This tool addresses the need for high-performance, server-side fingerprinting of web frameworks, CDNs, and CMSs. It targets security professionals, red teamers, and enterprise security teams, providing a rapid and evidence-based method for understanding the technology stack behind web assets, thereby accelerating asset comprehension and subsequent validation efforts.

How It Works

HFinger utilizes a multi-evidence fusion strategy, correlating data from HTTP headers, cookies, HTML content, JavaScript, Favicons, JSON/APIs, TLS certificates, and HTTP protocol behavior. It supports both active scanning of targets and passive identification by acting as an HTTP/HTTPS proxy. The tool features a unified YAML rule schema, allowing for built-in core rules and extensibility through external rule files. Outputs include detailed evidence and confidence scores, designed for human review and automated orchestration. Notably, it incorporates support for Chinese cryptographic standards (国密) in TLS/TLCP.

Quick Start & Requirements

• Primary install: Clone the repository and build using Go:

  git clone https://github.com/HackAllSec/hfinger.git
  cd hfinger
  go build
  

• Prerequisites: Go compiler.
• Usage Examples:
  • Single target: hfinger -u https://www.example.com
  • From file: hfinger -f targets.txt
  • Passive mode: hfinger -l 127.0.0.1:8888
  • External rules: hfinger --rules ./rules/custom.yaml
• Links: GitHub Repository

Highlighted Details

• Comprehensive Fingerprinting: Leverages diverse data sources (headers, cookies, JS, TLS, etc.) for robust identification.
• Dual Mode Operation: Seamlessly switches between active scanning and passive traffic analysis via an HTTP/HTTPS proxy.
• Extensible Rule Engine: Built-in rules are augmented by a flexible YAML format for custom, community, or enterprise-specific rules.
• 国密 (GM) TLS Support: Native handling of Chinese cryptographic standards (TLCP) for secure communication protocols.
• Integration-Ready Output: Generates structured JSON/JSONL/XLSX data with evidence and confidence, designed for toolchain integration and LLM/Agent workflows.

Maintenance & Community

The project welcomes contributions via Issues, Pull Requests, and YAML fingerprint rules. Specific community links (e.g., Discord, Slack) are not detailed in the README.

Licensing & Compatibility

• License: Apache License 2.0.
• Compatibility: The Apache 2.0 license is permissive and generally compatible with commercial use and closed-source linking.

Limitations & Caveats

HFinger is explicitly positioned as a server-side technology stack identification tool, not a vulnerability scanner. Its use is restricted to authorized security testing, and users must ensure they have explicit authorization for target systems, adhering to all applicable laws and contractual agreements. Unauthorized use is prohibited, and the developers disclaim responsibility for any consequences arising from misuse.