Web Application Fingerprinting

You have identified a web application on a target host. Perform thorough passive and active fingerprinting before active exploitation.

**Technology Stack Identification**
- How do you identify the web server, framework, and language from HTTP response headers?
- What do cookies reveal about the backend technology? (JSESSIONID → Java, PHPSESSID → PHP, ASP.NET_SessionId)
- How do you identify CMS platforms? (WordPress, Drupal, Joomla, Magento)
- What do the page structure, URL patterns, and error messages tell you?

**Content Discovery**
- What is the difference between directory brute-forcing and content discovery?
- How do you choose a wordlist for directory enumeration?
- What HTTP response codes tell you something interesting? (200, 301, 302, 403, 500)
- How do you handle rate limiting during content discovery?

**JavaScript & Client-Side Analysis**
- What can you learn from JavaScript files? (API endpoints, secrets, internal paths)
- How do you extract URLs and endpoints from source code?
- What do source maps (.map files) reveal?

**Robots.txt, Sitemap, & Metadata**
- Why check robots.txt even when it says "Disallow"?
- What does a sitemap.xml reveal about application structure?
- How do you use Google dorking to discover indexed content of a target?

**API Enumeration**
- How do you discover API endpoints on a web application?
- What does swagger.json or openapi.json reveal?
- How do you test API versioning for outdated endpoints?

Output:
- Fingerprinting checklist ordered by information value
- Tool list: Wappalyzer, whatweb, gobuster, ffuf, burpsuite
- Common fingerprint patterns and what they imply