WhatWeb: Identify Web Technologies with a Ruby Scanner

Overview

WhatWeb is a Ruby web scanner for answering the question, “What is that website?” It fingerprints web technologies such as content management systems, blogging platforms, analytics packages, JavaScript libraries, web servers, and embedded devices, and can also identify versions and other clues exposed by a site. The project’s core is its collection of more than 1,800 recognition plugins.

It is aimed at security practitioners and people doing web reconnaissance who need to inventory or identify technologies across individual sites or target lists. Its aggression settings let users choose between a quick, low-request scan and more thorough checks that make additional requests.

Key Features

• Uses plugins to recognize a broad range of web technologies and versions.
• Offers stealthy, aggressive, and heavy scan modes to trade request volume for detection depth.
• Accepts URLs, hostnames, IP addresses, files, and IP ranges as targets.
• Supports concurrent scanning, HTTP headers, basic authentication, cookies, proxies, and redirect controls.
• Writes results in formats including brief text, verbose text, XML, JSON, and MagicTree XML, with optional database and search-index logging.
• Allows plugin selection, plugin search, custom command-line plugins, and user-authored Ruby plugins.
• Supports dual-protocol scanning for simple hostnames, testing both HTTP and HTTPS.

Use Cases

• A penetration tester can fingerprint a permitted target and use a more aggressive mode when deeper version detection is needed.
• A security team can inventory technologies across a list of authorized websites or an IP range.
• A web administrator can quickly check which server, CMS, libraries, and other technologies a site exposes.
• A researcher can write or select plugins to look for a particular technology across a target set.

Getting Started

git clone https://github.com/urbanadventurer/WhatWeb.git
cd WhatWeb
./whatweb example.com

See the README for installation, options, and plugin documentation.

Considerations

• More aggressive modes send additional requests and may be unsuitable without authorization. The README notes that aggressive plugins can guess URLs and that heavy mode runs aggressive tests across targets.
• The measured project status is Quiet, with no commits in the last 90 days. There has been a release within the last year, and the contributor base is not flagged as concentrated, but the measured period shows no recent issue closures or merged pull requests.
• Ruby is required. MongoDB logging and character-set detection are optional dependencies; the README says character-set detection can reduce performance and is needed for JSON and MongoDB logging.
• WhatWeb is licensed under GPL-2.0, so teams should check the license terms against their distribution and integration plans.