Skip to content
OPS // KITitspentest.sh

R-WAP

Wappalyzer

Browser extension and lookup service that fingerprints a site's CMS, frameworks, and analytics stack.

Official siteBack to catalog

OVERVIEW

Wappalyzer inspects a page's HTTP response headers, HTML markup, script sources, and cookies to identify the CMS, JavaScript frameworks, analytics tools, web server, and dozens of other technologies a site runs on. It ships as a browser extension, a hosted lookup on wappalyzer.com, and a paid API for bulk or automated checks.

Because the browser extension and web lookup are free, it's typically the first tool opened against a new target — before running a heavier active scanner — to shortcut which CVEs, default paths, and admin panels are even worth checking for that stack.

USE CASES

Practical use cases

  • 01

    Identifying the CMS (WordPress, Drupal, etc.) and its likely plugin ecosystem before targeted enumeration.

  • 02

    Spotting outdated JavaScript library versions that map to known CVEs.

  • 03

    Confirming which CDN, WAF, or hosting provider sits in front of the target.

  • 04

    Building a quick technology profile across many hosts during a broad external assessment.

QUICK START

Early in recon, right after confirming a host is live, to quickly know what stack you're dealing with before choosing which enumeration tools to run.

  1. Install the browser extension or open the target's URL in the wappalyzer.com lookup.
  2. Browse the in-scope pages normally and review the detected technologies panel.
  3. Cross-reference flagged versions (CMS, JS libraries) against known vulnerabilities.
  4. Feed confirmed technologies into your enumeration and exploitation tool choices.

BEFORE YOU RUN IT

What to check before running it

Detection relies on visible markers (headers, meta tags, script paths); a hardened or obfuscated stack can hide from it entirely, so treat a negative result as inconclusive, not proof.

Version numbers it reports are often best-guess from static signatures — confirm anything security-relevant before citing it as a finding.

The hosted lookup sends the target URL to Wappalyzer's own servers, which is worth noting on engagements with strict data-handling requirements.

KEEP EXPLORING

View the whole phase →