Scanners
Fingerprint which CMS and version a host runs
CMS detection and version fingerprinting.
overview
What cmseek does
CMSeeK labels which CMS a host runs and often which version, reading generator tags, headers, cookies, and known paths. That label decides which follow-up scanner or template set to aim next.
--light-scan stops at CMS and version. --only-cms reports the platform alone. Default deep scan can pull users, plugins, and themes on WordPress. Feed --list for many hosts; --strict-cms narrows the signature set.
Trickest provides CMSeeK as a managed Scanners node: URL or target list in, results folder out. Run after httpx so only live hosts get fingerprinted, then route WordPress hits to wpscan.
use cases
Where cmseek fits
Identify a site's CMS and version
Fingerprint a target to learn which CMS it runs and at what version, the starting point for choosing relevant exploits and checks.
Run a fast detection pass
Use light scan or only-cms to get CMS and version alone, skipping deep enumeration when you need to label many hosts quickly.
Group an estate by platform
Pass a target list so one run fingerprints the CMS across every host, then group hosts by platform and route each group to a fitting scanner.
Reach sites that filter bots
Set a random or custom user agent, or the Googlebot agent, so detection still lands against hosts that filter on user agent.
reference
cmseek inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | --url | Target URL to fingerprint. |
| target-list | FILE | --list | File of targets to scan, comma separated. |
| light-scan | BOOLEAN | --light-scan | Skip the deep scan; CMS and version detection only. |
| only-cms | BOOLEAN | --only-cms | Report the CMS only, no version or deep scan. |
| cms-id | STRING | --strict-cms | Check only against the given CMS IDs, comma separated. |
| no-redirect | BOOLEAN | --no-redirect | Test the input target without following redirects. |
| use-random-agent | BOOLEAN | --random-agent | Use a random user agent to dodge basic bot filters. |
| custom-user-agent | STRING | --user-agent | Send a custom user agent string. |
Showing key inputs. cmseek exposes 13 inputs in total.
Full flag reference (13 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | --url | Target URL to fingerprint. |
| target-list | FILE | --list | File of targets to scan, comma separated. |
| cms-id | STRING | --strict-cms | Check the target only against the given CMS IDs, comma separated. |
| ignore-cms-ids | STRING | -i | CMS IDs to skip to avoid false positives, comma separated. |
| only-cms | BOOLEAN | --only-cms | Only detect the CMS; skip deep scan and version detection. |
| light-scan | BOOLEAN | --light-scan | Skip the deep scan; do CMS and version detection only. |
| skip-scanned | BOOLEAN | --skip-scanned | Skip a target whose CMS was already detected. |
| no-redirect | BOOLEAN | --no-redirect | Skip all redirects and test the input target as given. |
| follow-redirect | BOOLEAN | --follow-redirect | Follow all redirects. |
| use-random-agent | BOOLEAN | --random-agent | Use a random user agent. |
| custom-user-agent | STRING | --user-agent | Send a custom user agent string. |
| googlebot-useragent | BOOLEAN | --googlebot | Use the Googlebot user agent. |
| verbose | BOOLEAN | --verbose | Increase output verbosity. |
example
Run cmseek
# detect the CMS and version on one sitecmseek --url https://example.com --light-scan # fingerprint a host list and rotate the user agentcmseek --list targets.txt --random-agent --skip-scanned[i] Scanning Site: http://example.com[+] CMS Detected, CMS ID: wp, Detection method: Generator meta tag ┏━CMSeeK Result━━━━━━━━━━━━━━━━━━━━━━ ┃ [+] CMS: WordPress ┃ [+] Version: 6.4.2 ┃ [+] Readme File: http://example.com/readme.html ┃ [+] Users Found: admin, editor ┃ [+] Detected Plugins: contact-form-7, woocommerce ┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━[i] Result saved in Result/example.com/cms.jsonguidance
Choosing cmseek
Use CMSeeK to label which CMS and version a host runs before deeper testing, so the right tooling hits each platform. It identifies the stack; it is not a broad vulnerability scanner. Follow with wpscan, joomscan, or nuclei templates.
wpscan
Deep WordPress-only scanner. CMSeeK detects the CMS first; point wpscan at the WordPress hosts.
joomscan
Joomla-specific scanner. Use CMSeeK to find Joomla hosts, then joomscan to test them.
whatweb
Broad technology fingerprinting. CMSeeK is sharper on CMS identity and version.
faq
cmseek questions
related
More Scanners tools
ac-scanner
BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.
airixss
Reflection triage for parameter URLs during recon.
bedrock-keys-security
Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.
jaeles
Signature-driven web application scanner.
joomscan
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
nikto
Bundled web server checks for dangerous files and outdated software.
Run cmseek yourself
Hosts are probed by httpx, then CMSeeK fingerprints the live ones and writes a map of which CMS and version each host runs.
Facts on this page come from the live Trickest tool library.