skills.rest
mccleod1290
mccleod1290COMMUNITY
Explore all skills by this author →
GitHub

fingerprint-web-server

Fingerprint web servers via raw-socket HTTP probes per OWASP WSTG-INFO-02.

1|Updated Jul 2, 2026
Search Tags:#owasp#http#web server#fingerprinting#bug bounty#recon#cdn detection
One-click install
npx skills add https://github.com/mccleod1290/bb-agentic-setupv2 --skill fingerprint-web-server-mccleod1290
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: fingerprint-web-server
Source: https://github.com/mccleod1290/bb-agentic-setupv2/tree/main/web-skills/fingerprint-web-server
Command: npx skills add https://github.com/mccleod1290/bb-agentic-setupv2 --skill fingerprint-web-server-mccleod1290

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Identifying the exact web server software, version, framework, and CDN/WAF in front of a target is essential for targeted security testing, but banners are often suppressed or spoofed, and standard HTTP libraries hide the low-level signals that reveal the true stack. ## Core Features & Use Cases - Raw-socket probing: Sends crafted and malformed HTTP requests (bad version, bad method, OPTIONS, TRACE, 404) over a raw socket to capture exact header order and casing that higher-level libraries normalize away. - Multi-signal inference: Combines banner grabbing, 35+ session-cookie signatures, error-page fingerprints, malformed-request behavior, and CDN/WAF detection to identify the stack even when the Server header is suppressed. - Shodan pivot support: Computes md5 and mmh3 favicon hashes for Shodan http.favicon.hash pivots to unmask CDN-fronted origin servers. - Use Case: During an authorized bug-bounty recon phase, run the fingerprinter against an in-scope host to produce REPORT.md, fingerprint.json, and raw response captures, then route disclosed versions into CVE research hypotheses. ## Quick Start Ask the assistant to fingerprint an authorized in-scope host such as https://example.com and save the report into the target's recon-data folder.

Frequently Asked Questions about fingerprint-web-server

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fingerprint a web server to identify its software and version?▼

Run the fpserver.py script against the target host, for example: python scripts/fpserver.py https://example.com. It sends about ten crafted probes and writes REPORT.md, fingerprint.json, and raw responses with an inference of server, framework, language, and CDN/WAF.

How to detect Apache vs nginx vs IIS when the Server header is hidden?▼

When banners are suppressed, the tool falls back on secondary signals: on-the-wire header order and casing, 404 error-page body signatures, session-cookie tells like PHPSESSID or JSESSIONID, and malformed-request behavior such as differing responses to a bad HTTP version.

Does the fingerprinting script require any Python packages?▼

No external packages are needed. The script uses only the Python 3 standard library, including socket, ssl, hashlib, and a built-in MurmurHash3 implementation for the Shodan-style favicon hash.

Can I detect a CDN or WAF in front of a web server?▼

Yes, the tool detects Cloudflare, Akamai, Fastly, CloudFront, Sucuri, Imperva, Vercel, Netlify, Azure, Google Frontend, and Varnish via header and cookie signatures. When detected, the banner is treated as the edge and a favicon mmh3 Shodan pivot is suggested to find the origin.

Is active web server fingerprinting safe to run against any host?▼

No, it is active testing and must only run against authorized, in-scope hosts. The skill mandates confirming scope first, sends only about ten non-destructive requests, and supports a --delay flag to pace probes under rate limits.

What happens if the fingerprinting script fails or the host blocks it?▼

The documented fallback chain escalates to raw CLI tools like curl and openssl s_client for malformed requests, then to a browser-based approach for header and cookie observation, and finally to passive sources like Shodan, Censys, and Wappalyzer.

Related Skills

Explore More Software Engineering Skills→
salmanabdurrahmansalmanabdurrahman

enum-web-content

Automate web content enumeration and directory discovery across authorized in-scope targets.

Community
Advanced
shivpathakvwshivpathakvw
2

A03 — CVE & License Scanner

Scan Maven and Gradle dependencies for CVEs and license risks.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

recon-favicon-fingerprint

Compute MurmurHash3 fingerprints of favicon files to identify web technologies.

Community
Advanced
macaughmacaugh
5

Service Fingerprinting

Detect network services and versions on discovered hosts via active probing.

Community
Advanced