GO KALI FREE
BeginnerTools

WhatWeb Guide: Website Fingerprinting & Technology Detection

Complete WhatWeb guide for website fingerprinting and technology detection. Learn CMS identification, version detection, plugin usage, aggression levels, and practical reconnaissance techniques.

#whatweb#fingerprinting#technology detection#CMS detection#reconnaissance#web server detection#website fingerprinting#whatweb commands

Why You Need WhatWeb

You land on a website and need to know what technology stack it runs — WhatWeb identifies CMS, web servers, JavaScript libraries, analytics tools, and over 1800 other technologies. It runs from the command line, supports bulk scanning, and outputs structured data for automation. Use it to understand your target's tech stack before deeper testing with Nikto, Gobuster, or SQLMap.

Prerequisites

Before using WhatWeb, you should have:

  • Basic understanding of HTTP requests and responses ([HTTP vs HTTPS](/learn/http-vs-https))
  • Familiarity with common web technologies (CMS, web servers, JavaScript frameworks)
  • A Linux terminal or command-line environment
  • Explicit written authorization to scan target websites
  • Kali Linux with WhatWeb pre-installed (or manual installation)

    • How WhatWeb Works

    WhatWeb uses five primary detection techniques to identify web technologies. Each technique is implemented as a plugin in WhatWeb's architecture, with over 1800 plugins covering the web technology landscape.

    Signature Matching

    WhatWeb compares HTML content against known patterns for each technology. For example, WordPress generates specific HTML comments like <!-- generator --> and includes wp-content directory references in its source code. WhatWeb's plugins match these signatures to identify the technology.

    HTTP Header Analysis

    WhatWeb examines HTTP response headers like Server, X-Powered-By, and Set-Cookie for technology-specific values. A header like Server: Apache/2.4.41 immediately reveals both the web server and its exact version number.

    URL Pattern Matching

    WhatWeb identifies technologies from URL structures. WordPress uses /wp-admin, /wp-content, and /wp-login.php paths. Joomla uses /components/ and /modules/ paths. These URL patterns are reliable indicators of specific CMS platforms.

    Meta Tag Analysis

    WhatWeb examines meta tags for generator information and framework identifiers. A meta tag like <meta name="generator" content="WordPress 5.8.1"> provides definitive CMS identification with the exact version.

    Cookie Inspection

    WhatWeb checks Set-Cookie headers for technology-specific session names. PHPSESSID indicates PHP, JSESSIONID indicates Java, and wordpress_logged_in indicates WordPress. These cookies provide additional confirmation of detected technologies.

    Installation

    Kali Linux (Pre-installed)

    WhatWeb comes pre-installed on Kali Linux. If you need to reinstall or update:

    sudo apt install whatweb
sudo apt update && sudo apt upgrade whatweb

    Ubuntu / Debian

    sudo apt install whatweb

    macOS

    brew install whatweb

    From Source (All Platforms)

    git clone https://github.com/urbanadventurer/WhatWeb.git
cd WhatWeb
chmod +x whatweb
./whatweb --help

    Verify Installation

    whatweb --version
whatweb --list-plugins | wc -l

    Basic Usage

    Your First Scan

    whatweb example.com

    This performs a passive scan using aggression level 1. It makes minimal HTTP requests and identifies the most obvious technologies on the target website.

    Scan with Verbose Output

    whatweb -v example.com

    Verbose mode shows detailed information about each plugin match, including the detection method used and the specific HTTP headers or HTML patterns that triggered the detection.

    Aggressive Scanning

    whatweb -a 3 example.com

    Aggression level 3 probes deeply into plugins and can extract version numbers from detected technologies. This is the most commonly used level for comprehensive technology detection.

    Save Results to JSON

    whatweb --log-json=results.json example.com

    JSON output provides structured data with full plugin details, HTTP response headers, and detection methods. This format is ideal for automation, programmatic analysis, and integration with security tools.

    Aggression Levels

    WhatWeb has four aggression levels that control how deeply it probes a target:

    | Level | Name | Requests | Use Case |

    |-------|------|----------|----------|

    | 1 | Passive | Minimal | Quick overview, stealthy reconnaissance |

    | 2 | Mild | Few extra | Better version detection |

    | 3 | Aggressive | Many | Comprehensive detection, version extraction |

    | 4 | Heavy | Extensive | Maximum detail, lab environments only |

    Level 1: Passive (Default)

    The default scanning mode makes minimal HTTP requests. It identifies the most obvious technologies but may miss version numbers and less common software. Use this for stealthy initial reconnaissance.

    whatweb -a 1 example.com

    Level 2: Mild

    Makes a few additional HTTP requests to improve detection accuracy. Better version detection than passive mode with moderate network impact. A good balance for most scanning scenarios.

    whatweb -a 2 example.com

    Level 3: Aggressive

    Performs deep probing with many HTTP requests to extract version numbers and detect technologies missed by passive scanning. This is the recommended level for comprehensive technology detection.

