loading
Loading content
loading
Vulnerability Scanning
Tailored CVE scanning for ten web stacks post-fingerprint. WordPress, IIS, Ivanti, Joomla, GitLab, Jenkins, Spring Boot, Jira, Splunk, WebLogic.
CVE scanning gets specific once you know the stack. After fingerprinting names what each live web server runs, this module runs tailored checks for ten stacks and their components, not a generic template run across all software. The closed ten is the coverage ceiling: an eleventh stack is out of scope by design.
You feed web-technologies rows. This module runs tailored checks for ten
stacks: WordPress, Microsoft IIS, Ivanti Pulse Secure, Joomla, GitLab,
Jenkins, Spring Boot, Jira, Splunk, and WebLogic. It hunts stack CVEs and
related components on those products only (WordPress plugins and themes, for
example). The list is closed. An eleventh stack is out of scope. This is the
last step of the ASM web tail: hosts -> probe-web -> web FP -> tech-specific.
Pipeline guidance
hosts -> probe-web -> web FP -> tech-specific
web-technologies. Probe
for web servers sits one step earlier and does not feed this node.findings into Generate Scan Report.
The enriched web-technologies file is the component view from this pass.hosts -> open-ports -> network FP -> (misconfig | weak-creds)).Nest this after Fingerprint Web Technologies
has produced web-technologies rows. If fingerprint did not name one of the
ten stacks for a host, this module has nothing to run for that host. Do not
feed raw URLs or network-service details.
web-technologies (FILE). JSONL of web technology discovery details from
header (STRING). Header(s) to include in HTTP requests.
header-file (FILE). File with header(s) to include in HTTP requests.
findings (FILE). JSONL of finding details. Published fields: finding,
web-technologies (FILE). JSONL of web component discovery details
The tables this module produces. Sample rows are illustrative.
Stack-specific findings for the ten named products, including the triggering request.
findingtext | locationurl | severitytext | matchesjson | descriptiontext | hostnametext | domain_nametext | ip_addresstext | attacktext | bodytext | methodtext | fieldtext | requesttext | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Outdated WordPress Plugin | https://blog.example.com/wp-content/plugins/vuln-plugin/ | high | Array[1] | Plugin version below 1.2 is vulnerable to SQL injection. | blog.example.com | example.com | 203.0.113.10 | SQL injection via id parameter | GET | id | GET /wp-content/plugins/vuln-plugin/ HTTP/1.1 | |
| 2 | IIS Short File Name Enumeration | https://iis.example.com/ | medium | Array[1] | IIS short-name disclosure allows file enumeration. | iis.example.com | example.com | 198.51.100.25 | tilde enumeration | GET | GET / HTTP/1.1 | ||
| 3 | Spring Boot Actuator (Jolokia) XXE | https://spring.example.com/actuator/jolokia | critical | Array[1] | Jolokia endpoint exposed allowing XXE. | spring.example.com | example.com | 203.0.113.50 | XXE via Jolokia | POST | POST /actuator/jolokia HTTP/1.1 |
Enriched component view (plugins, themes, related extensions) discovered on the named stacks.
urlurl | technologytext | categoriesjson | versiontext | hostnametext | |
|---|---|---|---|---|---|
| 1 | https://blog.example.com | WordPress | Array[2] | 6.5.3 | blog.example.com |
| 2 | https://blog.example.com | WP Super Cache | Array[2] | 1.9.4 | blog.example.com |
| 3 | https://spring.example.com | Spring Boot | Array[2] | 2.7.5 | spring.example.com |
Artifact class it owns
CMS, CDN, WAF, versions
Upstream it needs
web-servers (after probe)
Scan for Technology-Specific Vulnerabilities
Artifact class it owns
Stack CVEs on the ten named products
Upstream it needs
web-technologies
Fuzz Web Applications for Vulnerabilities is adjacent crawl-then-payload DAST on a URL list. It does not sit in this table and does not consume web-technologies.
questions
template engine; flags live there
WordPress instrument inside the closed ten
Joomla instrument inside the closed ten
Drop this module into a Trickest workflow and connect it to your upstream and downstream nodes. The face contract above is the wiring.
Get a personalized demo
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.