Arsenly
Tools
Recon & Discovery16 tools Web Security Audit10 tools Exploitation & OOB3 tools Payloads & Wordlists4 tools Cryptography & Generators3 tools Encoders & Converters5 tools Reference & Reports4 tools
Browse the full catalogue Open /explore →
Free Tools
Recon & Discovery
SiteMapper ProTurn a URL list into 4 views: hierarchical host/path tree, sortable fl… URL & Endpoint ExtractorMine URLs, JS endpoints, domains and parameters from pasted source cod… CIDR / IP CalculatorIPv4 and IPv6 subnet math. Expand CIDRs, parse ranges and netmasks, ag…
Web Security Audit
Cookie / JWT AuditorAudit cookie flags (Secure, HttpOnly, SameSite, __Host- / __Secure- pr… OpenAPI / Swagger AnalyzerPaste or drop an OpenAPI 3 / Swagger 2 spec and map its attack surface…
Cryptography & Generators
Hash ToolkitGenerate (MD5, NTLM, SHA) and identify 60+ hash types with ranked cand… Test Data GeneratorRealistic-looking test data across 22 countries: names, emails, phone … Code / Password / Token GeneratorCustom-charset strings (1-512 chars, up to 5000 at a time), passwords …
Encoders & Converters
Encoder / Decoder4-tab workbench: 20+ encodings (URL, double-URL, percent-all, Base64, … HTTP Request ConverterConvert HTTP requests between 6 formats: Raw HTTP (Burp), curl, fetch(… JSON WorkbenchFormat, validate (with line / col error), minify, sort keys, unescape … Text Suite7-tab text workbench: regex find/replace, sort/dedupe/sample, keep-dro… Text Comparer4-tab diff workbench: true LCS line / word / char diff, side-by-side, …
See all 13 free tools on /explore →
Pricing
Resources
ChangelogWhat's shipped lately API DocsAutomate scans from your CLI About XowiaLabsWho's behind this ContactBug reports, ideas, just say hi Terms & PrivacyAcceptable-use policy + privacy
Sign in Get started
← All tools

Tech Fingerprint

Recon & Discovery

Fingerprint the stack behind a URL - with versions, confidence and CVE pivots - from headers, cookies, markup and assets.

What is Tech Fingerprint?

Tech Fingerprint identifies the technology stack behind a URL - web server, language, CMS, application frameworks, JavaScript frameworks and libraries, CDN/WAF, analytics and chat widgets - by analyzing response headers, cookies, HTML markup and asset signatures.

It goes beyond naming the tech: where the signal allows, it extracts the version, attaches a confidence level and shows the evidence (which header, cookie or asset gave it away). Detected library versions are checked against a built-in vulnerable-version database, so known-weak components (e.g. old jQuery, Lodash, Bootstrap) come back with their exact CVEs inline.

A deep scan option fetches the referenced JS/CSS to read precise versions from file banners, flag source maps and leaked keys (Firebase, Stripe, Google, AWS), and compute the favicon hash with a Shodan pivot to find other hosts running the same app. A bulk mode fingerprints a whole list of hosts into a stack matrix - ideal straight after Subdomain Discovery.

What it detects

  • Server & language - web server, backend language and OS hints, with versions from headers.
  • CMS & ecommerce - WordPress, Drupal, Joomla, Magento, Shopify and more, often with versions.
  • Frameworks & libraries - React/Vue/Angular/Next, jQuery, Bootstrap and others (version-aware).
  • Inline CVEs - vulnerable library versions flagged with their exact CVE IDs and severity.
  • CDN / WAF - Cloudflare, Akamai, Fastly, Imperva, Sucuri and friends sitting at the edge.
  • Deep scan - exact versions from asset banners, source maps, leaked keys and the favicon hash.
  • Bulk matrix - fingerprint many hosts at once and compare their stacks side by side.

Where it fits in your workflow

  • →Spot outdated/weak libraries and their CVEs at a glance, then confirm in CVE Lookup.
  • →Pull leaked keys / source maps and a Shodan favicon pivot from the deep scan.
  • →Map the stacks of every live host after a subdomain sweep with bulk mode.
Use Tech Fingerprint

Run it from your dashboard.

Create free account Sign in Use via API

At a glance

CategoryRecon & Discovery
RunsServer-side
Token cost 3 / run (free tier)
Access Free
Status● Live

Frequently asked questions

Where do the inline CVEs come from?

Detected JavaScript library versions are matched against a built-in, curated vulnerable-version database (Retire.js-style) - so a result like jQuery 3.2.1 shows its actual CVEs instantly and offline. For server products, use the one-click CVE Lookup pivot.

How accurate is version detection?

Best-effort from public signals; versions can be hidden or spoofed. Each result carries a confidence level and the evidence behind it. The deep scan reads asset file banners for far more reliable versions.

Does it scan the target?

No - it makes browser-style GETs (the page, and in deep mode its own linked assets/favicon) and reads only the responses. It does not probe paths or send attack traffic.

Explore more tools →