inventory-software-catalog

Inventory Software Catalog

Catalog the full technology stack of a target web application. Detect frameworks, runtime versions, and dependencies. Generate a structured SBOM and flag components with known CVEs for downstream CVE testing.

Workflow

Phase 1: Recon

1. Mount skill file:

   Read plugins/pentest/skills/web-application-mapping/SKILL.md
   

2. Fingerprint the target passively using HTTP headers and response analysis:

   whatweb https://TARGET -v 2>&1 | tee outputs/ENGAGEMENT/activity/whatweb-TARGET.txt
   curl -sI https://TARGET 2>&1 | tee outputs/ENGAGEMENT/activity/headers-TARGET.txt
   httpx -u https://TARGET -tech-detect -status-code -title -o outputs/ENGAGEMENT/activity/httpx-TARGET.txt
   

3. Extract server software, frameworks, CMS, CDN, language runtime from response headers and HTML meta tags.
4. Check for common framework indicator files:

   curl -so /dev/null -w "%{http_code}" https://TARGET/package.json
   curl -so /dev/null -w "%{http_code}" https://TARGET/composer.json
   curl -so /dev/null -w "%{http_code}" https://TARGET/requirements.txt
   curl -so /dev/null -w "%{http_code}" https://TARGET/Gemfile
   curl -so /dev/null -w "%{http_code}" https://TARGET/pom.xml
   

   If any return 200, fetch and parse the file to extract dependency names and versions.
5. Log:

   {"timestamp":"...","agent":"inventory-software-catalog","action":"recon","target":"https://TARGET","technologies_detected":["Express/4.18.2","React/18.2.0","Nginx/1.24.0"]}
   

Phase 2: Experiment

1. Use wappalyzer-cli for comprehensive technology detection:

   wappalyzer-cli https://TARGET 2>&1 | tee outputs/ENGAGEMENT/activity/wappalyzer-TARGET.txt
   

2. Run nuclei technology detection templates:

   nuclei -u https://TARGET -tags tech -o outputs/ENGAGEMENT/activity/nuclei-tech-TARGET.txt
   

3. If the target appears to be a Node.js application, attempt to retrieve dependency manifest:

   curl -s https://TARGET/package.json | jq '.dependencies, .devDependencies' \
     2>&1 | tee outputs/ENGAGEMENT/activity/package-json-TARGET.txt
   

4. If the target appears to be a PHP application:

   curl -s https://TARGET/composer.json | jq '.require' \
     2>&1 | tee outputs/ENGAGEMENT/activity/composer-json-TARGET.txt
   

5. Try automated SBOM generation if source code is accessible locally:

   syft dir:. -o json 2>/dev/null | tee outputs/ENGAGEMENT/activity/syft-sbom.json
   cdxgen -o outputs/ENGAGEMENT/activity/cdxgen-sbom.json 2>/dev/null
   

6. Log:

   {"timestamp":"...","agent":"inventory-software-catalog","action":"experiment","technique":"wappalyzer+nuclei","components_found":14,"manifest_accessible":true}