Tech-stack fingerprinting

When it applies

The start of any web/API engagement, before you pick techniques. Knowing the stack turns a generic "test everything" into a targeted plan: a Rails app routes to mass-assignment and deserialization, a GraphQL backend to api-graphql, a WAF in front changes your payloads-waf-bypass approach, and a pinned version turns into a CVE shortlist. It is passive OSINT — public signals only, no exploit.

Why it works

Applications advertise themselves constantly: response headers, cookie names, HTML generator tags, JS bundle names, error pages, TLS certs, DNS/CDN records, public repos, and job postings all leak the stack. Cross-correlating several weak signals gives a high-confidence picture no single tool produces — and confidence is what keeps you from scoring a CVE against a wrong guess.

Method

Work outside-in, then correlate. Keep every claim tagged with the signal that supports it and a confidence level.