Recon Fingerprint by crazyMarky — AI Skill for Any LLM

Overview

Publisher	crazyMarky
Repository	`pentest-skills`
Skill name	`recon-fingerprint`
Stars	342
Forks	37
Bundled files	11
License	Apache-2.0
Links	Skill source Repository

Markdown instructions

A SKILL.md file the model loads on demand, so it only costs tokens when a request actually matches.

Works with any LLM

AI skills are plain Markdown, not provider-specific code, so this works with GPT, Claude, Gemini, Grok, or a local model.

11 bundled files

Scripts, templates, and references the model can read while it works. Files are read-only and never executed.

Open source

Published by crazyMarky on GitHub. Read the source before you install it.

Installation

Install the Recon Fingerprint AI skill in TypingMind to use it with any LLM, or drop it into another agent that reads SKILL.md.

Install in TypingMind

TypingMind installs a skill straight from its GitHub folder — it reads SKILL.md, bundles the resource files, and stores the result locally.

Open the app and go to Plugins → Skills.
Choose "Install from GitHub".
Paste the skill folder URL below and confirm.
https://github.com/crazyMarky/pentest-skills/tree/main/recon-fingerprint
Enable the skill in any chat where you want it available.

Plugins → Skills → Add skill → From GitHub URL, then paste the folder URL and press Continue.

Install in another agent

Any agent that reads the Agent Skills format can use this skill — copy the folder into that agent's skills directory.

Claude Code — .claude/skills

git clone --depth 1 https://github.com/crazyMarky/pentest-skills.git /tmp/pentest-skills
mkdir -p .claude/skills
cp -r /tmp/pentest-skills/recon-fingerprint .claude/skills/recon-fingerprint

Restart Claude Code after copying so it picks up the new skill.

Use it in TypingMind

Enable Recon Fingerprint in any TypingMind chat and the model takes it from there. Its name and description sit in the system prompt, and the moment a request matches, the model loads the full instructions itself — you never invoke it by hand, and it costs no tokens until it is actually used.

The model loads Recon Fingerprint on its own as soon as a request matches it.

Works with any AI model

AI skills are plain Markdown instructions rather than provider-specific code, so Recon Fingerprint is not tied to the model it was written for. Install it once in TypingMind and use it with GPT-5, Claude, Gemini, Grok, DeepSeek, Mistral, Llama, or a local model you run yourself — all on your own API keys.

Loaded only when it is needed

The system prompt carries just the name and description. The instructions are fetched on the first matching request, so an idle skill costs nothing.

Switch models mid-chat

Because the skill is instructions rather than code, changing model does not break it — the next model reads the same SKILL.md.

Skill instructions

This is the SKILL.md content the model loads. Read it before installing — a skill is instructions your model will follow.

Web Fingerprinting & WAF Detection

Authorization Warning

IMPORTANT: Web fingerprinting sends requests to target servers. Always ensure you have:

Written permission from the target application owner
Defined scope of authorized testing
Legal compliance with local regulations

Prerequisites

Required tools that must be installed on your system:

httpx - go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
nuclei - go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest

Optional tools:

wafw00f - pip install wafw00f
whatweb - Package manager installation
fingerprintx - go install github.com/praetorian-inc/fingerprintx/cmd/fingerprintx@latest

Quick Start

Most commonly used commands for web fingerprinting:

Basic Technology Detection

bash
whatweb https://target.com

WAF Detection

bash
wafw00f https://target.com

HTTP Header Analysis

bash
curl -I https://target.com

Comprehensive Fingerprinting (Nuclei)

bash
nuclei -u https://target.com -tags tech

Common Scenarios

Scenario 1: Quick Technology Fingerprinting

When you need to quickly identify the technology stack:

bash
whatweb https://target.com --aggression 1

Parameters:

--aggression 1 - Quick scan (1-4, default 1)
-a 3 - More aggressive (more requests)
-v - Verbose output

Example:

bash
whatweb https://target.com -a 3

Scenario 2: WAF Detection

When you need to detect WAF/CDN protection:

bash
wafw00f https://target.com

Output shows:

WAF vendor (Cloudflare, AWS WAF, Imperva, etc.)
CDN in use
Firewall rules detected

Check multiple targets:

bash
wafw00f -i targets.txt

Scenario 3: Server Header Analysis

When you need to analyze HTTP headers:

bash
curl -I https://target.com

Detailed headers:

bash
curl -v https://target.com 2>&1 | grep -i "< "

Common headers to check:


Server: nginx/1.18.0
X-Powered-By: PHP/7.4
X-AspNet-Version: 4.0.30319
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000

Scenario 4: Technology Detection with Nuclei

When you need comprehensive technology fingerprinting:

bash
nuclei -u https://target.com -tags tech -severity info

Specific technologies:

bash
nuclei -u https://target.com -tags "wordpress,joomla,drupal"
nuclei -u https://target.com -tags "spring-boot,struts2"
nuclei -u https://target.com -tags "react,vue,angular"

Scenario 5: HTTPx Fingerprinting

When you need fast HTTP probing with tech detection:

bash
httpx -u https://target.com -tech-detect -status-code -title

Parameters:

-tech-detect - Enable technology detection
-status-code - Show HTTP status
-title - Extract page title
-server - Show server header
-websocket - Detect WebSocket
-cdn - Detect CDN

Example:

bash
httpx -u https://target.com -tech-detect -server -cdn -ssl

Scenario 6: CMS Detection

When you need to identify the CMS:

bash
whatweb https://target.com --aggression 3 | grep -i cms

Nuclei CMS detection:

bash
nuclei -u https://target.com -tags cms

Common CMS indicators:

WordPress: /wp-login.php, /wp-admin/, wp-json
Drupal: /user/login, Drupal.settings
Joomla: /administrator/components, Joomla!
TYPO3: /typo3conf

Scenario 7: JavaScript Framework Detection

When you need to identify frontend frameworks:

bash
curl -s https://target.com | grep -i "react\|vue\|angular\|jquery"

Check specific framework files:

bash
# React
curl -s https://target.com | grep -i "react"

# Vue.js
curl -s https://target.com | grep -i "vue\.js\|vue-"

# Angular
curl -s https://target.com | grep -i "angular\|ng-app"

# jQuery
curl -s https://target.com | grep -i "jquery"

Scenario 8: Server Version Detection

When you need to identify server software and version:

bash
nmap -sV -p 443,80 target.com

HTTP server banner:

bash
curl -I https://target.com | grep -i server

Use httpx for server detection:

bash
httpx -u https://target.com -server -response-time

Scenario 9: CDN Detection

When you need to identify CDN providers:

bash
httpx -u https://target.com -cdn

Check HTTP headers for CDN:

bash
curl -I https://target.com | grep -i "cf-ray\|x-amz\|x-akamai\|x-fastly"

Common CDN headers:

Cloudflare: cf-ray, cf-cache-status
AWS CloudFront: x-amz-cf-id
Akamai: x-akamai-transformed
Fastly: x-served-by, fastly-ssl
CloudFront: via, x-amz-cf-pop

Scenario 10: SSL/TLS Fingerprinting

When you need to analyze SSL configuration:

bash
nmap --script ssl-cert,ssl-enum-ciphers -p 443 target.com

SSL info with curl:

bash
curl -vI https://target.com 2>&1 | grep -i ssl

Using testssl.sh:

bash
testssl.sh https://target.com

Tool Selection Guide

Scenario	Recommended Tool	Command
Quick tech detect	whatweb	`whatweb https://target.com`
WAF detection	wafw00f	`wafw00f https://target.com`
Header analysis	curl	`curl -I https://target.com`
Comprehensive	nuclei	`nuclei -u https://target.com -tags tech`
Fast probing	httpx	`httpx -u https://target.com -tech-detect`
CMS detection	nuclei	`nuclei -u https://target.com -tags cms`
CDN detection	httpx	`httpx -u https://target.com -cdn`

Tool Comparison:

Tool	Speed	Coverage	Best For
whatweb	Fast	Good	Quick tech stack
wafw00f	Fast	WAF only	WAF detection
nuclei	Medium	Excellent	Comprehensive
httpx	Very Fast	Basic	Fast probing
nmap	Slow	Deep	SSL/Server details

Technology Fingerprints

Web Servers

Server	Header Pattern	Common Versions
nginx	`Server: nginx`	1.18.x, 1.20.x, 1.22.x
Apache	`Server: Apache`	2.4.x, 2.2.x
IIS	`Server: Microsoft-IIS`	7.5, 8.0, 8.5, 10.0
Cloudflare Server	`Server: cloudflare`	-

Backend Frameworks

Framework	Indicators
PHP	`X-Powered-By: PHP`, `.php` URLs
Python	`Server: WSGIServer`, Python headers
Ruby	`X-Powered-By: Phusion Passenger`
Node.js	`X-Powered-By: Express`
Java	`X-Powered-By: JSP`, `.jspx`, `.do`
.NET	`X-AspNet-Version`, `.aspx`
Go	`Server: Go-http-server`

Frontend Frameworks

Framework	File/Pattern
React	`react.js`, `react-dom`, `_react`, `__REACT__`
Vue.js	`vue.js`, `vue-router`, `v-if`, `v-for`
Angular	`ng-app`, `angular.js`, `zone.js`
jQuery	`jquery.js`, `$(`, `.ajax()`

WAF Signatures

WAF	Detection Method
Cloudflare	`cf-ray`, `cf-cache-status` headers
AWS WAF	`x-amz-cf-id` headers
Imperva	`X-Iinfo`, `X-CDN` headers
Akamai	`akamai-origin` headers
F5 ASM	`BIGipServer` cookies
ModSecurity	`Mod_Security` headers
Barracuda	`barra_counter_session` cookies

Tips and Best Practices

Start passive - Use headers and page content first
Check multiple sources - Combine tool outputs for accuracy
Verify versions - Technology detection is not always precise
Note evasion - Some sites hide their technology stack
WAF first - Always check for WAF before active scanning
CDN consideration - CDN may hide actual server info
Save results - Record fingerprints for correlation

Resources

Scripts

scripts/extract_headers.py - Extract and analyze HTTP headers
scripts/tech_matcher.py - Match technologies from responses
scripts/waf_detector.py - Detect WAF from headers/cookies

References

references/whatweb_guide.md - WhatWeb reference guide
references/wafw00f_guide.md - WAF detection guide
references/httpx_guide.md - HTTPx reference
references/fingerprinting_techniques.md - Advanced fingerprinting methods

Scenario: Persistent Storage of Fingerprinting Results

When you need to persist web fingerprinting results to the database:

bash
# Manual entry after fingerprinting
python .claude/skills/recon-fingerprint/scripts/fingerprint_storage.py \
  --host-ip 192.168.1.100 \
  --url "https://example.com" \
  --technology "Apache 2.4.41" \
  --category "web-server" \
  --version "2.4.41" \
  --subsystem "Web Application"

Parameters:

--host-ip - Target host IP (required)
--url - Target URL (required)
--technology - Discovered technology (required)
--category - Technology category: web-server, cms, framework, etc. (optional)
--version - Technology version (optional)
--confidence - Confidence level (optional)
--subsystem - Subsystem name (optional)

Database location: ./data/results.db

Related skills: results-storage - Query data, generate reports

Assets

assets/waf-signatures.txt - Known WAF signatures
assets/tech-headers.txt - Technology header patterns
assets/cms-fingerprints.txt - CMS detection patterns

Frequently asked questions

What does the Recon Fingerprint AI skill do?

Web fingerprinting and WAF detection using wafw00f, whatweb, nuclei, and httpx. Use this skill when user needs to identify web technologies, detect WAF/CDN, analyze server headers, or fingerprint web applications and frameworks.

Why use Recon Fingerprint on TypingMind?

Because you install it once and use it with any model. Recon Fingerprint is plain Markdown rather than provider-specific code, so the same skill runs on GPT-5, Claude, Gemini, Grok, or a local model — and you can switch model mid-chat without it breaking. TypingMind runs on your own API keys, so you pay providers directly instead of a per-seat subscription, and your skills and chats stay in your own storage.

How do I install Recon Fingerprint in TypingMind?

Open Plugins → Skills → Install from GitHub in TypingMind and paste https://github.com/crazyMarky/pentest-skills/tree/main/recon-fingerprint. TypingMind reads its SKILL.md and bundles its files and installs it as a skill you can enable per chat.

Which AI models can use Recon Fingerprint?

Any model you connect in TypingMind. AI skills are plain Markdown instructions rather than provider-specific code, so GPT, Claude, Gemini, Grok, and local models can all load this skill when a request matches it.

How many AI models can I use with Recon Fingerprint?

As many as you like. As long as a model supports skills, you can use Recon Fingerprint with it — GPT, Claude, Gemini, Grok, DeepSeek, Mistral, Llama and more — all on TypingMind with your own API keys.

Is the Recon Fingerprint AI skill free?

Yes. It is published on GitHub by crazyMarky under the Apache-2.0 license. You only pay your own AI provider for the tokens you use.

What are AI skills?

An AI skill is a reusable instruction bundle that teaches an AI model how to do one specific task. It follows the open Agent Skills format: a SKILL.md file with a name and description, plus any scripts, templates or reference files the model may need. The model reads the instructions only when your request matches the skill, so an installed skill costs nothing until it is used.

How are AI skills different from plugins or MCP servers?

A plugin or MCP server gives a model new tools to call — code that runs somewhere and returns a result. An AI skill gives the model knowledge and process instead: how to approach a task, which steps to follow, what good output looks like. Skills are plain Markdown, so they need no server, no API key and no runtime, and they work with any model.

Overview

Installation

Install in TypingMind

Install in another agent

Use it in TypingMind

Works with any AI model

Skill instructions

Web Fingerprinting & WAF Detection

Authorization Warning

Prerequisites

Quick Start

Basic Technology Detection

WAF Detection

HTTP Header Analysis

Comprehensive Fingerprinting (Nuclei)

Common Scenarios

Scenario 1: Quick Technology Fingerprinting

Scenario 2: WAF Detection

Scenario 3: Server Header Analysis

Scenario 4: Technology Detection with Nuclei

Scenario 5: HTTPx Fingerprinting

Scenario 6: CMS Detection

Scenario 7: JavaScript Framework Detection

Scenario 8: Server Version Detection

Scenario 9: CDN Detection

Scenario 10: SSL/TLS Fingerprinting

Tool Selection Guide

Technology Fingerprints

Web Servers

Backend Frameworks

Frontend Frameworks

WAF Signatures

Tips and Best Practices

Resources

Scripts

References

Scenario: Persistent Storage of Fingerprinting Results

Assets

Bundled files

Frequently asked questions

Related AI Skills

Set up your own AI workspace now