R-WHA
WhatWeb
Web technology fingerprinting scanner that identifies CMSs, frameworks, servers, and libraries.
OVERVIEW
WhatWeb is a Ruby-based fingerprinting scanner with over 1800 plugins that identify content management systems, JavaScript frameworks, web servers, analytics packages, embedded devices, version numbers, and more from a page's headers, HTML, cookies, and error responses.
Its aggression levels (from a single passive request up to a more thorough recursive probe) let a tester trade coverage for stealth, and results can feed directly into deciding which CMS-specific or version-specific tooling and exploits are worth trying next.
USE CASES
Practical use cases
- 01
Quickly identifying the CMS, framework, and server behind a target at the start of an engagement.
- 02
Spotting outdated software versions worth checking against known CVEs.
- 03
Scanning a large list of hosts in bulk to triage which stacks deserve deeper manual testing.
- 04
Confirming technology changes on a target between engagement checkpoints.
QUICK START
Early in web recon, to quickly identify the stack behind a target before choosing which specialized tools or exploits to try next.
- Confirm the target URL is inside the agreed scope.
- Install WhatWeb via the package manager or clone the GitHub repo.
- Run a default-aggression scan against the target first.
- Increase aggression (-a 3 or -a 4) only if scope and stealth requirements allow it.
- Cross-reference identified versions against known CVEs before reporting them.
whatweb -a 3 -v https://target.example.comBEFORE YOU RUN IT
What to check before running it
Higher aggression levels (-a 3/-a 4) send many more requests and can trip WAFs or rate limits — match the level to the agreed stealth profile.
Plugin-based fingerprints can be wrong or outdated on customized or heavily modified installs — treat a version match as a lead to confirm, not a fact.
Some plugins fetch additional pages or follow redirects, which can pull in out-of-scope paths on multi-tenant or shared hosting — review scope before a high-aggression run.