# 2.2.3 Fingerprinting Frameworks and Applications

## Fingerprinting Frameworks and Applications

After obtaining a list of subdomains, the next step involves identifying the frameworks and applications running on each subdomain. This information is crucial for understanding potential vulnerabilities.

#### **Common Applications**

Common applications, whether open source or commercial, are interesting for analysis due to their source code accessibility. Unlike in-house applications, testers can review both the application logic and implemented security controls. Some common applications include forums (e.g., phpBB, vBulletin), Content Management Systems (CMS) like Joomla or Drupal, Customer Relationship Management (CRM) systems, blogging platforms (e.g., WordPress, Movable Types), and social networking scripts.

## **Fingerprinting Web Applications**

Identifying the exact application and version is essential for finding publicly available exploits. Techniques include:

* **Browsing the Website:**
  * Look at URLs, appearance, and logic of webpages.
  * Search for the application's name in page content.
  * Inspect web page source; the name and version might be in HTML comments or HTTP headers.
* **Sending a GET Request:**
  * Examine response headers for information.
  *   Example (Joomla):

      ```bash
      plaintextCopy codeRequest:
      GET / HTTP/1.1
      Host: www.joomla.org
      User-Agent: Mozilla/5.0 (x11; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0 Iceweasel/31.5.3

      Response:
      HTTP/1.x 200 OK
      Content-Encoding: gzip
      Content-Type: text/html; charset=utf-8
      Server: LiteSpeed
      Vary: Accept-Encoding
      X-Content-Encoded-By: Joomla! 2.5
      ```

      Here, the server is running Joomla! 2.5.
* **Footer Notifications:**
  * Some applications require users to keep a footer notification for support and acknowledgment.
  *   Example (vBulletin):

      ```plaintext
      plaintextCopy codeCopyright © 2015 vBulletin Solutions. All Rights Reserved
      vBulletin® is a registered trademark of vBulletin Solutions.
      ```
* **Source Code Examination:**
  * Examine web page source code for information in META tags and HTML comments.
  *   Example (WordPress):

      ```html
      htmlCopy code<meta name="generator" content="Wordpress 4.2-beta-31946" />
      ```

### **Fingerprinting Third-Party Add-Ons**

Common CMS platforms like Joomla, Drupal, and Mambo often have large support communities providing free add-ons, components, and extensions. These third-party add-ons can introduce vulnerabilities. Fingerprinting installed add-ons can involve examining website URLs, as these URLs typically consist of three main parts:

```bash
plaintextCopy codeindex.php?option=%component_name%&task=%task_value%
```

In Joomla, for example, the `option` parameter in the URL reveals installed third-party add-ons. For instance:

```bash
plaintextCopy codeindex.php?option=com_docman&task=doc_view&gid=100
```

This URL indicates the use of the `Docman` document manager component.

In the information-gathering process, it is crucial not only to list common applications in use but also to identify third-party add-ons, potentially useful for penetration testing tasks.
