R-WAP
Wappalyzer
Browser extension and lookup service that fingerprints a site's CMS, frameworks, and analytics stack.
OVERVIEW
Wappalyzer inspects a page's HTTP response headers, HTML markup, script sources, and cookies to identify the CMS, JavaScript frameworks, analytics tools, web server, and dozens of other technologies a site runs on. It ships as a browser extension, a hosted lookup on wappalyzer.com, and a paid API for bulk or automated checks.
Because the browser extension and web lookup are free, it's typically the first tool opened against a new target — before running a heavier active scanner — to shortcut which CVEs, default paths, and admin panels are even worth checking for that stack.
USE CASES
Practical use cases
- 01
Identifying the CMS (WordPress, Drupal, etc.) and its likely plugin ecosystem before targeted enumeration.
- 02
Spotting outdated JavaScript library versions that map to known CVEs.
- 03
Confirming which CDN, WAF, or hosting provider sits in front of the target.
- 04
Building a quick technology profile across many hosts during a broad external assessment.
QUICK START
Early in recon, right after confirming a host is live, to quickly know what stack you're dealing with before choosing which enumeration tools to run.
- Install the browser extension or open the target's URL in the wappalyzer.com lookup.
- Browse the in-scope pages normally and review the detected technologies panel.
- Cross-reference flagged versions (CMS, JS libraries) against known vulnerabilities.
- Feed confirmed technologies into your enumeration and exploitation tool choices.
BEFORE YOU RUN IT
What to check before running it
Detection relies on visible markers (headers, meta tags, script paths); a hardened or obfuscated stack can hide from it entirely, so treat a negative result as inconclusive, not proof.
Version numbers it reports are often best-guess from static signatures — confirm anything security-relevant before citing it as a finding.
The hosted lookup sends the target URL to Wappalyzer's own servers, which is worth noting on engagements with strict data-handling requirements.