Fingerprint front-end JS library versions

Overview

Old front-end libraries stay on sites long after the advisory. This workflow enumerates hosts, fetches pages, and reads script URLs and version banners. It recognises libraries such as jQuery, AngularJS, Bootstrap, and Lodash. A filename with a version is a fingerprint. A banner inside the file is a fingerprint. The check does not execute a payload against the library. Point it at a domain you are authorised to test, and use the version list as the queue for exposure management.

Pipeline

1. subfinder enumerates hosts for the domain you set.
2. httpx fetches pages on those hosts.
3. harvest collects script URLs, on at most 60 pages.
4. fingerprint reads the library name and version.
5. advisory attaches a CVE only when a version is parsed.
6. report writes findings.jsonl, one row per advisory, plus a summary.

Inputs

• Domain. Set on the subfinder node. Pages come from that enumeration.

Outputs

• findings.jsonl. One JSON line per library version observed, plus a summary.

Integrations

• Subfinder. Host enumeration.
• httpx. Page fetch for the enumerated hosts.

Sample output

The row below is from a completed run on brokencrystals.com on 2026-09-24. jQuery 3.4.1 was parsed from the page and matched two CVEs.

url	library	version	cves	severity	note	scanned_at
https://qa.brokencrystals.com	jquery	3.4.1	CVE-2020-11022, CVE-2020-11023	medium	XSS via htmlPrefilter	2026-09-24T10:11:05Z

FAQ

Does an observed version mean the bug fired?

No. The row is a version fingerprint from a public script URL or banner. It is not an exploit result.

Which libraries are recognised?

The scanner looks for names such as jQuery, AngularJS, Bootstrap, and Lodash in script URLs and banners.

How many pages are checked?

At most 60 URLs from the enumerated hosts.

Where should I run it?

On a domain you are authorised to test.

Related workflows

• Exposed Database Scanner. Reach for this when the exposure is an open database port rather than a script version.
• Subdomain Takeover Scanner. Reach for this when the host should not exist, rather than when its front end is old.