skills.rest
hoanghn61
hoanghn61COMMUNITY
Explore all skills by this author →
GitHub

techstack-identification

Identify a company's technology stack from passive OSINT signals.

Updated May 27, 2026
Search Tags:#reconnaissance#confidence scoring#osint#tech stack identification#evidence-based reporting#dns ct tls fingerprinting#frontend backend inference
One-click install
npx skills add https://github.com/hoanghn61/.agents --skill techstack-identification-hoanghn61
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: techstack-identification
Source: https://github.com/hoanghn61/.agents/tree/main/skills/techstack-identification
Command: npx skills add https://github.com/hoanghn61/.agents --skill techstack-identification-hoanghn61

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill eliminates the guesswork of determining what technologies a company uses by generating an evidence-backed tech stack profile from public, passive reconnaissance signals.

Core Features & Use Cases

  • Passive tech stack discovery: Infers frontend, backend, infrastructure, security, devops, and third-party services without credentials or active scanning.
  • Multi-domain signal correlation: Runs multiple specialized sub-skills across asset discovery, HTTP/DNS/TLS analysis, JavaScript/HTML parsing, repository inference, job-posting extraction, and historical checks.
  • Evidence-driven reporting: Produces a JSON report with confidence scoring and evidence for every inference, plus a human-readable Markdown summary for review.
  • Use case: In a security assessment, quickly map technologies to potential exposure paths and prioritize where to focus validation (for example, identifying the likely CDN/WAF and application framework before deeper testing).

Quick Start

Ask the system to run a passive tech stack identification for "Acme Corp" and return the highest-confidence technologies with their evidence and confidence breakdown.

Frequently Asked Questions about techstack-identification

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify a company's tech stack using passive OSINT?▼

Passive OSINT tech stack identification infers frontend, backend, infrastructure, security, devops, and third-party services from public signals. It correlates DNS, CT logs, TLS, HTTP, JavaScript/HTML, repositories, job postings, and web archives into a schema-aligned report with confidence scoring and evidence traces.

What is the best way to infer a company's web application framework from public records?▼

Inferring a company's web application framework from public records involves correlating HTTP headers, JavaScript and HTML parsing, TLS fingerprinting, and Certificate Transparency logs. This passive approach generates evidence-backed inferences with confidence scores rather than relying on active scanning or guesswork.

Can I use passive reconnaissance for preliminary security targeting?▼

Yes, passive reconnaissance supports preliminary security targeting by mapping inferred technologies to potential exposure paths. It helps prioritize validation focus, such as identifying likely CDN/WAF configurations and application frameworks before conducting deeper authorized testing.

How do DNS, CT logs, and TLS fingerprinting correlate to reveal backend infrastructure?▼

DNS, CT logs, and TLS fingerprinting reveal backend infrastructure by exposing server records, historical certificate registrations, and cryptographic handshake details. Correlating these passive signals allows inference of underlying hosting providers, load balancers, and security configurations with evidence traces.

Does this tech stack identification approach require credentials or active scanning?▼

No, this tech stack identification approach strictly avoids credentials and active scanning. It relies entirely on public, passive signals across multiple intelligence domains to produce a schema-aligned TechStackReport with confidence scoring and evidence for every inference.

Related Skills

Explore More Software Engineering Skills→
YukiIto1999YukiIto1999

techstack-identification

Identify a company's technology stack from public OSINT signals.

Community
Advanced
ArianHobson333ArianHobson333
7

json_report_generator

Generate structured TechStackReport JSON documents from asset inventory and evidence data.

Community
Advanced
hoanghn61hoanghn61

Signal Correlator Skill

Cross-validate technology signals across domains and flag contradictory evidence.

Community
Intermediate
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced