WhatWeb Web Scanner for Technology Detection

WhatWeb is an open-source web technology fingerprinting tool that helps security researchers identify the software and services powering a website. It detects content management systems (CMS), web servers, JavaScript libraries, blogging platforms, analytics packages, and other technologies by examining HTTP responses and website characteristics.

The WhatWeb web scanner uses a large collection of plugins to recognize technology-specific patterns. Depending on the target and available evidence, it can identify software versions, server details, cookies, email addresses, framework components, and other useful information during reconnaissance.

WhatWeb is useful during authorized penetration testing, security assessments, and infrastructure discovery. For related tools, explore our Kali Linux security tutorials and learn how web reconnaissance fits into a broader assessment workflow.

Key Features of WhatWeb

WhatWeb combines passive fingerprinting techniques with configurable requests to improve technology detection. Its major features include:

• Extensive plugin library: More than 1,800 plugins identify different web technologies and software platforms.
• Configurable aggression: Choose between fewer HTTP requests and more detailed fingerprinting.
• Version detection: Identify software versions when the target exposes sufficient information.
• Custom HTTP headers: Specify headers, cookies, user agents, and authentication details.
• Proxy support: Route requests through a configured proxy when required by an authorized testing environment.
• Multiple output formats: Save results as JSON, XML, verbose logs, or other supported formats.
• Concurrent scanning: Adjust the number of simultaneous requests to balance speed and server load.
• Custom plugins: Extend detection rules to recognize additional technologies or patterns.
• Target flexibility: Scan individual URLs, hostnames, IP addresses, input files, and supported IP ranges.

These capabilities make WhatWeb a useful first step before more detailed testing. For additional reconnaissance resources, browse our RustDesk tools archive or visit the official WhatWeb repository for source code and documentation.

How WhatWeb Identifies Website Technologies

When a browser loads a website, the server returns HTTP headers, HTML content, cookies, and other information. These responses can reveal which technologies are being used, even when the website does not explicitly advertise them.

WhatWeb analyzes these indicators through specialized plugins. A plugin might inspect a page title, a recognizable HTML tag, a cookie name, a response header, or a known file path. Combining several indicators can improve identification accuracy when a website hides some of its default signatures.

For example, WordPress websites may expose recognizable references such as /wp-content/, theme resources, or familiar installation paths. Removing one indicator does not necessarily prevent detection because the plugin can check other characteristics.

However, fingerprinting is not infallible. Reverse proxies, customized applications, caching layers, and deliberately modified responses can affect the results. Treat detected versions and technologies as evidence to validate rather than guaranteed proof of the target’s configuration.

Installing WhatWeb on Kali Linux

WhatWeb is available in Kali Linux repositories. If it is not already installed, update the package index and install it using APT.

# Update the package index
sudo apt update

# Install WhatWeb
sudo apt install whatweb

# Verify the installed version
whatweb --version

Once installed, you can run WhatWeb directly from the terminal. To explore other security tools available for Linux, visit Kali Linux Tutorials.

For the latest development version, clone the official repository and install the required Ruby dependencies according to its documentation.

# Clone the official repository
git clone https://github.com/urbanadventurer/WhatWeb.git

# Enter the project directory
cd WhatWeb

# Install dependencies
bundle install

# Check the version
./whatweb --version

The repository’s current installation instructions should be followed if dependency requirements differ on your system.

Scanning a Website with WhatWeb

The simplest way to use WhatWeb is to supply a hostname or URL. The scanner examines the website and prints the detected technologies directly in the terminal.

# Scan a website
whatweb https://example.com

# Scan multiple websites
whatweb example.com example.org

# Display detailed output
whatweb -v https://example.com

The output can include the HTTP response status, server information, detected CMS, page title, cookies, IP address, and security-related headers. The available fields depend on the website and the plugins that match its responses.

For example, a result containing 301 Moved Permanently indicates a redirect. WhatWeb can follow supported redirects and inspect the resulting destination, which may reveal additional technology information.

Understanding WhatWeb Aggression Levels

One of WhatWeb’s most useful features is its aggression setting. It controls how many requests the scanner can make and how extensively it investigates a target.

• Level 1 – Stealthy: Uses a minimal request approach, making it suitable for initial fingerprinting.
• Level 3 – Aggressive: Runs additional tests for plugins identified during initial detection.
• Level 4 – Heavy: Performs more extensive plugin checks and can generate substantially more requests.

Level 2 is unused in the documented aggression scheme. Higher aggression does not guarantee more accurate results, and it can increase scan duration, server load, and the chance of triggering monitoring systems.

# Perform a basic scan
whatweb example.com

# Run an aggressive scan
whatweb -a 3 example.com

# Run a heavy scan
whatweb -a 4 example.com

Use higher levels only when you have authorization to perform the additional requests. When investigating a particular technology, limiting the scan to its relevant plugin can reduce unnecessary traffic.

Working with WhatWeb Plugins

Plugins are the core of WhatWeb’s detection system. They define the patterns and checks used to recognize individual technologies, from CMS platforms to server software and web application frameworks.

You can list the available plugins and inspect their descriptions using the following commands.

# List available plugins
whatweb -l

# Search plugin information
whatweb -I wordpress

# Search for plugins by keyword
whatweb --search-plugins=wordpress

To focus on a particular technology, specify the required plugin:

# Run only the WordPress plugin
whatweb -p wordpress https://example.com

Plugin selection is particularly helpful when validating a specific technology or investigating possible version information. You can also develop custom plugins using Ruby to match unique headers, page content, hashes, and other recognizable patterns.

For plugin development examples and advanced options, consult the WhatWeb project wiki.

Scanning Multiple Targets and IP Ranges

WhatWeb supports batch scanning, allowing researchers to process several authorized targets without entering each hostname manually. This is useful when auditing an organization’s approved asset inventory.

Create a text file named targets.txt containing one hostname or URL per line, then execute:

# Read targets from a file
whatweb -i targets.txt

# Scan an authorized internal network range
whatweb --no-errors 192.168.1.0/24

The second example examines addresses within the specified private network range and suppresses error messages for targets that cannot be scanned successfully. Use network-wide scans only on systems you own or have explicit permission to assess.

Saving WhatWeb Scan Results

Saving results makes it easier to compare scans, investigate findings, and incorporate fingerprinting data into security assessment workflows. WhatWeb supports several logging formats for different analysis requirements.

# Save brief output
whatweb --log-brief=results.txt example.com

# Save structured JSON output
whatweb --log-json=results.json example.com

# Save XML output
whatweb --log-xml=results.xml example.com

# Save detailed output
whatweb --log-verbose=details.txt example.com

Brief logs are useful for quickly reviewing multiple targets, while JSON and XML can support automated processing. Some integrations, such as MongoDB logging, require optional dependencies.

You can also adjust concurrency and connection timeouts when scanning larger approved inventories. For example, the --max-threads option controls simultaneous scanning workers, while --open-timeout and --read-timeout configure connection and response time limits.

# Scan with a smaller number of concurrent workers
whatweb --max-threads=5 --open-timeout=10 example.com

WhatWeb for Web Reconnaissance

WhatWeb helps security professionals build an initial picture of a website’s technology stack before conducting deeper testing. Its plugin-based approach, configurable aggression levels, and flexible reporting options make it useful for penetration testing, asset discovery, and routine security assessments.

Nevertheless, WhatWeb is a fingerprinting tool rather than a complete vulnerability scanner. Identifying an outdated server or CMS does not automatically establish that the system is exploitable. Confirm findings with additional checks and assess the security impact before recommending remediation.

To get started, install WhatWeb through your Linux distribution or follow the official project’s setup instructions. You can find the source code, current release information, and further usage examples in the WhatWeb GitHub repository.