    whatweb -a 3 example.com

    Level 4: Heavy

    Maximum aggression with extensive HTTP requests for the deepest possible probing. Use this only in lab environments or when you have explicit permission for active scanning. Most likely to trigger security alerts.

    whatweb -a 4 example.com

    Practical Examples

    Basic Scan

    whatweb http://target.com

    Verbose Aggressive Scan with JSON Output

    whatweb -a 3 --verbose --log-json results.json http://target.com

    Scan Multiple Targets from File

    whatweb -i targets.txt

    Create a text file with one URL per line:

    http://example.com
http://example.org
https://example.net

    Bulk Scan with JSON Output

    whatweb -i urls.txt --log-json=output.json

    CMS Detection

    whatweb -a 3 --color=always http://target.com

    Scan Through Proxy (Burp Suite)

    whatweb --proxy=http://127.0.0.1:8080 http://target.com

    Rate-Limited Scanning

    whatweb --wait=2 http://target.com

    Custom User Agent

    whatweb --user-agent='Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' http://target.com

    List All Available Plugins

    whatweb --list-plugins

    HTML Report Generation

    whatweb --log-html=report.html http://target.com

    Understanding Output

    A typical WhatWeb output line looks like this:

    http://example.com [200 OK] Apache[2.4.41], PHP[7.4.33], WordPress[5.8.1], jQuery[3.6.0]

    Output Format

  • **URL**: The target website URL
  • **HTTP Status**: The HTTP response code (200 OK, 301 Moved, etc.)
  • **Technologies**: Detected technologies with versions in brackets
  • **Colors**: Different technology types are color-coded

    • Color Coding

    | Color | Technology Type |

    |-------|----------------|

    | Green | CMS platforms (WordPress, Joomla, Drupal) |

    | Blue | JavaScript libraries (jQuery, React, Angular) |

    | Yellow | Web servers (Apache, Nginx, IIS) |

    | Red | Embedded devices and other technologies |

    | Cyan | Analytics tools (Google Analytics, Matomo) |

    Verbose Output

    With -v flag, WhatWeb shows the specific detection method:

    http://example.com [200 OK] WordPress[5.8.1] http-generator:WordPress, wp-content[wp-includes/]

    Plugin Management

    List All Plugins

    whatweb --list-plugins

    This displays every available WhatWeb plugin. With over 1800 plugins, the list covers CMS platforms, JavaScript libraries, web servers, analytics tools, and many more.

    Get Plugin Details

    whatweb --info-plugins

    Shows detailed information about each plugin including author, description, and detection methods.

    Use Specific Plugins

    whatweb --use-plugins=WordPress http://target.com

    Focus scanning on specific technology categories for faster, more targeted detection.

    Highlight Specific Plugins

    whatweb --colour-plugins=WordPress http://target.com

    Highlight specific plugins in the output with custom colors for easy identification.

    Output Formats

    JSON Output

    whatweb --log-json=results.json http://target.com

    JSON provides the most complete information including HTTP headers, detection confidence, and plugin metadata. Ideal for automation and integration with security tools.

    XML Output

    whatweb --log-xml=results.xml http://target.com

    XML format integrates with SIEM tools, reporting platforms, and automated security workflows.

    HTML Output

    whatweb --log-html=report.html http://target.com

    Human-readable HTML report for sharing findings with non-technical stakeholders and management.

    SQL Output

    whatweb --log-sql=results.sql http://target.com

    Store results in database format for querying, analysis, and long-term storage.

    Common Mistakes

    Using Only Default Aggression

    Mistake: Running WhatWeb without -a flag uses level 1 (passive), which misses many technologies and version numbers.

    Fix: Use whatweb -a 3 target.com for comprehensive detection with version extraction.

    Not Saving Results

    Mistake: Running WhatWeb without --log-json or --log-xml means all findings exist only in terminal output.

    Fix: Always append --log-json=results.json to save structured output for later analysis.

    Scanning Without Authorization

    Mistake: Scanning websites you don't own is illegal under computer fraud laws in most jurisdictions.

    Fix: Always obtain explicit written authorization before scanning. Use WhatWeb only on systems you own or have permission to test.

    Using Aggressive Mode on Production Sites

    Mistake: Aggressive scanning (-a 3 or -a 4) generates hundreds of HTTP requests per target, triggering WAFs and slowing servers.

    Fix: Use -a 1 or -a 2 on production systems. Reserve -a 3 for lab environments or authorized testing.

    Ignoring False Positives

    Mistake: WhatWeb may occasionally detect technologies incorrectly due to generic patterns in HTML or headers.

    Fix: Verify critical findings manually by visiting the target website. Use verbose mode (-v) to understand why a detection was made.

