPTIONS request method to the server.
-i Include HTTP response headers in the output.
http://$TARGET_IP:$PORT/ Target URL built from variable IP address and port number.

If you see PUT, PROPFIND, MKCOL, or MOVE in the Allow header, move to WebDAV enumeration.

TLS Certificate Triage

The SAN field often leaks additional hostnames not visible through DNS bruteforce. Use SNI with -servername for modern setups:

┌──(kali㉿kali)-[~]
└─$ openssl s_client -connect $DOMAIN:443 -servername $DOMAIN </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName 
subject=CN=example.com
subjectAltName:
    DNS:example.com, DNS:dev.example.com, DNS:internal.corp

Feed subjectAltName hostnames back into virtual host enumeration. Internal hostnames in the SAN often reveal staging environments or internal services.

whatweb

whatweb fingerprints stack, CMS, JavaScript libraries, and email addresses in one request. Use aggression level 3 for active probing:

┌──(kali㉿kali)-[~]
└─$ whatweb -a 3 http://$TARGET_IP:$PORT/ 
http://10.10.10.50/ [200 OK] Apache[2.4.18], Bootstrap[4.0.0], PHP[7.4.3], WordPress[5.9], JQuery[3.6.0], Title[My Site]
Explain command
-a 3 Sets aggression level to 3 (aggressive), sending more HTTP requests.
http://$TARGET_IP:$PORT/ Target URL with variable IP address and port to fingerprint.
┌──(kali㉿kali)-[~]
└─$ whatweb -a 3 https://$DOMAIN/ --log-brief=whatweb.txt
Explain command
-a 3 Sets aggression level to 3 (aggressive), sending more HTTP requests.
https://$DOMAIN/ Target URL with placeholder domain to fingerprint.
--log-brief=whatweb.txt Logs brief output (one line per result) to the specified file.

httpx for Bulk Fingerprinting

When you have multiple hosts from subdomain bruteforce, probe all of them in parallel:

┌──(kali㉿kali)-[~]
└─$ httpx -l hosts.txt -status-code -title -tech-detect -server -content-length -o httpx_results.txt 
https://dev.example.com [200] [Dev Portal] [nginx,PHP/7.4]
https://api.example.com [401] [Unauthorized] [nginx]
https://admin.example.com [302] [] [Apache]
Explain command
-l hosts.txt Read target hosts from the specified input file.
-status-code Display the HTTP response status code for each host.
-title Extract and display the HTML page title from responses.
-tech-detect Detect web technologies using Wappalyzer-based signatures.
-server Display the Server response header value.
-content-length Display the Content-Length of the HTTP response body.
-o httpx_results.txt Write output results to the specified file.
┌──(kali㉿kali)-[~]
└─$ httpx -u http://$TARGET_IP:$PORT/ -status-code -title -tech-detect -server -json
Explain command
-u http://$TARGET_IP:$PORT/ Target URL with variable IP and port to probe.
-status-code Display the HTTP response status code.
-title Extract and display the page title from the response.
-tech-detect Detect web technologies used by the target.
-server Display the server header from the HTTP response.
-json Output results in JSON format.

nikto for Quick Misconfiguration Hints

nikto surfaces obvious misconfigurations, outdated server versions, and dangerous files quickly. Not a full scanner but useful for fast low-hanging findings after fingerprinting:

┌──(kali㉿kali)-[~]
└─$ nikto -h http://$TARGET_IP:$PORT/ -output nikto.txt
Explain command
-h Specifies the target host or URL to scan.
http://$TARGET_IP:$PORT/ Target URL with variable host IP and port placeholder.
-output Writes scan results to the specified output file.
nikto.txt File where the scan output will be saved.

References