StackPrism by setube

StackPrism detects technologies and services used by websites, including frontend and backend technologies, CDNs, SaaS, advertising and marketing tools, analytics, authentication, payment services, website software, themes, and templates.

StackPrism / 栈棱镜 is a browser extension for identifying website technology stacks, built on Chrome / Edge Manifest V3. Simply visit any webpage and click the extension icon to discover which frontend frameworks, backend services, CDNs, analytics tools, authentication systems, payment services, and other technologies the site uses. Results are organized and displayed by category.

【Multidimensional Detection, Beyond HTML】

Unlike most similar tools on the market that only scan HTML and resource URLs, StackPrism collects clues through multiple independent detection channels operating in parallel:

• Static scanning: When a page loads, the extension scans DOM nodes, global variables, CSS class names, CSS variables, and meta tags.

• Response header monitoring: A Service Worker monitors response headers and captures information such as Server, X-Powered-By, and Cookie from the main document, XHR requests, and iframes.

• Dynamic resource monitoring: Even after the page finishes loading, the extension continues monitoring newly loaded scripts, stylesheets, iframes, and feed links.

• JavaScript copyright comment scanning: The opening sections of main bundle files are fetched asynchronously to analyze copyright comments. Embedded OAuth URLs within bundle code are also examined. This makes it possible to identify third-party dependencies bundled into vendor chunks, as well as callback URLs used by single-page applications (SPAs) for authentication flows such as “Sign in with X.”

Results from all four channels are merged, deduplicated, and organized into more than 50 categories.

【Detection Coverage】

• Frontend: Frontend frameworks (React / Vue / Angular / Svelte, etc.), UI frameworks (Bootstrap / Tailwind / Ant Design, etc.), build tools and runtimes (Vite / Webpack / Rollup, etc.), and frontend libraries (thousands of NPM libraries distributed through CDNs).

• Backend: Web servers (Nginx / Apache / IIS / OpenResty), backend frameworks (Rails / Django / Spring / Express / ASP.NET, etc.), CDNs and hosting providers (Cloudflare / AWS / Vercel / Netlify, etc.), and programming languages and runtimes (Node.js / Python / PHP / Java, etc.).

• Content and platforms: Website software (WordPress / Drupal / Joomla, etc.), themes and templates, CMS platforms, e-commerce platforms, RSS, and subscription feeds.

• Third-party services: SaaS, large language models (LLMs) and AI services, analytics, advertising and marketing, third-party authentication (Google / GitHub / Apple / Microsoft, as well as national identity-based SSO systems across different regions), and payment services.

• Security and protocols: HTTPS, HTTP/2, HTTP/3, CSP, and cookie consent mechanisms.

In total, StackPrism includes more than 20,000 detection rules covering over 50 categories.

【Key Features】

• MV3 Service Worker architecture: No permanently running background process. The extension is event-driven and uses minimal memory.

• Rules as data: More than 50 JSON rule files are centrally maintained. During the build process, hint prefilters and combined keyword regular expressions are precompiled. At runtime, only candidate rules that pass the initial filters are evaluated.

• Fake response header detection: If response headers contain multiple identification fields associated with different technologies or entities, such as server, x-aspnet-, x-drupal-, x-powered-cms, and x-varnish, or if the server field lists multiple products, the confidence of all related detection results is automatically downgraded and a warning is added. This helps identify common header spoofing techniques.

• Self-identification suppression: When visiting more than 50 major websites, including github.com, x.com, and npmmirror.com, the extension automatically avoids listing same-named services as technologies used by the website currently being visited.

• HTTP version detection: The actual negotiated protocol version is extracted from the response status line, bypassing restrictions imposed by CORS and the Timing-Allow-Origin header.

• JavaScript bundle scanning: Detects cases where SPAs embed OAuth callback URLs directly in their bundle files. This makes it possible to identify authentication mechanisms even when no login buttons are visible in the HTML.

【Privacy】

StackPrism runs entirely locally:

• All detection takes place inside the browser, and results are stored exclusively in chrome.storage.

• No page content, URLs, or detection results are transmitted to any external server.

• No telemetry, advertising SDKs, or external analytics tools.

• The only network requests are asynchronous fetches of short opening sections from selected JavaScript files already loaded by the target website. These are used to identify copyright comments. The browser cache is utilized, avoiding additional data transfers for resources that are already cached.

【Open Source】

The source code is hosted on GitHub under the CC BY-NC-SA 4.0 license, which permits non-commercial use and modification of the project, subject to the license terms.

https://github.com/setube/stackprism

Reports of missed detections or false positives are welcome in the Issues section. Clicking the “Inaccurate Detection” button in the extension popup automatically opens the issue template. Pull requests introducing new detection rules are also welcome.