Agent skill · security · jeremylongshore
fingerprinting-server-software
Identify the server software, framework, and component versions a target is running from its HTTP response signatures — Server header, X-Powered-By, Via, X-AspNet-Version, X-Runtime, X-Drupal-Cache, X-Generator, Set-Cookie name patterns, error-page artwork, HTTP method behavior signatures. Use when: penetration test reconnaissance phase, post-deploy audit of fingerprintable exposure, or before reporting "no obvious version disclosure" to an auditor. Threshold: any version string in a response header (e.g., Server header with nginx/1.18.0, X-Powered-By with PHP/7.4.21, X-Generator with Drupal 9), or any framework-default Set-Cookie name (PHPSESSID, JSESSIONID, connect.sid, _csrf_token). Trigger with: "fingerprint server", "version disclosure", "tech-stack identification", "what's this site running".
Why this skill is useful
Provides specific commands and patterns for identifying server software and versions that the AI wouldn't reliably generate on its own.
What it needs
Requires python3 installed locally. About 4k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Fingerprinting Server Software Overview Version disclosure is the cheapest recon an attacker buys. A single GET request returns the Server: header, the X-Powered-By: header, and any framework-default cookies. From those three signals the attacker derives: web server family + exact version, app-framework + version, language runtime + version. That maps directly to a CVE catalog query: every published CVE affecting any of those components, filtered to ones an unauthenticated attacker can trigger. The fix is operationally trivial (one line in nginx, one line in Apache, one line in IIS) but the discipline isn't universal. This skill enumerates the signals + reports each disclosure with the severity matching how much it enables follow-on attack. When the skill produces findings Finding Severity Threshold Affected control --- --- --- --- Server header discloses version MEDIUM Server: nginx/1.18.0 or similar with explicit version CWE-200 Server header discloses minor version LOW Server: nginx (no version) CWE-200 X-Powered-By discloses framework version MEDIUM X-Powered-By: PHP/7.4.21, Express, ASP.NET CWE-200 X-AspNet-Version present HIGH Specific dotnet runtime version CWE-200 X-Runtime / X-Rails / X-Django headers present LOW Framework identification, no version CWE-200 X-Generator: drupal/wordpress + version MEDIUM CMS family + version disclosure CWE-200 Via header discloses proxy chain LOW Reveals upstream architecture (Varnish, Squid, CloudFront) CWE-200 Framework-default Set-Cookie pattern LOW PHPSESSID, JSESSIONID, connect.sid, etc. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/fingerprinting-server-software