    Best Practices

  • **Start Passively**: Begin with aggression level 1 for initial reconnaissance, then increase to level 3 for comprehensive detection.
  • **Always Save Output**: Use `--log-json` to save structured results. Create a naming convention: `whatweb-target-date.json`.
  • **Use Proxy Support**: Route traffic through Burp Suite with `--proxy=http://127.0.0.1:8080` for detailed request analysis.
  • **Rate Limit**: Add `--wait=2` or higher between requests when scanning production websites.
  • **Verify Findings**: Always manually verify critical detections before reporting. Use verbose mode to understand detection methods.
  • **Combine with Other Tools**: Use WhatWeb for fingerprinting, then [Nikto](/tools/nikto) for vulnerability scanning and [Gobuster](/tools/gobuster) for directory enumeration.
  • **Respect Authorization**: Only scan systems you own or have written permission to test. Document your authorization.

    • Related Tools

    Nikto

    Web server scanner that tests for vulnerabilities, misconfigurations, and dangerous files. Use after WhatWeb identifies the technology stack. [Learn Nikto](/tools/nikto)

    Gobuster

    Directory and subdomain brute-forcer. Discovers hidden content on web servers identified by WhatWeb. [Learn Gobuster](/tools/gobuster)

    WPScan

    WordPress-specific security scanner. When WhatWeb detects WordPress, WPScan provides deep WordPress-specific vulnerability scanning. [Learn WPScan](/tools/wpscan)

    Wappalyzer

    Browser extension for quick technology checks. Complements WhatWeb's command-line automation. [Wappalyzer Website](https://www.wappalyzer.com)

    BuiltWith

    Web service for business intelligence and technology profiling. [BuiltWith Website](https://builtwith.com)

    Nmap

    Network mapper that discovers web servers for WhatWeb to fingerprint. [Learn Nmap](/tools/nmap)

    Related Articles

  • [Nmap Beginner Tutorial](/learn/nmap-beginner-tutorial)
  • [Nikto Guide](/learn/nikto-guide)
  • [Web Security Fundamentals](/learn/web-security-fundamentals)
  • [HTTP vs HTTPS](/learn/http-vs-https)
  • [Recon Workflow](/learn/recon-workflow)
  • [Ethical Hacking Fundamentals](/learn/ethical-hacking-fundamentals)

    • Summary

    WhatWeb is the industry-standard website fingerprinting tool for identifying web technologies. Its 1800+ plugins, four configurable aggression levels, multiple output formats, and command-line automation make it indispensable for penetration testers, bug bounty hunters, and security auditors. Combined with tools like Nikto, Gobuster, and Nmap, WhatWeb provides the essential technology context that guides every subsequent step of web application security testing.

    Knowledge Check

  • What can WhatWeb detect? (CMS, web servers, JavaScript libraries, analytics tools, and 1800+ other technologies)
  • What does aggression level control? (How deeply WhatWeb probes the target, from passive to heavy)
  • How does WhatWeb identify technologies? (HTTP headers, HTML signatures, URL patterns, meta tags, cookies)
  • Why is fingerprinting important? (Different technologies have different attack surfaces and vulnerabilities)
  • Best output format for automation? (JSON with `--log-json`)
  • What is the recommended aggression level for comprehensive detection? (Level 3)
  • How do you scan multiple URLs? (Use `-i targets.txt` to read from a file)

    • Frequently Asked Questions

    What is WhatWeb?

    WhatWeb is a website fingerprinting tool that identifies technologies used by websites, including CMS platforms, web servers, JavaScript libraries, and analytics tools. It uses over 1800 plugins to detect technologies through HTTP headers, HTML content, and cookies.

    What does the aggression level do in WhatWeb?

    Aggression levels (1-4) control scan intensity. Level 1 (default) is passive with minimal requests. Level 4 makes numerous requests for thorough detection. Higher levels provide more accurate results but are more detectable.

    How do you scan multiple websites with WhatWeb?

    Use `whatweb -i urls.txt` to scan a file containing one URL per line. WhatWeb processes them sequentially, outputting results for each site. Combine with `-o results.json` for bulk analysis.

    What output formats does WhatWeb support?

    WhatWeb outputs JSON (`-o json`), XML (`-o xml`), HTML (`-o html`), SQL (`-o sql`), and grepable formats. JSON is preferred for automation and integration with other security tools.

    What detection techniques does WhatWeb use?

    WhatWeb uses signature matching (HTML patterns), HTTP header analysis, URL pattern matching, meta tag inspection, and cookie detection. Each technique is implemented as a plugin for comprehensive technology identification.

    How does WhatWeb differ from Wappalyzer?

    WhatWeb runs from the command line supporting bulk scans of thousands of sites with structured output. Wappalyzer is a browser extension providing interactive single-site analysis. WhatWeb is better for reconnaissance at scale.

    What is verbose mode in WhatWeb?

    Verbose mode (`-v`) shows detailed plugin information and detection methods for each technology found. This helps understand exactly how WhatWeb identified each technology on the target.

    How do you list all available plugins?

    Run `whatweb --list-plugins` to see all 1800+ plugins. Use `--info-plugin pluginname` to get details about a specific plugin's detection methods and supported versions.