Website Recon

Overview

Website Recon identifies server-side and client-side technologies on a web application. It generates findings for each detected technology and adds results to your Attack Surface.

Parameters

Parameter	Description
Target	The address of the website to analyze. Must start with `http://` or `https://`.

How it works

Website Recon uses Wappalyzer as its scanning engine. Wappalyzer maintains a database of over 7,900 technologies across 100+ categories. The tool analyzes multiple elements of the website:

Element	What it reveals
HTTP response headers	Server software, frameworks, caching layers
HTML Meta Generator tags	CMS platforms, static site generators
Embedded JavaScript files	Frontend frameworks, libraries, analytics
HTML content patterns	Application frameworks, templating engines
HTML comments	Development tools, build systems
Website favicon	Platform identification (e.g., WordPress, Drupal)

It also takes a screenshot of the website.

Technology categories

Website Recon identifies technologies across many categories:

Category	Examples
CMS	WordPress, Drupal, Joomla, Wix, Squarespace
Web servers	nginx, Apache, IIS, LiteSpeed, Caddy
Programming languages	PHP, Python, Java, Node.js, Ruby, ASP.NET
JavaScript frameworks	React, Angular, Vue.js, jQuery, Next.js
CSS frameworks	Bootstrap, Tailwind CSS, Foundation
E-commerce	Shopify, WooCommerce, Magento, PrestaShop
CDN	Cloudflare, Akamai, Fastly, AWS CloudFront
Analytics	Google Analytics, Matomo, Hotjar
Marketing automation	HubSpot, Mailchimp, Marketo
Security	reCAPTCHA, Cloudflare Bot Management
Caching	Varnish, Redis, Memcached
Reverse proxies	nginx, HAProxy, Envoy

How recon results feed into testing

Technology fingerprinting typically happens early in a penetration test. Knowing what software a target runs lets you:

Use CMS-specific tools when WordPress, Drupal, or Joomla is detected
Match detected versions against known CVEs
Plan targeted testing based on the application architecture
Focus on known-vulnerable components first

When Website Recon detects WordPress, a recommendation appears to run the WordPress Scanner for a more thorough CMS-specific assessment.

Example workflow

If Website Recon finds the following about a target:

CMS: WordPress 4.1
Server: Apache 2.2
Operating System: Linux

Next steps:

Search for WordPress 4.1 CVEs
Run the WordPress Scanner for CMS-specific testing
Use the server and OS information to select appropriate exploits

Follow-up actions

Discovery	Recommended action
WordPress	Run WordPress Scanner
Drupal	Run Drupal Scanner
Joomla	Run Joomla Scanner
API endpoints	Run API Scanner
GraphQL	Run API Scanner with GraphQL support
Outdated software	Check CVE databases for known vulnerabilities
Any web application	Run Website Scanner for full assessment
WAF presence suspected	Run WAF Detector to identify protection
Hidden content	Run URL Fuzzer to discover hidden directories and files
HTTPS enabled	Run SSL/TLS Scanner to analyze encryption configuration

Intro

Core

Tools reference

Capabilities

AI

Account & billing

Overview

Parameters

How it works

Technology categories

How recon results feed into testing

Example workflow

Follow-up actions

​Overview

​Parameters

​How it works

​Technology categories

​How recon results feed into testing

​Example workflow

​Follow-up actions

Overview

Parameters

How it works

Technology categories

How recon results feed into testing

Example workflow

Follow-up actions