xssmap 2.8.1__tar.gz → 2.9.0__tar.gz

{xssmap-2.8.1 → xssmap-2.9.0}/CHANGELOG.md

@@ -8,6 +8,45 @@ Releases before 2.8.0 predate this file; their history is in the git log.
 
 ## [Unreleased]
 
+## [2.9.0] - 2026-11-13
+
+### Added
+
+- Server-stack fingerprinting. `Server`, `X-Powered-By`, `X-AspNet-Version`,
+  `X-Generator`, `<meta name="generator">` and session cookie names are read
+  from the seed response the crawl already fetched, so the pass sends no extra
+  request. Rows are printed in the console and rendered in the Markdown and
+  HTML reports under "Server stack".
+- Outdated-version detection for components that advertise a version, using a
+  deliberately short policy table: Apache 2.4.49/2.4.50 (CVE-2021-41773,
+  CVE-2021-42013), nginx before 1.20.1 (CVE-2021-23017), PHP branches before
+  8.2 (out of security support) and IIS 6.0-8.5 (shipped only with an
+  end-of-life Windows Server). A flagged version is a lead for the operator,
+  never a finding on its own.
+- 35 tests pinning the new crawl scheduling, the transport cap, the throttle
+  rules and the stack policy table.
+
+### Changed
+
+- Crawl scheduling is continuous instead of level-by-level. `--depth` counts
+  hops from the seed and `--max-pages` is a hard stop, so one slow branch no
+  longer holds back pages that are already queued behind it.
+- `robots.txt` and `sitemap.xml` are fetched concurrently, turning two round
+  trips into one.
+- `Throttle` no longer reads an HTTP 500 as backpressure. An application error
+  is not load, so only 429/503 count, and only after a short streak; a target
+  that answers a fraction of URLs with 500 used to stack seconds of sleep into
+  the crawl and dominate its duration.
+- Binary bodies are read up to a 256 KB cap and marked truncated instead of
+  being buffered whole. A truncated body drops its connection rather than
+  returning a half-drained socket to the pool.
+
+### Fixed
+
+- Crawling a target that 500s part of its URL space is ~24x faster at the same
+  page count: 18.90 s to 0.79 s for 68 requests in the bundled benchmark
+  (identical page sets, deterministic error injection).
+
 ## [2.8.1] - 2026-11-13
 
 Packaging release. No scanner behaviour changed.

{xssmap-2.8.1/xssmap.egg-info → xssmap-2.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: xssmap
-Version: 2.8.1
+Version: 2.9.0
 Summary: Context-aware XSS scanner: crawler, browser verification, mXSS, charset and stored-XSS stages
 Author: Ian Mattas
 License-Expression: MIT
@@ -58,6 +58,12 @@ actually execute in a real browser.
   friends from body or filename, compares versions against each advisory's affected range
   (so 2.3.2 is not blamed for a 3.4.1 fix) and can merge fresh advisories from osv.dev
   with `--osv`.
+- **Server stack and outdated versions.** Reads what each host says about itself - `Server`,
+  `X-Powered-By`, `X-AspNet-Version`, `X-Generator`, `<meta name="generator">` and session
+  cookie names - from the seed response the crawl already received, so the pass costs no
+  extra request. Versions whose exact build is known-vulnerable or out of support (Apache
+  2.4.49/2.4.50, nginx before 1.20.1, PHP before 8.2, IIS 6.0-8.5) are flagged with the
+  CVE, and every row names the header it came from.
 - **Leads, not silence.** A parameter that reflects but swallows every payload is recorded
   as an unconfirmed lead with the measured filter and how much of the probe survived
   (verbatim, recased, escaped, truncated), in its own report section - never presented as a
@@ -483,6 +489,28 @@ OSV enrichment is verified against the live service, not only against fixtures.
 and Lodash 4.17.4 (9) into the local verdicts, then stopped: the fourth library was never
 queried and stayed unchanged, so the cap is visibly enforced.
 
+### Server stack and outdated versions
+
+The headers a host sends are also an inventory: `Server: nginx/1.18.0` is a version, not
+just a name. The crawler keeps the headers and the `<meta name="generator">` value of the
+first HTML response it already fetched, and the stack pass reads them without a second
+request. Three things make the result usable rather than noisy:
+
+- A row always cites its evidence (`Server`, `X-Powered-By`, `X-AspNet-Version`,
+  `X-Generator`, `meta generator`, or `cookie <name>`), so a claim can be checked against
+  the response that produced it.
+- Versions are compared numerically, so nginx 1.20.10 is newer than 1.20.9 and is not
+  blamed for a fix that shipped in 1.20.1, and the IIS rules match `8.5` without also
+  matching `10.0`.
+- The policy table only holds issues that are public, fixed and cheap to verify: Apache
+  2.4.49/2.4.50 (CVE-2021-41773, CVE-2021-42013), nginx before 1.20.1 (CVE-2021-23017),
+  PHP branches before 8.2 (out of security support) and IIS 6.0-8.5 (shipped only with an
+  end-of-life Windows Server). A CMS such as WordPress is reported with its disclosed
+  version and no end-of-life claim, because that judgement is not the scanner's to make.
+
+A flagged version is a lead: it says the build has a published problem, not that this
+host is exploitable through it. The finding standard for XSS is unchanged.
+
 ### Browser cost
 
 `--browser` reuses one browser and one page per run. The report's `browser_verification`

{xssmap-2.8.1 → xssmap-2.9.0}/README.md

@@ -34,6 +34,12 @@ actually execute in a real browser.
   friends from body or filename, compares versions against each advisory's affected range
   (so 2.3.2 is not blamed for a 3.4.1 fix) and can merge fresh advisories from osv.dev
   with `--osv`.
+- **Server stack and outdated versions.** Reads what each host says about itself - `Server`,
+  `X-Powered-By`, `X-AspNet-Version`, `X-Generator`, `<meta name="generator">` and session
+  cookie names - from the seed response the crawl already received, so the pass costs no
+  extra request. Versions whose exact build is known-vulnerable or out of support (Apache
+  2.4.49/2.4.50, nginx before 1.20.1, PHP before 8.2, IIS 6.0-8.5) are flagged with the
+  CVE, and every row names the header it came from.
 - **Leads, not silence.** A parameter that reflects but swallows every payload is recorded
   as an unconfirmed lead with the measured filter and how much of the probe survived
   (verbatim, recased, escaped, truncated), in its own report section - never presented as a
@@ -459,6 +465,28 @@ OSV enrichment is verified against the live service, not only against fixtures.
 and Lodash 4.17.4 (9) into the local verdicts, then stopped: the fourth library was never
 queried and stayed unchanged, so the cap is visibly enforced.
 
+### Server stack and outdated versions
+
+The headers a host sends are also an inventory: `Server: nginx/1.18.0` is a version, not
+just a name. The crawler keeps the headers and the `<meta name="generator">` value of the
+first HTML response it already fetched, and the stack pass reads them without a second
+request. Three things make the result usable rather than noisy:
+
+- A row always cites its evidence (`Server`, `X-Powered-By`, `X-AspNet-Version`,
+  `X-Generator`, `meta generator`, or `cookie <name>`), so a claim can be checked against
+  the response that produced it.
+- Versions are compared numerically, so nginx 1.20.10 is newer than 1.20.9 and is not
+  blamed for a fix that shipped in 1.20.1, and the IIS rules match `8.5` without also
+  matching `10.0`.
+- The policy table only holds issues that are public, fixed and cheap to verify: Apache
+  2.4.49/2.4.50 (CVE-2021-41773, CVE-2021-42013), nginx before 1.20.1 (CVE-2021-23017),
+  PHP branches before 8.2 (out of security support) and IIS 6.0-8.5 (shipped only with an
+  end-of-life Windows Server). A CMS such as WordPress is reported with its disclosed
+  version and no end-of-life claim, because that judgement is not the scanner's to make.
+
+A flagged version is a lead: it says the build has a published problem, not that this
+host is exploitable through it. The finding standard for XSS is unchanged.
+
 ### Browser cost
 
 `--browser` reuses one browser and one page per run. The report's `browser_verification`

xssmap-2.9.0/tests/test_crawlperf.py

@@ -0,0 +1,230 @@
+"""Crawl scheduling and transport cost.
+
+Three behaviours are pinned here, all of them things that made a crawl slower
+than the work it was doing:
+
+  * the crawl queue is fed continuously, so ``max_depth`` counts hops from the
+    seed and ``max_pages`` is a hard stop;
+  * a 500 from the target is not read as backpressure (only 429/503 are, and
+    only after a short streak);
+  * binary bodies are read up to a cap and their connection is dropped instead
+    of being returned to the pool half-drained.
+"""
+from __future__ import annotations
+
+import os
+import sys
+import threading
+import unittest
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from xssmap.crawler import Crawler, Scope
+from xssmap.net import HTTP, MAX_BINARY_BODY, Throttle
+
+SEED = "http://app.test/"
+
+
+class QuietLog:
+    def info(self, *_a, **_k):
+        pass
+
+    def debug(self, *_a, **_k):
+        pass
+
+    def warn(self, *_a, **_k):
+        pass
+
+    def ok(self, *_a, **_k):
+        pass
+
+    def action(self, *_a, **_k):
+        pass
+
+
+class PageResp:
+    """Enough of :class:`xssmap.net.Response` for the crawler to parse."""
+
+    def __init__(self, url, status=200, text="", content_type="text/html"):
+        self.url = url
+        self.status = status
+        self.text = text
+        self.body = text.encode()
+        self.content_type = content_type
+        self.history: list = []
+
+    @property
+    def is_html(self):
+        return self.content_type.startswith("text/html")
+
+    @property
+    def is_javascript(self):
+        return "javascript" in self.content_type
+
+
+class RouterHTTP:
+    def __init__(self, pages):
+        self.pages = pages
+        self.urls: list[str] = []
+
+    def get(self, url, headers=None, **_kwargs):
+        self.urls.append(url)
+        if url.endswith("/robots.txt") or url.endswith("/sitemap.xml"):
+            return PageResp(url, 404, "not found", "text/plain")
+        text = self.pages.get(url)
+        if text is None:
+            return PageResp(url, 404, "not found", "text/html")
+        ctype = "application/javascript" if url.endswith(".js") else "text/html"
+        return PageResp(url, 200, text, ctype)
+
+
+def crawl(pages, depth, max_pages=50):
+    http = RouterHTTP(pages)
+    crawler = Crawler(http, Scope(SEED), QuietLog(), max_depth=depth,
+                      max_pages=max_pages, crawl_js=True)
+    return crawler.run([SEED]), http
+
+
+class DepthTests(unittest.TestCase):
+    PAGES = {
+        SEED: '<a href="/a">a</a><a href="/b">b</a>',
+        "http://app.test/a": '<a href="/a1">a1</a>',
+        "http://app.test/b": '<a href="/b1">b1</a>',
+        "http://app.test/a1": '<a href="/a2">a2</a>',
+        "http://app.test/b1": "leaf",
+        "http://app.test/a2": "leaf",
+    }
+
+    def test_depth_counts_hops_from_seed(self):
+        _result, http = crawl(self.PAGES, depth=1)
+        fetched = {u for u in http.urls if not u.endswith(("/robots.txt", "/sitemap.xml"))}
+        self.assertEqual(fetched, {SEED, "http://app.test/a", "http://app.test/b"})
+        self.assertNotIn("http://app.test/a1", fetched)
+
+    def test_seed_is_depth_zero(self):
+        result, _http = crawl(self.PAGES, depth=1)
+        self.assertEqual(result.pages[SEED].depth, 0)
+        self.assertEqual(result.pages["http://app.test/a"].depth, 1)
+
+    def test_page_budget_stops_the_crawl(self):
+        _result, http = crawl(self.PAGES, depth=5, max_pages=2)
+        fetched = [u for u in http.urls if not u.endswith(("/robots.txt", "/sitemap.xml"))]
+        self.assertEqual(len(fetched), 2)
+
+    def test_boundary_pages_are_fetched_but_not_expanded(self):
+        result, _http = crawl(self.PAGES, depth=2)
+        # The seed is hop 0, so depth 2 reaches /a1 at hop 2 and stops there.
+        self.assertEqual(result.pages["http://app.test/a1"].depth, 2)
+        self.assertNotIn("http://app.test/a2", result.pages)
+
+
+class ThrottleTests(unittest.TestCase):
+    def test_application_error_is_not_backpressure(self):
+        throttle = Throttle(delay=0.0)
+        for _ in range(6):
+            throttle.on_status(500)
+        self.assertEqual(throttle.delay, 0.0)
+
+    def test_single_load_signal_does_not_slow_the_scan(self):
+        throttle = Throttle(delay=0.0)
+        throttle.on_status(503)
+        self.assertEqual(throttle.delay, 0.0)
+
+    def test_repeated_load_signals_slow_then_recover(self):
+        throttle = Throttle(delay=0.0)
+        throttle.on_status(429)
+        throttle.on_status(429)
+        slowed = throttle.delay
+        self.assertGreater(slowed, 0.0)
+        for _ in range(6):
+            throttle.on_status(200)
+        self.assertLess(throttle.delay, slowed)
+        self.assertGreaterEqual(throttle.delay, throttle.base_delay)
+
+    def test_adaptive_delay_is_capped(self):
+        throttle = Throttle(delay=0.0)
+        for _ in range(20):
+            throttle.on_status(503)
+        self.assertLessEqual(throttle.delay, 3.0)
+
+
+class _BodyHandler(BaseHTTPRequestHandler):
+    protocol_version = "HTTP/1.1"
+    disable_nagle_algorithm = True
+
+    def log_message(self, *_a):
+        pass
+
+    def do_GET(self):
+        if self.path == "/big.bin":
+            body = b"\x00" * (MAX_BINARY_BODY + 500_000)
+            ctype = "application/octet-stream"
+        elif self.path == "/small.bin":
+            body = b"\x00" * 2048
+            ctype = "application/octet-stream"
+        else:
+            body = b"<html><body>hello</body></html>"
+            ctype = "text/html"
+        self.send_response(200)
+        self.send_header("Content-Type", ctype)
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+
+class _QuietServer(ThreadingHTTPServer):
+    daemon_threads = True
+
+    def handle_error(self, request, client_address):
+        # A client that abandons a capped binary body leaves the server thread
+        # writing into a closed socket; that is the behaviour under test.
+        pass
+
+
+class BodyCapTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.server = _QuietServer(("127.0.0.1", 0), _BodyHandler)
+        cls.server.daemon_threads = True
+        threading.Thread(target=cls.server.serve_forever, daemon=True).start()
+        cls.base = f"http://127.0.0.1:{cls.server.server_address[1]}"
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.server.shutdown()
+
+    def test_binary_body_is_capped_and_flagged(self):
+        http = HTTP(timeout=10, retries=0, throttle=Throttle())
+        resp = http.get(self.base + "/big.bin")
+        self.assertTrue(resp.truncated)
+        self.assertEqual(len(resp.body), MAX_BINARY_BODY)
+
+    def test_truncated_connection_is_not_pooled(self):
+        http = HTTP(timeout=10, retries=0, throttle=Throttle())
+        http.get(self.base + "/big.bin")
+        self.assertEqual(len(http._pool()), 0)
+
+    def test_full_binary_body_is_pooled(self):
+        # Under the cap nothing is truncated, so the socket stays reusable.
+        http = HTTP(timeout=10, retries=0, throttle=Throttle())
+        resp = http.get(self.base + "/small.bin")
+        self.assertFalse(resp.truncated)
+        pool = http._pool()
+        self.assertEqual(len(pool), 1)
+        for _key, conn, _used in pool:
+            conn.close()
+
+    def test_text_body_is_read_in_full_and_pooled(self):
+        http = HTTP(timeout=10, retries=0, throttle=Throttle())
+        resp = http.get(self.base + "/page.html")
+        self.assertFalse(resp.truncated)
+        self.assertIn(b"hello", resp.body)
+        pool = http._pool()
+        self.assertEqual(len(pool), 1)
+        for _key, conn, _used in pool:
+            conn.close()
+
+
+if __name__ == "__main__":
+    unittest.main()

xssmap-2.9.0/tests/test_tech.py

@@ -0,0 +1,150 @@
+"""Server-stack fingerprinting: header parsing, version rules and report shape."""
+import unittest
+
+from xssmap import tech
+
+
+def names(techs):
+    return [t.name for t in techs]
+
+
+def by_name(techs, name):
+    return next(t for t in techs if t.name == name)
+
+
+class HeaderParsingTests(unittest.TestCase):
+    def test_nginx_version_is_read_from_server(self):
+        found = tech.detect([("Server", "nginx/1.24.0")])
+        self.assertEqual(names(found), ["nginx"])
+        self.assertEqual(found[0].version, "1.24.0")
+        self.assertEqual(found[0].source, "Server")
+
+    def test_header_lookup_is_case_insensitive(self):
+        found = tech.detect([("server", "Apache/2.4.51 (Debian)")])
+        self.assertEqual(found[0].name, "Apache httpd")
+        self.assertEqual(found[0].version, "2.4.51")
+
+    def test_products_without_a_version_are_still_named(self):
+        found = tech.detect([("Server", "cloudflare")])
+        self.assertEqual(found[0].name, "Cloudflare")
+        self.assertEqual(found[0].version, "")
+
+    def test_several_products_in_one_header(self):
+        found = tech.detect([("Server", "nginx/1.18.0 (Ubuntu) OpenSSL/1.1.1f")])
+        self.assertEqual(names(found), ["nginx"])
+
+    def test_powered_by_and_aspnet_version(self):
+        found = tech.detect([("X-Powered-By", "PHP/8.1.2"),
+                             ("X-AspNet-Version", "4.0.30319")])
+        self.assertEqual(set(names(found)), {"PHP", "ASP.NET"})
+        self.assertEqual(by_name(found, "ASP.NET").version, "4.0.30319")
+
+    def test_meta_generator_identifies_the_cms(self):
+        found = tech.detect([], generator="WordPress 6.2")
+        self.assertEqual(found[0].name, "WordPress")
+        self.assertEqual(found[0].version, "6.2")
+        self.assertEqual(found[0].source, "meta generator")
+
+    def test_cookie_names_identify_the_runtime(self):
+        found = tech.detect([("Set-Cookie", "PHPSESSID=abc123; path=/; HttpOnly")])
+        self.assertEqual(found[0].name, "PHP")
+        self.assertEqual(found[0].version, "")
+        self.assertTrue(found[0].source.startswith("cookie "))
+
+    def test_cookie_does_not_repeat_a_versioned_product(self):
+        found = tech.detect([("X-Powered-By", "PHP/7.4.33"),
+                             ("Set-Cookie", "PHPSESSID=abc; path=/")])
+        self.assertEqual(names(found), ["PHP"])
+        self.assertEqual(found[0].version, "7.4.33")
+
+    def test_duplicate_evidence_is_collapsed(self):
+        found = tech.detect([("Server", "nginx/1.24.0"), ("Server", "nginx/1.24.0")])
+        self.assertEqual(len(found), 1)
+
+    def test_empty_headers_yield_nothing(self):
+        self.assertEqual(tech.detect([]), [])
+        self.assertEqual(tech.detect([], generator=""), [])
+
+
+class VersionRuleTests(unittest.TestCase):
+    def test_apache_2449_is_flagged_critical(self):
+        row = tech.detect([("Server", "Apache/2.4.49")])[0]
+        self.assertEqual(row.status, "vulnerable")
+        self.assertEqual(row.severity, "critical")
+        self.assertIn("CVE-2021-41773", row.cves)
+
+    def test_apache_2450_is_flagged_with_its_own_cve(self):
+        row = tech.detect([("Server", "Apache/2.4.50")])[0]
+        self.assertIn("CVE-2021-42013", row.cves)
+
+    def test_patched_apache_is_not_flagged(self):
+        row = tech.detect([("Server", "Apache/2.4.51")])[0]
+        self.assertEqual(row.status, "detected")
+        self.assertEqual(row.cves, [])
+
+    def test_old_nginx_matches_the_resolver_cve(self):
+        row = tech.detect([("Server", "nginx/1.18.0")])[0]
+        self.assertEqual(row.status, "vulnerable")
+        self.assertEqual(row.severity, "high")
+        self.assertIn("CVE-2021-23017", row.cves)
+
+    def test_nginx_1201_is_the_fix_and_is_clean(self):
+        row = tech.detect([("Server", "nginx/1.20.1")])[0]
+        self.assertEqual(row.status, "detected")
+
+    def test_version_compare_is_numeric_not_lexicographic(self):
+        # 1.20.10 > 1.20.9 > 1.20.1, so none of these are "older than 1.20.1".
+        for version in ("1.20.9", "1.20.10", "1.21.0"):
+            row = tech.detect([("Server", f"nginx/{version}")])[0]
+            self.assertEqual(row.status, "detected", version)
+
+    def test_php_below_82_is_out_of_support_without_a_cve_claim(self):
+        row = tech.detect([("X-Powered-By", "PHP/7.4.33")])[0]
+        self.assertEqual(row.status, "outdated")
+        self.assertEqual(row.cves, [])
+        self.assertTrue(row.detail)
+
+    def test_supported_php_is_clean(self):
+        row = tech.detect([("X-Powered-By", "PHP/8.3.1")])[0]
+        self.assertEqual(row.status, "detected")
+
+    def test_iis_10_is_not_flagged(self):
+        row = tech.detect([("Server", "Microsoft-IIS/10.0")])[0]
+        self.assertEqual(row.status, "detected")
+
+    def test_iis_85_is_flagged_but_prefix_does_not_swallow_10(self):
+        self.assertEqual(tech.detect([("Server", "Microsoft-IIS/8.5")])[0].status,
+                         "outdated")
+        self.assertEqual(tech.detect([("Server", "Microsoft-IIS/10.0")])[0].status,
+                         "detected")
+
+    def test_cms_versions_are_reported_without_eol_claims(self):
+        row = tech.detect([], generator="Drupal 9")[0]
+        self.assertEqual(row.status, "detected")
+        self.assertEqual(row.cves, [])
+
+
+class ReportShapeTests(unittest.TestCase):
+    def test_rows_carry_every_report_field(self):
+        rows = tech.rows(tech.detect([("Server", "Apache/2.4.49")]))
+        self.assertEqual(set(rows[0]), {"name", "version", "source", "status",
+                                        "severity", "cves", "detail"})
+        self.assertIsInstance(rows[0]["cves"], list)
+
+    def test_summary_counts_by_status(self):
+        found = (tech.detect([("Server", "Apache/2.4.49")])
+                 + tech.detect([("X-Powered-By", "PHP/7.4")])
+                 + tech.detect([("Server", "Microsoft-IIS/10.0")]))
+        self.assertEqual(tech.summary(found)["vulnerable"], 1)
+        self.assertEqual(tech.summary(found)["outdated"], 1)
+        self.assertEqual(tech.summary(found)["detected"], 1)
+
+    def test_line_names_the_version_and_evidence(self):
+        row = tech.detect([("Server", "nginx/1.18.0")])[0]
+        self.assertIn("nginx 1.18.0", row.line())
+        self.assertIn("Server", row.line())
+        self.assertIn("1.20.1", row.line())
+
+
+if __name__ == "__main__":
+    unittest.main()

{xssmap-2.8.1 → xssmap-2.9.0}/xssmap/__init__.py

@@ -1,6 +1,6 @@
 """xssmap - context-aware cross-site scripting scanner with a crawler."""
 
-__version__ = "2.8.1"
+__version__ = "2.9.0"
 
 __all__ = ["__version__", "main"]
 

{xssmap-2.8.1 → xssmap-2.9.0}/xssmap/cli.py

@@ -18,6 +18,7 @@ from . import report as rp
 from . import sarif
 from . import state as stateio
 from . import subdomains as subs
+from . import tech as techmod
 from . import waf as wafmod
 from .browser import BrowserVerifier
 from .callback import CallbackListener
@@ -723,6 +724,7 @@ def main(argv=None) -> int:
     brute_reports: list[dict] = []
     discoveries: list[dict] = []
     libs_found: list = []
+    server_tech: list = []
     waf_results: dict[str, wafmod.WAFDetection] = {}
     evasion_notes: dict[str, str] = {}
     fuzz_summary = None
@@ -824,6 +826,17 @@ def main(argv=None) -> int:
             if crawl_result.errors:
                 log.warn(f"{len(crawl_result.errors)} request(s) failed during crawl "
                          f"(first: {crawl_result.errors[0][1][:90]})")
+            # Server-stack pass: it reads the seed response the crawl already
+            # received, so it costs no extra request. An outdated version is a
+            # lead for the operator, never a finding on its own.
+            if crawl_result.root_headers:
+                server_tech = techmod.detect(crawl_result.root_headers,
+                                             crawl_result.generator)
+                for entry in server_tech:
+                    if entry.status == "detected":
+                        log.info(entry.line())
+                    else:
+                        log.warn(entry.line())
         else:
             log.info("crawling disabled")
 
@@ -1291,6 +1304,10 @@ def main(argv=None) -> int:
         meta["js_libraries"] = [lib.as_dict() for lib in lib_list]
         meta["js_library_summary"] = {
             k: v for k, v in jslibmod.summary(lib_list).items() if k != "libraries"}
+    if server_tech:
+        meta["server_stack"] = techmod.rows(server_tech)
+        meta["server_stack_summary"] = {
+            k: v for k, v in techmod.summary(server_tech).items() if v}
     if discoveries:
         meta["discovered_parameters"] = discoveries
     if fuzz_summary is not None: