Purpose
Use this skill when the current phase needs quick technology fingerprinting of a confirmed web surface.
Phase Fit
- Primary: Discovery and Reconnaissance
- Secondary: Threat Modeling and Test Planning, Vulnerability Analysis
Use When
- Need framework, CMS, or middleware hints to prioritize testing.
- Need to identify likely admin products or exposed components.
- Need to support exploit research with version or product clues.
Avoid When
- The target is not a confirmed web service.
- Aggressive fingerprinting options would exceed the approved impact level.
Inputs
- Confirmed URLs from inventory or
httpx - Target-specific exclusions and rate expectations
Procedure
- Fingerprint only confirmed web targets.
- Record product and framework clues with asset context.
- Correlate results with discovery and reporting data.
- Hand material product/version leads to
searchsploit,wpscan, or manual validation. - Keep unverified version hints clearly labeled.
Command Syntax
Replace sample targets with approved in-scope assets.
# Basic technology fingerprint
whatweb https://portal.contoso.com
# Aggressive detection (all plugins)
whatweb -a 3 https://portal.contoso.com
# Scan a list of URLs with aggressive detection
whatweb -a 3 -i contoso-live.txt --log-json contoso-whatweb.json
# Log to CSV for spreadsheet analysis
whatweb https://portal.contoso.com --log-csv contoso-whatweb.csv
# Follow redirects to final destination
whatweb https://portal.contoso.com --follow-redirect=always
# Brief output for network range
whatweb 10.10.10.0/24 --log-brief contoso-range.txt
Evidence to Capture
- Technology stack clues tied to each URL
- Product signatures that change testing priority
- Version hints requiring follow-up validation
Safety Boundaries
- Keep fingerprinting low impact.
- Treat signatures and version hints as leads, not final findings.