cms-detection

CMS Detection

Identify the content management system, web framework, server software, and technology stack of every live host. Know which stack you're attacking before you attack it — a WordPress site needs different tests than a Laravel API or a Spring Boot microservice. Multi-CMS detection covers WordPress, Drupal, Joomla, Magento, Shopify, Wix, Squarespace, Laravel, Django, Express, Spring Boot, and more.

When to Use

• You have a list of alive hosts and need to categorize them by technology.
• WordPress-specific tests produced false positives (the site uses Drupal).
• Need to identify which CMS version is running to match against known CVEs.
• A host returns generic 200 on all paths — technology detection tells you what it actually runs.
• Want to find sites running outdated versions of popular CMS platforms.

Prerequisites

• terminal with httpx, whatweb, wappalyzer, and curl.
• A list of alive subdomains from skill_view(name='visual-recon') or skill_view(name='subdomain-enumeration').

Quick Detection

# Fastest: httpx with built-in tech detection
cat alive_subs.txt | httpx -silent -tech-detect -o tech_detect.txt

# Deep: whatweb with aggressive checks
whatweb -i alive_subs.txt -a 3 -t 50 --log-brief=cms_results.txt

Procedure

Phase 1 — Bulk Technology Fingerprinting

# httpx — fast tech detection using Wappalyzer signatures
cat alive_subs.txt | httpx -silent -tech-detect -o tech_httpx.txt

# Parse results: extract unique technologies with counts
cat tech_httpx.txt | awk -F' [' '{print $2}' | tr -d ']' | tr ',' '\n' \
  | sed 's/^ *//' | sort | uniq -c | sort -rn > tech_summary.txt

# whatweb — deeper, identifies specific CMS versions
whatweb -i alive_subs.txt -a 3 -t 50 \
  --log-brief=cms_results.txt \
  --log-json=cms_results.json

# Parse whatweb JSON for versioned findings
cat cms_results.json | jq -r '.[] | select(.version != null) | "\(.target): \(.plugin) \(.version)"' \
  | sort -u > versioned_cms.txt