Which stacks are supported?

WordPress, Microsoft IIS, Ivanti Pulse Secure, Joomla, GitLab, Jenkins, Spring Boot, Jira, Splunk, and WebLogic. The list is closed. An eleventh is not added on request. There is no WordPress-only or IIS-only module page.

Do I need to fingerprint first?

Yes. The required input is `web-technologies` from Fingerprint web technologies. If you skip fingerprinting, this module has no targets.

Is this the same as the nuclei tool page?

No. This page is the closed ten-stack check set nested on `web-technologies`. [nuclei](/tools/nuclei) is the template engine and its flags. They link as instrument and job. Neither page replaces the other.

Does it find every CVE?

It finds stack-specific issues on the ten products, some of which map to CVEs. For CVE/CNVD matching across any URL, use Scan for outdated software. For crawl-then-payload DAST, use Fuzz web applications for vulnerabilities.

Does it write exploits or proof-of-concept steps?

No. Findings describe the issue and include the triggering request. Reproduction is a separate step you run yourself. The checks are matcher-based HTTP probes, not exploits.

Is there a separate WordPress or IIS module?

No. The ten stacks live in this one module. There are no per-stack landing pages and no eleventh stack added on request. Drupal, Tomcat, Exchange, and Cisco are out of scope by design.

2026-08-13

Vulnerability Scanning

Scan for Technology-Specific Vulnerabilities

Tailored CVE scanning for ten web stacks post-fingerprint. WordPress, IIS, Ivanti, Joomla, GitLab, Jenkins, Spring Boot, Jira, Splunk, WebLogic.

What Scan for Technology-Specific Vulnerabilities does

CVE scanning gets specific once you know the stack. After fingerprinting names what each live web server runs, this module runs tailored checks for ten stacks and their components, not a generic template run across all software. The closed ten is the coverage ceiling: an eleventh stack is out of scope by design.

You feed web-technologies rows. This module runs tailored checks for ten stacks: WordPress, Microsoft IIS, Ivanti Pulse Secure, Joomla, GitLab, Jenkins, Spring Boot, Jira, Splunk, and WebLogic. It hunts stack CVEs and related components on those products only (WordPress plugins and themes, for example). The list is closed. An eleventh stack is out of scope. This is the last step of the ASM web tail: hosts -> probe-web -> web FP -> tech-specific.

Where it fits in the pipeline

Illustrative excerpt. Each node is a Trickest module.

Pipeline guidance

hosts -> probe-web -> web FP -> tech-specific

Upstream. Fingerprint web technologies writes web-technologies. Probe for web servers sits one step earlier and does not feed this node.
Downstream. findings into Generate Scan Report. The enriched web-technologies file is the component view from this pass.
Parallel. Scan for Outdated Software (CVE/CNVD matchers on a URL list, stack-agnostic), Scan for Misconfigured Software (setup state), and Fuzz Web Applications for Vulnerabilities (crawl-then-payload DAST) run on the same live surface and answer different questions. Do not cross-wire onto the network tail (hosts -> open-ports -> network FP -> (misconfig | weak-creds)).

When to use this

Nest this after Fingerprint Web Technologies has produced web-technologies rows. If fingerprint did not name one of the ten stacks for a host, this module has nothing to run for that host. Do not feed raw URLs or network-service details.

Inputs and outputs

Required: web-technologies (FILE). JSONL of web technology discovery details from
Optional: header (STRING). Header(s) to include in HTTP requests.
header-file (FILE). File with header(s) to include in HTTP requests.
Outputs: findings (FILE). JSONL of finding details. Published fields: finding,
web-technologies (FILE). JSONL of web component discovery details

Data

The tables this module produces. Sample rows are illustrative.

findings13 columns · 3 sample rows

Stack-specific findings for the ten named products, including the triggering request.

	findingtext	locationurl	severitytext	matchesjson	descriptiontext	hostnametext	domain_nametext	ip_addresstext	attacktext	methodtext	fieldtext	requesttext
1	Outdated WordPress Plugin	https://blog.example.com/wp-content/plugins/vuln-plugin/	high	Array[1]	Plugin version below 1.2 is vulnerable to SQL injection.	blog.example.com	example.com	203.0.113.10	SQL injection via id parameter	GET	id	GET /wp-content/plugins/vuln-plugin/ HTTP/1.1
2	IIS Short File Name Enumeration	https://iis.example.com/	medium	Array[1]	IIS short-name disclosure allows file enumeration.	iis.example.com	example.com	198.51.100.25	tilde enumeration	GET		GET / HTTP/1.1
3	Spring Boot Actuator (Jolokia) XXE	https://spring.example.com/actuator/jolokia	critical	Array[1]	Jolokia endpoint exposed allowing XXE.	spring.example.com	example.com	203.0.113.50	XXE via Jolokia	POST		POST /actuator/jolokia HTTP/1.1

web-technologies5 columns · 3 sample rows

Enriched component view (plugins, themes, related extensions) discovered on the named stacks.

	urlurl	technologytext	categoriesjson	versiontext	hostnametext
1	https://blog.example.com	WordPress	Array[2]	6.5.3	blog.example.com
2	https://blog.example.com	WP Super Cache	Array[2]	1.9.4	blog.example.com
3	https://spring.example.com	Spring Boot	Array[2]	2.7.5	spring.example.com

How it differs from similar modules

Probe for Web Servers

Artifact class it owns

Live HTTP(S) URLs + details

Upstream it needs

hosts

Fingerprint Web Technologies

Artifact class it owns

CMS, CDN, WAF, versions

Upstream it needs

web-servers (after probe)

Scan for Technology-Specific Vulnerabilities

Artifact class it owns

Stack CVEs on the ten named products

Upstream it needs

web-technologies

Fuzz Web Applications for Vulnerabilities is adjacent crawl-then-payload DAST on a URL list. It does not sit in this table and does not consume web-technologies.

questions