Where does `version_status` come from?

For technologies that support version checks, the module writes the detected `version`, the `latest_version` it knows, and `version_status` as `outdated`, `up_to_date`, or `unknown`. `unknown` means the version could not be determined or the technology is not supported for version checks. It is not a verdict of current, and it is not a CVE match.

Does this crawl or render JavaScript?

No. This is HTTP fingerprinting against the live URL. It does not run a browser or follow a render. For JS analysis, use Analyze JavaScript code.

Can I use this to find the origin IP behind a WAF?

No. WAF bypass and origin-IP discovery are not claimed. CDN and WAF rows describe the edge.

What does `location` mean?

A technology-specific URL the module associated with the technology, such as a login panel. It is a pointer for the next scan, not a finding.

Does this run on one URL or a list?

A list. The input is live web server URLs, one per line, and the module runs across the fleet in one pass. There is no single-URL mode; feed a one-line file if you only have one target.

Does `version_status` of `unknown` mean the software is current?

No. `unknown` means the version could not be determined or the technology is not supported for version checks. Treat it as unknown, not as up to date, and not as a CVE match.

2026-08-13

Attack Surface Management

Fingerprint Web Technologies

Identify CMS, CDN, and WAF on live web servers. Technology detection names server software, runtimes, and frameworks with version status.

What Fingerprint Web Technologies does

Technology detection answers what a live web server actually runs. After liveness, the next question is the stack: the CMS, the CDN, the WAF, the server software, the runtimes, and the frameworks, with a version status when the check is supported. This module writes that taxonomy as a typed record the next scan nests on.

You feed live web server URLs. This module names the CMS, CDN, WAF, server software, runtimes, and frameworks on each one. When a version check is supported, it writes version, latest_version, and version_status (outdated, up_to_date, or unknown), plus technology-specific locations such as login panels. The artifact is a typed web-technologies JSONL file for the next scan. This is the fingerprint step of the ASM web tail: hosts -> probe-web -> web FP -> tech-specific.

Where it fits in the pipeline

Illustrative excerpt. Each node is a Trickest module.

Pipeline guidance

hosts -> probe-web -> web FP -> tech-specific

Upstream. Probe for web servers writes web-servers. That is what you nest on. Do not feed raw hosts.
Downstream. Scan for Technology-Specific Vulnerabilities consumes web-technologies. Generate Scan Report can take the same file.
Parallel. Fingerprint Network Services runs on port-details from Scan for Open Ports. Do not cross-wire this node onto the network tail (hosts -> open-ports -> network FP -> (misconfig | weak-creds)).

When to use this

Nest this after Probe for Web Servers has produced web-servers, and before any technology-specific vulnerability scan. The input contract is live HTTP(S) URLs. Probe owns liveness. This module owns the CMS, CDN, and WAF taxonomy on that live list.

Inputs and outputs

Required: web-servers (FILE). Live web server URLs, one per line. Probe for web
Optional: header (STRING). Header(s) to include in HTTP requests. There is no
Outputs: web-technologies (FILE). JSONL rows. Published fields: asset,

Data

The tables this module produces. Sample rows are illustrative.

web-technologies5 columns · 3 sample rows

CMS, CDN, WAF, server software, runtimes, and frameworks detected on each live web server URL.

	urlurl	technologytext	categoriesjson	versiontext	hostnametext
1	https://blog.example.com	WordPress	Array[2]	6.5.3	blog.example.com
2	https://app.example.com	Cloudflare	Array[2]		app.example.com
3	https://git.example.com	GitLab	Array[1]	16.11.4	git.example.com

How it differs from similar modules

Probe for Web Servers

Artifact class it owns

Live HTTP(S) URLs + details

Upstream it needs

hosts

Fingerprint Web Technologies

Artifact class it owns

CMS, CDN, WAF, versions

Upstream it needs

web-servers (after probe)

Scan for Technology-Specific Vulnerabilities

Artifact class it owns

Stack CVEs on the ten named products

Upstream it needs

web-technologies

Fuzz Web Applications for Vulnerabilities is adjacent crawl-then-payload DAST on a URL list. It does not sit in this table and does not consume web-technologies.

questions