Overview
Website Recon identifies server-side and client-side technologies on a web application. It generates findings for each detected technology and adds results to your Attack Surface.Parameters
How it works
Website Recon uses Wappalyzer as its scanning engine. Wappalyzer maintains a database of over 7,900 technologies across 100+ categories. The tool analyzes multiple elements of the website:
It also takes a screenshot of the website.
WAF detection
Website Recon includes the WAF detection that was previously available in the standalone WAF Detector. It checks whether a Web Application Firewall (WAF) protects the site and tries to identify the product. The detector recognizes 97 WAF products, including Cloudflare, AWS WAF, Akamai Kona, Imperva Incapsula, F5 BIG-IP ASM, Fortinet FortiWeb, Barracuda, Sucuri, ModSecurity, and Wordfence. The check sends a request with a combined attack payload and compares the response with known WAF signatures. If it can’t identify a product, it checks for WAF behavior by comparing normal responses with requests that omit the User-Agent or contain individual attack payloads. A detected WAF appears as an informational finding with:
The finding includes a Replay Attack button to repeat the request that triggered the WAF.
The check works in several steps:
1
Heuristic attack
Sends a request with a combined payload that simulates several attack types (XSS, SQLi, directory traversal, RCE, XXE) and matches the response against known WAF signatures.
2
Generic detection
If no specific WAF is identified, sends requests without a User-Agent header and with individual attack vectors, and compares the status codes and the
Server header with a normal request.3
Origin IP search
If a WAF is detected, searches DNS records and Shodan for possible origin IPs. Shodan searches use the favicon hash, hostname, and SSL certificate fingerprint. Website Recon checks each candidate to confirm it serves the same page directly.
WAF detection is also available in Website Scanner as the WAF Detection check. It runs in Deep scans and can be selected in Custom scans. The standalone WAF Detector has been consolidated into Website Recon and Website Scanner.
Technology categories
Website Recon identifies technologies across many categories:How recon results feed into testing
Technology fingerprinting typically happens early in a penetration test. Knowing what software a target runs lets you:- Use CMS-specific tools when WordPress or Drupal is detected
- Match detected versions against known CVEs
- Plan targeted testing based on the application architecture
- Focus on known-vulnerable components first
Example workflow
If Website Recon finds the following about a target:- Search for WordPress 4.1 CVEs
- Run the WordPress Scanner for CMS-specific testing
- Use the server and OS information to select appropriate exploits