How to use
- Copy the installation command and review the source package before installing it in your own agent environment.
- Check the source document for required tools, credentials and supported hosts.
- Describe your input and desired deliverable; review the output against the source material.
npx skills add https://github.com/TerminalSkills/skills --skill whatwebBefore you start
- Installation does not include a model subscription, API allowance or permission to access your files.
- Repository stars and installation counts describe activity, not an independent quality or security test.
Original skill document
Rendered from the source repository. Headings, examples, code, tables, links, and referenced images are preserved.
WhatWeb
Overview
Identify web technologies on target websites. WhatWeb recognizes CMS platforms, web frameworks, JavaScript libraries, analytics tools, web servers, embedded devices, version numbers, and more. It has over 1,800 plugins for technology detection.
Instructions
Installation
bash
# Debian/Ubuntu/Kali
sudo apt install whatweb
# macOS
brew install whatweb
# From source (latest release is 0.6.4, April 2026; needs Ruby)
git clone https://github.com/urbanadventurer/WhatWeb.git
cd WhatWeb && bundle install
./whatweb --versionThe repository also ships a make install target for a system-wide install. Check whatweb --version after installing: distro packages often lag behind the release.
Basic Usage
bash
# Scan a single URL
whatweb https://www.northwind-logistics.com
# Scan multiple URLs
whatweb https://www.northwind-logistics.com https://blog.northwind-logistics.com
# Scan from a file
whatweb -i urls.txt
# Output formats
whatweb https://www.northwind-logistics.com --log-json=results.json # JSON
whatweb https://www.northwind-logistics.com --log-xml=results.xml # XML
whatweb https://www.northwind-logistics.com --log-brief=results.txt # one line per target, greppable
whatweb https://www.northwind-logistics.com -v # VerboseAggression Levels
Levels control how much WhatWeb probes the target (-a / --aggression):
bash
# Level 1 (Stealthy) - default
# One HTTP request per target, follows redirects. Analyzes headers, body, cookies.
whatweb -a 1 https://shop.northwind-logistics.com
# Level 2 is unused
# Level 3 (Aggressive)
# Plugins that matched at level 1 make extra requests (guess URLs, pin down versions)
whatweb -a 3 https://shop.northwind-logistics.com
# Level 4 (Heavy)
# Aggressive tests of ALL plugins run against every URL. Noisy, may trigger a WAF
whatweb -a 4 https://shop.northwind-logistics.comTo find an exact version, combine level 3 with one plugin (-p wordpress -a 3): far fewer requests than a full level 3 scan. WhatWeb has no intrusion or exploit tests, but levels 3-4 still need permission. WhatWeb does not cache, so aggressive scans of redirecting URLs repeat requests.
Plugin System
WhatWeb's power comes from its 1,800+ plugins. Each plugin detects one technology:
bash
# List all plugins
whatweb --list-plugins
# Search plugin names and descriptions, or show details for one
whatweb --search-plugins wordpress
whatweb --info-plugins phpBB
# Use only specific plugins (comma separated)
whatweb --plugins WordPress,Apache,PHP https://blog.northwind-logistics.com
# Remove a plugin from the full set with a minus modifier
whatweb --plugins=-md5 https://blog.northwind-logistics.com
# Quick custom match without writing a plugin
whatweb --custom-plugin ":text=>'powered by OpenCart'" https://shop.northwind-logistics.comA + modifier adds to the full set (for example +plugins-disabled), - removes from it, and a plain list selects only those plugins.
