WhatWeb
WhatWeb is a free web scanner used to identify technologies, frameworks, and plugins on websites for recon and application security practitioners.
0 upvotes · 0 downvotes
No ratings yet
- Pricing
- Free
- Platforms
- LinuxWindowsmacOS
- License
- Open source
- Reviewed
- Last reviewed 25 October 2026
What it is
A Ruby-based scanner with hundreds of plugins that fingerprint CMS platforms, JavaScript libraries, HTTP headers, and other site details. It supports passive and aggressive modes and several report formats.
What it helps with
- Fingerprinting CMS and framework versions on a target site
- Gathering header and plugin clues during recon
- Running aggressive checks when authorized to probe deeper
- Exporting results as JSON, XML, or other formats
Who it's for
Recon analysts and AppSec testers gathering technology details on targets they are allowed to assess.
Worth knowing
Aggressive mode sends more requests and can look like an attack, so keep it inside authorized scopes. The latest release is from April 2026.
How is it different from wafw00f?
wafw00f focuses on WAF fingerprinting, while WhatWeb identifies a broader set of web technologies.
What pairs well with it?
In our view Amass helps find related hosts, and Nuclei can test the stacks WhatWeb identifies.
Discussion & reviews
0 comments
No contributions yet. Be the first to review or comment.