{"name":"WhatWeb: Identify Web Technologies with a Ruby Scanner","description":"WhatWeb is a Ruby web scanner that identifies websites and the technologies behind them, from CMSs and JavaScript libraries to servers and embedded devices. Its plugin-based fingerprinting ranges from a single-request stealthy scan to more thorough checks.","github":"https://github.com/urbanadventurer/WhatWeb","url":"https://osrepos.com/repo/urbanadventurer-whatweb","source":"osrepos.com","sourceDescription":"This repository profile is provided by osrepos.com, an open source repository discovery platform.","repositoryProfile":"https://osrepos.com/repo/urbanadventurer-whatweb","generatedFor":"open source discovery and AI-assisted research","markdown":"https://osrepos.com/repo/urbanadventurer-whatweb.md","json":"https://osrepos.com/repo/urbanadventurer-whatweb.json","topics":["ruby","security","cli","web-development","web-fingerprinting","technology-detection"],"keywords":["ruby","security","cli","web-development","web-fingerprinting","technology-detection"],"stars":null,"summary":"WhatWeb is a Ruby web scanner that identifies websites and the technologies behind them, from CMSs and JavaScript libraries to servers and embedded devices. Its plugin-based fingerprinting ranges from a single-request stealthy scan to more thorough checks.","content":"## Overview\n\nWhatWeb is a Ruby web scanner for answering the question, “What is that website?” It fingerprints web technologies such as content management systems, blogging platforms, analytics packages, JavaScript libraries, web servers, and embedded devices, and can also identify versions and other clues exposed by a site. The project’s core is its collection of more than 1,800 recognition plugins.\n\nIt is aimed at security practitioners and people doing web reconnaissance who need to inventory or identify technologies across individual sites or target lists. Its aggression settings let users choose between a quick, low-request scan and more thorough checks that make additional requests.\n\n## Key Features\n\n- Uses plugins to recognize a broad range of web technologies and versions.\n- Offers stealthy, aggressive, and heavy scan modes to trade request volume for detection depth.\n- Accepts URLs, hostnames, IP addresses, files, and IP ranges as targets.\n- Supports concurrent scanning, HTTP headers, basic authentication, cookies, proxies, and redirect controls.\n- Writes results in formats including brief text, verbose text, XML, JSON, and MagicTree XML, with optional database and search-index logging.\n- Allows plugin selection, plugin search, custom command-line plugins, and user-authored Ruby plugins.\n- Supports dual-protocol scanning for simple hostnames, testing both HTTP and HTTPS.\n\n## Use Cases\n\n- A penetration tester can fingerprint a permitted target and use a more aggressive mode when deeper version detection is needed.\n- A security team can inventory technologies across a list of authorized websites or an IP range.\n- A web administrator can quickly check which server, CMS, libraries, and other technologies a site exposes.\n- A researcher can write or select plugins to look for a particular technology across a target set.\n\n## Our Take\n\nWhatWeb is a mature, specialized reconnaissance tool with a large plugin set, though its measured status is Quiet, with no commits in the last 90 days and no issues or pull requests closed or merged in that period, despite a release within the last year. \n\n**Good fit if:**\n- You need Ruby-based web technology fingerprinting and value a large, selectable plugin collection.\n- Your workflow benefits from choosing between one-request scans and deeper checks, and exporting results in multiple formats.\n- You can review GPL-2.0 obligations and use the tool against targets you are authorized to scan.\n\n**Look elsewhere if:**\n- Your environment cannot run Ruby or your workflow requires Docker, which the project does not provide.\n- You need recent evidence of active issue handling or pull-request integration before adopting a tool. The measured data shows none in the last 90 days.\n- You need intrusion or exploit testing. The README says WhatWeb plugins do not support those tests.\n\n## Project Health\n\n| Signal | Value |\n|---|---|\n| Status | **Quiet**: no commits in the last 90 days |\n| Last commit | 2026-04-02 (7 months ago) |\n| Commits, last 90 days | 0 |\n| Releases, last 12 months | 1 (latest v0.6.4, 2026-04-02) |\n| Contributors | 51 (top contributor: 72% of commits) |\n| Issues closed, last 90 days | 0 |\n| Pull requests merged, last 90 days | 0 |\n| Project age | 16 years |\n\nChecked on 2026-11-06 with the GitHub API.\n\n## Project Facts\n\n- Language: Ruby\n- License: GPL-2.0\n- Stars: 7k\n- Forks: 1k\n- Topics: application-security, appsec, hacking, hacking-tools, kali-linux, network-security, owasp, penetration-test\n- Website: https://www.morningstarsecurity.com/research/whatweb\n- Archived: no\n\n## What You Need\n\nDetected in the repository:\n\n- Ruby (from Gemfile)\n- A test suite\n\n## Getting Started\n\n```bash\ngit clone https://github.com/urbanadventurer/WhatWeb.git\ncd WhatWeb\n./whatweb example.com\n```\n\nSee the [README](https://github.com/urbanadventurer/WhatWeb#readme) for installation, options, and plugin documentation.\n\n## License in Plain Words\n\n**GPL-2.0** (strong copyleft).\n\n- Commercial use: yes\n- Modify and redistribute: yes\n- You must keep: the license notice\n- Share your changes: yes, the full source of anything you distribute that includes it, under the GPL\n\nA summary, not legal advice: the LICENSE file is what applies.\n\n## Considerations\n\n- More aggressive modes send additional requests and may be unsuitable without authorization. The README notes that aggressive plugins can guess URLs and that heavy mode runs aggressive tests across targets.\n- The measured project status is Quiet, with no commits in the last 90 days. There has been a release within the last year, and the contributor base is not flagged as concentrated, but the measured period shows no recent issue closures or merged pull requests.\n- Ruby is required. MongoDB logging and character-set detection are optional dependencies; the README says character-set detection can reduce performance and is needed for JSON and MongoDB logging.\n- WhatWeb is licensed under GPL-2.0, so teams should check the license terms against their distribution and integration plans.","metrics":{"detailViews":2,"githubClicks":0},"dates":{"published":null,"modified":"2026-11-06T20:39:24.000Z"}}