What WhatWeb detects
CMS PLATFORMS
├── WordPress (version, theme, plugins)
├── Drupal, Joomla, Magento, Shopify
├── Ghost, Hugo, Jekyll (static site generators)
└── Custom CMS indicators
WEB SERVERS
├── Apache (version, modules)
├── Nginx (version, configuration hints)
├── IIS (version, ASP.NET version)
├── LiteSpeed, Caddy, Cloudflare
└── Reverse proxy detection
FRAMEWORKS & LANGUAGES
├── PHP (version from headers/errors)
├── Python (Django, Flask, FastAPI)
├── Ruby (Rails version detection)
├── Node.js (Express, Next.js, Nuxt)
├── Java (Spring, Tomcat, JBoss)
└── .NET (version, MVC detection)
JAVASCRIPT LIBRARIES
├── jQuery (version)
├── React, Vue, Angular
├── Bootstrap (version)
└── 200+ JS library plugins
SECURITY-RELATED HEADERS
├── Strict-Transport-Security, X-Frame-Options, UncommonHeaders
├── Cookie flags (HttpOnly, Secure)
└── Some WAF/CDN products (Cloudflare, Akamai, Sucuri) via plugins
OTHER
├── Analytics (Google Analytics, Matomo)
├── CDN detection (Cloudflare, Fastly, Akamai)
├── Email addresses, phone numbers
├── Country, IP address
└── Embedded devices (routers, cameras, printers)Interpreting Results
bash
# Example output:
# https://www.northwind-logistics.com [200 OK] Apache[2.4.52], Bootstrap[5.2.3],
# Country[US], HTML5, HTTPServer[Ubuntu Linux][Apache/2.4.52 (Ubuntu)],
# JQuery[3.6.0], PHP[8.1.12], Script, Title[Northwind Logistics],
# WordPress[6.3.1], X-Powered-By[PHP/8.1.12]
# What this tells a pentester:
# - Apache 2.4.52 on Ubuntu → check for known CVEs
# - PHP 8.1.12 → check for PHP-specific vulnerabilities
# - WordPress 6.3.1 → check for WP core + plugin vulnerabilities
# - jQuery 3.6.0 → check for prototype pollution
# - No WAF detected → direct attacks may work
# - X-Powered-By header → information leakage (should be disabled)Pipeline Integration
bash
# Combine with subfinder and ProjectDiscovery httpx (not the Python httpx package)
# 1. Find subdomains
subfinder -d northwind-logistics.com -silent > subs.txt
# 2. Keep the live ones
httpx -l subs.txt -silent > live.txt
# 3. Fingerprint all live hosts (JSON log is one array of result objects)
whatweb -i live.txt --log-json=tech-stack.json -a 1
# 4. Pick out WordPress sites with their version
jq -r '.[] | select(.plugins.WordPress) |
.target + " - WordPress " + (.plugins.WordPress.version[0] // "unknown")' tech-stack.jsonBulk Scanning
bash
# Large list, polite pacing: one request per second per thread, 10 threads
whatweb -i urls.txt --wait=1 --max-threads=10 --log-json=results.json -a 1
# Hostnames, CIDR ranges and ranges like 10.0.0-3.1-254 are valid targets
whatweb --no-errors --url-prefix https:// 192.168.10.0/24Defaults: 25 threads, 15 s open timeout, 30 s read timeout. There is no resume option: split large lists and re-run the unfinished part. Add --no-cookies for very high thread counts.
Examples
Fingerprint all subdomains of a target
prompt
We've discovered 150 subdomains for northwind-logistics.com using subfinder. Run WhatWeb against all live hosts to identify the technology stack — CMS platforms, web servers, frameworks, and JavaScript libraries. Flag any outdated versions with known CVEs. Produce a summary table showing each subdomain, its tech stack, and risk level.Detect WAF and security headers
prompt
Scan our 5 production domains with WhatWeb and report which ones show a recognizable WAF or CDN (Cloudflare, Akamai, Sucuri), which send Strict-Transport-Security and X-Frame-Options, and which set cookies without HttpOnly. Note that WhatWeb does not test TLS configuration or full CSP; say which checks need another tool.Map technology stack for vulnerability assessment
prompt
Before starting a penetration test on our client's web application at app.client.com, fingerprint the complete technology stack using WhatWeb at aggression level 3. Identify the web server, backend language, framework, CMS, JavaScript libraries, CDN, and any third-party services. Cross-reference all detected versions against the NVD database for known vulnerabilities. Produce a target profile document for the pentest team.Guidelines
- WhatWeb is GPLv2 and sends a
WhatWeb/<version>User-Agent by default; change it with-Uwhen policy requires - WhatWeb reports what the target advertises; hidden versions and WAFs can be missed
- Only scan targets you have explicit written authorization to test
- Start with aggression level 1 (stealthy) for initial recon; only escalate to level 3-4 on authorized pentests
- Level 4 (heavy) is noisy and will appear in target logs — use only when stealth is not a concern
- Use
--waitfor rate limiting when scanning large URL lists to avoid overwhelming targets - Cross-reference detected versions against NVD/CVE databases for vulnerability context
- WhatWeb results may include false positives — verify critical technology findings manually
