# HTTP Tech Fingerprinting

> Identify web technologies, frameworks, servers & versions via HTTP headers, cookies, error pages, and tool-based analysis to map attack surface.

- **URL:** https://hackindex.io/services/web/enumeration/http-tech-fingerprinting
- **Path:** HTTP/HTTPS > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/web/enumeration.md)
- **Published:** 2026-01-23
- **Updated:** 2026-04-24

Fingerprinting runs first on any HTTP target. The output decides which wordlists to use, which CMS tooling applies, what extensions to bruteforce, and what vulnerability checks are relevant. A single curl command gives you server stack, cookies, security headers, and redirect behavior in seconds.

After fingerprinting, move to [content discovery](https://hackindex.io/services/web/enumeration/content-discovery) with stack-matched extensions. If a CMS is confirmed, jump directly to [WordPress](https://hackindex.io/services/web/enumeration/wordpress-enumeration), [Drupal](https://hackindex.io/services/web/enumeration/drupal-enumeration), or [Joomla enumeration](https://hackindex.io/services/web/enumeration/joomla-enumeration).

## Fast Baseline with curl

Pull headers without downloading the body. This is the fastest way to identify stack, cookies, and security posture:

```bash
curl -skI http://$TARGET_IP:$PORT/
# HTTP/1.1 200 OK
# Server: Apache/2.4.18 (Ubuntu)
# X-Powered-By: PHP/7.4.3
# Set-Cookie: PHPSESSID=abc123; path=/
# Content-Type: text/html
```

Headers to check in every response:

- `Server`: web server software and version (Apache, nginx, IIS)
- `X-Powered-By`: backend language and version (PHP, ASP.NET, Express)
- `Set-Cookie`: session cookie names reveal the framework or CMS
- `X-Generator`, `X-Drupal-Cache`: CMS-specific headers
- `Content-Security-Policy`: allowed script sources, potential bypass targets
- `Strict-Transport-Security`: HSTS presence and max-age
- `X-Frame-Options`: clickjacking protection status

Missing security headers are findings in themselves and feed into [misconfiguration scanning](https://hackindex.io/services/web/vulnerability-discovery/misconfiguration-scan).

Follow redirects and keep all headers to see where the chain lands:

```bash
curl -skIL http://$TARGET_IP:$PORT/
```

Test whether the server routes differently by Host header. Compare response sizes:

```bash
curl -skI http://$TARGET_IP:$PORT/ -H "Host: $DOMAIN"
```

Different `Content-Length`, `Location`, or `Set-Cookie` between requests confirms virtual host routing. Move to [virtual host enumeration](https://hackindex.io/services/web/enumeration/virtual-host-enumeration).

## HTTP Methods Check

OPTIONS reveals what methods the server accepts. PUT or WebDAV methods indicate an upload surface worth investigating:

```bash
curl -sk -X OPTIONS -i http://$TARGET_IP:$PORT/
# HTTP/1.1 200 OK
# Allow: GET,HEAD,POST,OPTIONS,PUT,PROPFIND
# DAV: 1,2
```

If you see `PUT`, `PROPFIND`, `MKCOL`, or `MOVE` in the Allow header, move to [WebDAV enumeration](https://hackindex.io/services/web/vulnerability-discovery/webdav-enumeration).

## TLS Certificate Triage

The SAN field often leaks additional hostnames not visible through DNS bruteforce. Use SNI with `-servername` for modern setups:

```bash
openssl s_client -connect $DOMAIN:443 -servername $DOMAIN </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName
# subject=CN=example.com
# subjectAltName:
#     DNS:example.com, DNS:dev.example.com, DNS:internal.corp
```

Feed subjectAltName hostnames back into [virtual host enumeration](https://hackindex.io/services/web/enumeration/virtual-host-enumeration). Internal hostnames in the SAN often reveal staging environments or internal services.

## whatweb

whatweb fingerprints stack, CMS, JavaScript libraries, and email addresses in one request. Use aggression level 3 for active probing:

```bash
whatweb -a 3 http://$TARGET_IP:$PORT/
# http://10.10.10.50/ [200 OK] Apache[2.4.18], Bootstrap[4.0.0], PHP[7.4.3], WordPress[5.9], JQuery[3.6.0], Title[My Site]
```

```bash
whatweb -a 3 https://$DOMAIN/ --log-brief=whatweb.txt
```

## httpx for Bulk Fingerprinting

When you have multiple hosts from subdomain bruteforce, probe all of them in parallel:

```bash
httpx -l hosts.txt -status-code -title -tech-detect -server -content-length -o httpx_results.txt
# https://dev.example.com [200] [Dev Portal] [nginx,PHP/7.4]
# https://api.example.com [401] [Unauthorized] [nginx]
# https://admin.example.com [302] [] [Apache]
```

```bash
httpx -u http://$TARGET_IP:$PORT/ -status-code -title -tech-detect -server -json
```

## nikto for Quick Misconfiguration Hints

nikto surfaces obvious misconfigurations, outdated server versions, and dangerous files quickly. Not a full scanner but useful for fast low-hanging findings after fingerprinting:

> [!WARNING]
> nikto is noisy and generates significant log entries on the target. Use only when active scanning is authorized.

```bash
nikto -h http://$TARGET_IP:$PORT/ -output nikto.txt
```

## References

- [WhatWeb](https://github.com/urbanadventurer/WhatWeb) - Fingerprinting rules, aggression levels, and output formats
- [httpx: ProjectDiscovery](https://docs.projectdiscovery.io/opensource/httpx) - Fast HTTP probing with tech detection flags
- [nikto](https://github.com/sullo/nikto) - Web server scanner for misconfigurations and outdated software