How do I install the Whatweb skill?

Run npx skillmds@latest add timsonner/whatweb in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Whatweb safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Whatweb?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Whatweb free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Whatweb?

timsonner (@timsonner) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Whatweb by timsonner — Agent Skill

Name: Whatweb
Author: timsonner

File contents

WhatWeb

Purpose

Use this skill when the current phase needs quick technology fingerprinting of a confirmed web surface.

Phase Fit

Primary: Discovery and Reconnaissance
Secondary: Threat Modeling and Test Planning, Vulnerability Analysis

Use When

Need framework, CMS, or middleware hints to prioritize testing.
Need to identify likely admin products or exposed components.
Need to support exploit research with version or product clues.

Avoid When

The target is not a confirmed web service.
Aggressive fingerprinting options would exceed the approved impact level.

Inputs

Confirmed URLs from inventory or httpx
Target-specific exclusions and rate expectations

Procedure

Fingerprint only confirmed web targets.
Record product and framework clues with asset context.
Correlate results with discovery and reporting data.
Hand material product/version leads to searchsploit, wpscan, or manual validation.
Keep unverified version hints clearly labeled.

Command Syntax

Replace sample targets with approved in-scope assets.

# Basic technology fingerprint
whatweb https://portal.contoso.com

# Aggressive detection (all plugins)
whatweb -a 3 https://portal.contoso.com

# Scan a list of URLs with aggressive detection
whatweb -a 3 -i contoso-live.txt --log-json contoso-whatweb.json

# Log to CSV for spreadsheet analysis
whatweb https://portal.contoso.com --log-csv contoso-whatweb.csv

# Follow redirects to final destination
whatweb https://portal.contoso.com --follow-redirect=always

# Brief output for network range
whatweb 10.10.10.0/24 --log-brief contoso-range.txt

Evidence to Capture

Technology stack clues tied to each URL
Product signatures that change testing priority
Version hints requiring follow-up validation

Safety Boundaries

Keep fingerprinting low impact.
Treat signatures and version hints as leads, not final findings.

---name: whatwebdescription: Use for web technology fingerprinting during authorized pentests. Trigger on identifying frameworks, middleware, CMS signatures, version hints, and prioritizing analysis on confirmed web services.license: MIT---# WhatWeb## PurposeUse this skill when the current phase needs quick technology fingerprinting of a confirmed web surface.## Phase Fit- Primary: Discovery and Reconnaissance- Secondary: Threat Modeling and Test Planning, Vulnerability Analysis## Use When- Need framework, CMS, or middleware hints to prioritize testing.- Need to identify likely admin products or exposed components.- Need to support exploit research with version or product clues.## Avoid When- The target is not a confirmed web service.- Aggressive fingerprinting options would exceed the approved impact level.## Inputs- Confirmed URLs from inventory or `httpx`- Target-specific exclusions and rate expectations## Procedure1. Fingerprint only confirmed web targets.2. Record product and framework clues with asset context.3. Correlate results with discovery and reporting data.4. Hand material product/version leads to `searchsploit`, `wpscan`, or manual validation.5. Keep unverified version hints clearly labeled.## Command SyntaxReplace sample targets with approved in-scope assets.```bash# Basic technology fingerprintwhatweb https://portal.contoso.com# Aggressive detection (all plugins)whatweb -a 3 https://portal.contoso.com# Scan a list of URLs with aggressive detectionwhatweb -a 3 -i contoso-live.txt --log-json contoso-whatweb.json# Log to CSV for spreadsheet analysiswhatweb https://portal.contoso.com --log-csv contoso-whatweb.csv# Follow redirects to final destinationwhatweb https://portal.contoso.com --follow-redirect=always# Brief output for network rangewhatweb 10.10.10.0/24 --log-brief contoso-range.txt```## Evidence to Capture- Technology stack clues tied to each URL- Product signatures that change testing priority- Version hints requiring follow-up validation## Safety Boundaries- Keep fingerprinting low impact.- Treat signatures and version hints as leads, not final findings.

Frequently asked questions

Whatweb