The Problem with Traditional Security Tools
When a new security flaw is discovered, teams ask: "Who is actually affected?"
But finding the answer isn't easy.
Old ways don't work well:
- Vendor emails tell you who should be affected, not who actually is
- Shodan shows open ports, not what a website loads in your browser
- Technology lists track big names but miss specific versions
- Security scanners can't check every website on the internet
What if you could search for one file and instantly see every website using it?
That's exactly what tools like StackScan's Custom Scan let you do.
StackScan's Custom Scan lets you find any website by searching for a specific file, folder, or host-making it easy to track vulnerable versions, third-party risks, and hidden technologies without needing a pre-made list.
How Security Researchers Use This
1. Find the Exact Risky Version
Version numbers are usually in file names. When a security flaw targets a specific version, you can find exactly that version:
jquery-1.12.4.min.js - 377,673 websites
jquery-1.11.3.min.js - 232,719 websites
This is much better than asking "Who uses jQuery?"-which gives millions of sites, most using safe versions.
2. Check Supply Chain Risk
When a third-party provider gets hacked or changes ownership, every site using them is at risk:
polyfill.io - 16,016 websites
cdn.polyfill.io - 9,866 websites
In 2024, polyfill.io had a widely reported security problem. A quick search showed exactly who was still affected.
3. Find Plugin Usage
Most WordPress plugins store files in the same folder on every site. One search finds all users:
/wp-content/plugins/revslider/ - 2,248,932 websites
4. Map Third-Party Dependencies
Before a problem happens, know what you're dealing with:
cdnjs.cloudflare.com - 5,833,844 websites
cdn.jsdelivr.net - 4,363,936 websites
5. Find Things That Aren't Cataloged
Custom tools, company-specific scripts, new frameworks-if a site loads it and it has a unique filename, you can find it. No list needed.
Simple Workflow for Security Teams
1. Find one site that has the file you're looking for
2. Search for it
3. Check the sample results to make sure they're right
4. Try 2-3 different searches and compare
5. Add country filters if you only want certain regions
6. Download the full list (only cost)
7. Run again later to see who fixed the problem
Key point: Searching is free and unlimited. You only pay when you download the results.
How to Run a Custom Scan on StackScan
Step 1: Open and Sign Up
Go to https://www.stackscan.com, Click on the "Get Started" button in the top right corner. Sign up with your email. Once registered, you'll be taken to the Custom Scan page.
Step 2: Choose What to Search For
Pick one option:
File Name - Search for a specific file - jquery.js
File Path - Search for a folder - /wp-content/plugins/
Asset Host - Search for the website providing the file - cdn.shopify.com
Step 3: Type What You Want to Find
Type the file name, folder, or website address you're looking for.
Examples:
woocommerce.css/wp-content/plugins/polyfill.io
Tip: You can paste a full website address—the tool will clean it up for you.
Step 4: Click "Search"
Press the search button.
You'll instantly see:
- Total number of websites found
- 10 sample websites with their country and domain
- Country filters to narrow results (optional)
Step 5: Check the Sample Results
Look at the 10 sample websites.
Ask yourself:
- Are these the right kind of websites?
- Do they actually use what I searched for?
If not, try a different search term.
Step 6: Try Different Search Terms
Searching is free, so try different versions:
Example for WordPress:
/wp-content/ - 25 million+
/wp-includes/js/ - 21 million+
wp-embed.min.js - 1.5 million+
Choose the one that best fits what you need.
Step 7: Download Your Results
What's Included
The index covers JavaScript and CSS files only-the code that runs in your browser. It does not include:
- Files on the server
- Settings files
- Response headers
- Images or fonts
- Anything a page doesn't link to
This is designed this way-it's exactly what makes it useful for browser-based and third-party questions.
Company Data
You'll get company data (name, size, industry, location, LinkedIn URL) for some websites in your export.
Real Examples
WordPress-One Platform, Different Results
/wp-content/ - 25,809,358
/wp-includes/js/ - 21,948,511
wp-embed.min.js - 1,599,285
The same platform, but results vary by 16×!
Lesson: Search for core folders, not optional files, if you want the biggest picture.
Other Uses
- Check plugin popularity for any WordPress plugin
- Find competitor users by searching their tracking scripts
- Track framework adoption like React or Next.js
-
Find weak spots by searching for
/node_modules/(sites exposing their code)
Top comments (0)