# Whatweb

> Use for web technology fingerprinting during authorized pentests. Trigger on identifying frameworks, middleware, CMS signatures, version hints, and prioritizing analysis on confirmed web services.

- Skill: `timsonner/whatweb` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/whatweb`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/whatweb/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/whatweb

---


# WhatWeb

## Purpose

Use this skill when the current phase needs quick technology fingerprinting of a confirmed web surface.

## Phase Fit

- Primary: Discovery and Reconnaissance
- Secondary: Threat Modeling and Test Planning, Vulnerability Analysis

## Use When

- Need framework, CMS, or middleware hints to prioritize testing.
- Need to identify likely admin products or exposed components.
- Need to support exploit research with version or product clues.

## Avoid When

- The target is not a confirmed web service.
- Aggressive fingerprinting options would exceed the approved impact level.

## Inputs

- Confirmed URLs from inventory or `httpx`
- Target-specific exclusions and rate expectations

## Procedure

1. Fingerprint only confirmed web targets.
2. Record product and framework clues with asset context.
3. Correlate results with discovery and reporting data.
4. Hand material product/version leads to `searchsploit`, `wpscan`, or manual validation.
5. Keep unverified version hints clearly labeled.

## Command Syntax

Replace sample targets with approved in-scope assets.

```bash
# Basic technology fingerprint
whatweb https://portal.contoso.com

# Aggressive detection (all plugins)
whatweb -a 3 https://portal.contoso.com

# Scan a list of URLs with aggressive detection
whatweb -a 3 -i contoso-live.txt --log-json contoso-whatweb.json

# Log to CSV for spreadsheet analysis
whatweb https://portal.contoso.com --log-csv contoso-whatweb.csv

# Follow redirects to final destination
whatweb https://portal.contoso.com --follow-redirect=always

# Brief output for network range
whatweb 10.10.10.0/24 --log-brief contoso-range.txt
```

## Evidence to Capture

- Technology stack clues tied to each URL
- Product signatures that change testing priority
- Version hints requiring follow-up validation

## Safety Boundaries

- Keep fingerprinting low impact.
- Treat signatures and version hints as leads, not final findings.