Pentest Methodology & Recon · beginner · ~10 min

Technology detection and attack-surface mapping

Fingerprint technologies and turn scattered recon into a single attack-surface map.

Overview

Fingerprint tech from headers/cookies/frameworks (WhatWeb/Wappalyzer), screenshot many web hosts to triage visually, then consolidate domains, IPs, ports, services, stacks, and endpoints into one attack-surface map.

Why it matters

Recon only pays off when organised. A consolidated map shows where the surface is concentrated and which targets are high-value, so limited active-testing time is spent well — and every finding traces back to it.

Core concepts

Fingerprinting. Server/X-Powered-By headers, cookies, framework artefacts, favicon hashes. Mass screenshotting. Visually triage many hosts fast. Consolidation. Map domains→IPs→ports→services→stack→endpoints. Map drives plan. Prioritise high-value surface.

Lesson

The output of recon should be a single, organised attack-surface map — everything reachable, what it runs, and where to focus.

Technology detection

Fingerprint what a host runs from its responses: HTTP headers (Server, X-Powered-By), cookies, HTML/JS frameworks, favicon hashes, error pages. Tools like WhatWeb/Wappalyzer automate this. Knowing the stack (e.g. a specific CMS and version) points you straight at relevant known issues.

Screenshotting at scale

With dozens or hundreds of discovered web hosts, automated screenshotting (e.g. tools that render every host) lets you eyeball the lot quickly — spotting login panels, default pages, and dev/admin interfaces worth a closer look.

Building the map

Consolidate everything into one picture:

  • Domains and subdomains → resolved IPs.
  • Open ports and identified services per host.
  • Technology stack per web app.
  • Interesting endpoints (admin, API, upload, auth).

Why a map

It turns recon into a plan: it shows where the surface is concentrated, which targets are highest-value, and how to spend limited active-testing time. A finding always traces back to a place on this map.

Summary

Technology detection identifies what each host runs; mass screenshotting triages web hosts quickly; consolidating it all into an attack-surface map turns scattered recon into a prioritised testing plan.

Practice with these exercises