PAGES
← all tools
◆ Reconnaissance & OSINT

webanalyze

v0.4.5 open-source

webanalyze is a Go port of Wappalyzer that detects web technologies across large host lists with high performance.

source ↗ rss ↗ What is a cyber toolchain? last repo push Aug 28, 2026

Summary

webanalyze is an open-source command-line tool that fingerprints the web technologies behind a host, identifying things like CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly. platforms, JavaScript libraries, CDNs, and web servers at scale. It is a Go port of Wappalyzer, built to stay performant across large lists of hosts rather than single lookups, and it pulls its technology definitions from the enthec fork since Wappalyzer closed public access to its own. It can crawl a set number of links from a root page, search subdomains on the same base domain, send custom headers for scans behind auth tokens, and output to stdout, CSV, or JSON, with a library mode available for embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. in other Go tools. This puts it in the reconnaissance toolkit for people mapping attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. or auditing their own stack across many hosts at once. With 17 contributors since 2015 and a release just 14 days ago, though only 2 commits in the past year, it reads as stable and lightly maintained rather than actively evolving.

webanalyze is a Go port of Wappalyzer that detects web technologies across large host lists with high performance.

How webanalyze helps

Which technologies are running behind each of the hosts on this list?

fingerprints every host by matching response content against the technologies.json signature set and prints the CMS, JS libraries, servers, and CDNs found per URL, with version numbers where the signature captures one

Which of my subdomains are running an outdated or risky stack?

walks every URL sharing a base domain alongside the root host and reports findings per-subdomain, so a forgotten install on a sibling host still turns up

Are the pages linked from the homepage running different technology than the homepage itself?

follows links a set number of hops from the root page and reports each crawled URL separately, so a stack change on a deeper page isn't hidden behind the front page's result

Can I scan a host that only serves content to authenticated or token-bearing requests?

sends a custom header on every probe, letting the scan present an auth token or user-agent the target requires before it returns fingerprintable content

How do I get scan results into something I can feed to another tool or spreadsheet?

writes findings as CSV or JSON instead of the default stdout listing, one row or record per host

Is the technology fingerprint database I'm scanning with current?

fetches a fresh technologies.json from the enthec fork on request, replacing the local copy used for matching

all 3 features, with the evidence for each →

Languages

Not documented

Features

3 capabilities · 1 backed by code, an API document or a real run

Built from webanalyze's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • webanalyze covers 1 of the 13 network discovery and scanning capabilities we track.

What webanalyze offers you

  • Command-line interface2
All capabilities 3 capabilities
Concurrent scanning verified Scans multiple targets or pages in parallel to improve throughput. 2 releases · 1 other source · first seen Sep 2020

Also counts toward: Command-line interface

release

  • Allows the apps.json (now technologies.json) data source to be injected via io.Reader interface instead of requiring an os.File path, enabling in-memory or streamed technology definitions v0.3.2 · Sep 2020 · source · release history
  • Adds -silent flag to suppress the startup header output for cleaner scripting integration v0.3.2 · Sep 2020 · source · release history

command line

Web technology fingerprinting shipped Identifies technologies used by web servers across large lists of hosts. 1 release · 1 other source · first seen Aug 2026

Shared capability: Attack surface inventory

Also counts toward: Command-line interface

release

  • Adds --headers flag to allow setting custom HTTP headers during target probing v0.4.5 · Aug 2026 · source · release history

docs

  • Go port of Wappalyzer that fingerprints web technologies across large lists of hosts.
Definition management shipped suggested Updates the technology signature database used for fingerprinting. 1 release · 1 other source · first seen Sep 2020

Suggested capability: Service and version detection. This is our guess, not confirmed.

release

  • The upstream configuration file has been renamed from apps.json to technologies.json; existing local references must be updated. v0.3.2 · Sep 2020 · source · release history

example

  • Update technology definitions file webanalyze -update

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for webanalyze, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail webanalyze puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

2 entries

  1. August 20261
  3. September 20201
    Show

    2 entries

    1. v0.4.5 Aug 28, 2026 · issue 058

      webanalyze v0.4.5 adds -header flag for injecting custom HTTP request headers during fingerprinting scans.

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.4.5 https://github.com/rverton/webanalyze.git
# already have the repo? check out this version:
$ git checkout v0.4.5
      └──▷ TRY IT
      Scan a host behind bearer-token authentication by injecting an Authorization header on every request.
      $ webanalyze -host internal.example.com -crawl 2 -header 'Authorization: Bearer eyJhbGc...' -header 'X-Custom-Header: value' -output json
    2. v0.3.2 Sep 29, 2020 · release notes

      webanalyze v0.3.2 adds configurable HTTP client via io.Reader and a new -silent flag

      └──▷ GET THIS VERSION 
      $ git clone --branch v0.3.2 https://github.com/rverton/webanalyze.git
# already have the repo? check out this version:
$ git checkout v0.3.2
      • Allows the apps.json (now technologies.json) data source to be injected via io.Reader interface instead of requiring an os.File path, enabling in-memory or streamed technology definitions
      • Adds -silent flag to suppress the startup header output for cleaner scripting integration

      2 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !The upstream configuration file has been renamed from apps.json to technologies.json; existing local references must be updated.

    Project health

    Issue, contributor and maintainer activity in rverton/webanalyze, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 2 +2 vs prior 12 months
    2. Maintainers 1 +1 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 4.9 years first maintainer reply 45 days
    6. Open backlog 4 of 56 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 4
    3. Contributors / month 2
    4. Commits / month 2
    5. Stars 1,177
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback