Read the headers
Before attacking anything, learn what it is. The response headers often name the server and framework outright:
curl -s -I http://127.0.0.1:8080/In the terminal
student@vulntech:~$ curl -s -I http://127.0.0.1:8080/ HTTP/1.1 200 OK Server: Werkzeug/2.2.2 Python/3.11.2 Date: Mon, 19 Oct 2026 08:35:18 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1930 Connection: close
The Server header here gives away the stack. In the field you'd also reach for whatweb and nikto (both installed on this machine) to fingerprint technologies and flag known issues — though against a slow target you run them sparingly.