기술 스택 핑거프린팅

Recon is the first phase of every targeted attack and most opportunistic ones. Tools like Wappalyzer, BuiltWith, and Shodan scan the public internet continuously, mapping which sites run which stacks at which versions. The attacker's worflow: filter for 'sites running vulnerable WordPress 5.x' or 'sites with exposed Spring Boot Actuator', then mass-exploit. Fingerprint defense doesn't prevent attacks, but it raises the cost — the attacker has to probe individually rather than pulling targets from a pre-built database. Combined with prompt patching, fingerprint reduction means the only attackers who reach your stack are the ones already specifically interested.

Frameworks and hosts announce themselves in several ways: version banners in response headers such as `X-Powered-By` and `Server`, distinctive session cookie names, framework-specific asset paths, markers inside the JavaScript bundle, and CDN headers. None of these is a secret on its own. Together they tell an attacker which stack you run and often which version, and a version maps straight to published CVEs.

Maps your deployment to known CVEs in seconds. An outdated WordPress version surfaces a list of public exploits ranked by severity and exploitation maturity. An old Spring Boot version is potentially Spring4Shell-class RCE. Knowing your edge CDN is knowing which WAF rules to tunnel through (every WAF has known bypasses; targeted attackers research yours specifically). Combined with the CVE-lookup check, fingerprinting is the input that makes targeted exploitation efficient.

Strip version banners from response headers. Most servers and frameworks ship with an option: nginx `server_tokens off`, Apache `ServerTokens Prod` and `ServerSignature Off`, Express `app.disable('x-powered-by')`, ASP.NET MVC's `<httpRuntime enableVersionHeader='false' />`, Django's `SECURE_BROWSER_XSS_FILTER` and related. Don't expose framework defaults that broadcast identity — `/wp-json/wp/v2/users` listing your editorial team is WordPress doing what WordPress does, but you can disable it. Patch promptly so the version that's identifiable is at least the current one. A CDN with a strong WAF (Cloudflare, AWS Shield, Fastly) helps mask origin identity from drive-by scanners. Audit your bundle for inline references to your stack — many SaaS apps unintentionally include `vite.config.ts` paths or webpack plugin names in error messages. None of these alone is impactful; together they reduce the surface meaningfully.