whatweb

No entries match these filters. Clear filters

1. v0.6.4 Apr 2, 2026 · release notes

   WhatWeb v0.6.4 delivers up to 20x faster verbose output with per-logger mutexes and new tuning flags.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.6.4 https://github.com/urbanadventurer/WhatWeb.git
   # already have the repo? check out this version:
   $ git checkout v0.6.4

   └──▷ TRY IT
   Benchmark WhatWeb's output performance on your own hardware after upgrading.
   copy

   $ WHATWEB_PROFILE=1 whatweb --threads 20 -v http://example.com

   • New --output-sync flag gives manual control over output synchronization behavior.
   • New --output-buffer-size flag lets you tune output buffer size for high-thread-count scans.
   • New WHATWEB_PROFILE=1 environment variable enables built-in performance benchmarking.
   • Intelligent output buffering now scales automatically with thread count, unlocking up to 20x faster verbose output.

   4 details in Everything

2. v0.6.3 Oct 18, 2025 · release notes

   WhatWeb v0.6.3 adds cookie jar support, a no-cookies flag, and four new fingerprinting plugins.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.6.3 https://github.com/urbanadventurer/WhatWeb.git
   # already have the repo? check out this version:
   $ git checkout v0.6.3

   └──▷ TRY IT
   Save cookies during a scan to capture session tokens set across redirects — useful for auditing login flows or multi-step authentication pages.
   copy

   $ whatweb --cookie-jar cookies.txt https://target.example.com

   Strip all cookie handling to simulate a stateless client or avoid polluting results with session state on high-volume scans.
   copy

   $ whatweb --no-cookies -i targets.txt --log-brief=results.txt

   • Adds --no-cookies option to disable cookie handling entirely during scans.
   • Adds --cookie-jar option to persist cookies to a file across a scan session.
   • Improves cookie retention across redirects for more accurate multi-hop fingerprinting.
   • New plugin: Cisco Meraki detection.
   • New plugin: GoAnywhere Web Client detection.

   +2 more show less

   • New plugin: Oracle EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. detection.
   • New plugin: Google Tag Manager detection.

   7 details in Everything

3. v0.6.2 Aug 25, 2025 · release notes

   WhatWeb v0.6.2 adds support for scanning .onion Tor hidden services via HTTP proxy.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.6.2 https://github.com/urbanadventurer/WhatWeb.git
   # already have the repo? check out this version:
   $ git checkout v0.6.2

   • Supports scanning .onion (Tor) hidden service domains by bypassing DNS resolution when routing through an HTTP proxy.

   1 detail in Everything

4. v0.6.1 Aug 1, 2025 · release notes

   WhatWeb v0.6.1 adds dual HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. scanning, 9 new detection plugins, 3 new plugin search contexts, and legacy TLS/SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.6.1 https://github.com/urbanadventurer/WhatWeb.git
   # already have the repo? check out this version:
   $ git checkout v0.6.1

   └──▷ USE IT
   Match PHP files by extension inside a WhatWeb plugin using the new uri.extension search context.
   ruby copy

   { :name=>"File extension", :regexp=>/^(php|phtml|php3|php4|php5|phps)$/, :search=>"uri.extension" }

   • Adds dual-protocol scanning: simple hostnames are automatically scanned over both HTTP and HTTPS in a single invocation.
   • Adds comprehensive legacy SSL/TLS support, enabling negotiation of TLSv1, TLSv1.1, TLSv1.2, SSLv3, and SSLv2 for maximum compatibility with older targets.
   • Adds automatic abort after 10 consecutive parsing errors, preventing wasted resources on invalid or malformed input sources.
   • Adds three new plugin search contexts — uri.path, uri.query, and uri.extension — giving plugin authors finer-grained URL matching.
   • Adds 9 new detection plugins: Plex Media Server, Meta-Facebook-Infrastructure, Netflix-Platform, VKontakte-Platform, Distributed-Tracing, Modern-Security-Headers, Baidu-Platform, Alibaba-Aliyun, and Weibo-Platform.

   +5 more show less

   • Enhances CloudFlare plugin with CF-RAY and additional header detection.
   • Enhances Shopify plugin with HTTP header-based detection.
   • Renames CloudFront to Amazon-CloudFront and Microsoft Azure plugin to Microsoft-Azure, with enhanced detection in both.
   • Updates detection for Adobe-Flash, ASP.NET, ColdFusion, Drupal, Java, Perl, PHP, Python, Ruby, TYPO3, WordPress, Tengine, and Content-Security-Policy plugins.
   • Adds Bundler group support and GEMFILE_GROUPS environment variable for managing optional dependencies (mongo, rchardet) across older Bundler versions.

   10 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Ruby 2.0 is no longer supported.
   • !The CloudFront plugin is renamed to Amazon-CloudFront; any scripts or tooling referencing the old plugin name by string will no longer match.
   • !The Azure plugin is renamed to Microsoft-Azure; any scripts or tooling referencing the old plugin name by string will no longer match.
5. v0.5.5 Jan 15, 2021 · release notes

   WhatWeb v0.5.5 adds detection plugins for Apache Flink, FLIR AX8, Huginn, OpenResty, Telerik UI, Umbraco, and VMware Horizon.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.5.5 https://github.com/urbanadventurer/WhatWeb.git
   # already have the repo? check out this version:
   $ git checkout v0.5.5

   • Adds detection of Dell-OpenManage-Switch-Administrator

   1 detail in Everything

6. v0.5.4 Dec 14, 2020 · release notes

   WhatWeb v0.5.4 adds BlockScout, ElasticSearch, and Grafana detection plugins

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.5.4 https://github.com/urbanadventurer/WhatWeb.git
   # already have the repo? check out this version:
   $ git checkout v0.5.4

   • Adds BlockScout plugin to detect BlockScout blockchain explorer instances.
   • Adds ElasticSearch plugin to detect Elasticsearch instances.
   • Adds Grafana plugin to detect Grafana monitoring dashboards.

   3 details in Everything

7. v0.5.3 Oct 2, 2020 · release notes

   WhatWeb v0.5.3 adds detection for 7 new technologies including AEM, Artifactory, Matomo, MobileIron-MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies., Slack Workspace, Wobserver, and Zoom.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.5.3 https://github.com/urbanadventurer/WhatWeb.git
   # already have the repo? check out this version:
   $ git checkout v0.5.3

   • Adds AEM plugin to detect Adobe Experience Manager.
   • Adds Artifactory plugin to detect JFrog Artifactory.
   • Adds Matomo plugin to detect Matomo analytics platform.
   • Adds MobileIron-MDM plugin to detect MobileIron MDM.
   • Adds Slack-Workspace plugin to detect Slack workspaces.

   +2 more show less

   • Adds Wobserver plugin to detect Wobserver technology.
   • Adds Zoom plugin to detect Zoom conferencing software.

   7 details in Everything

8. v0.5.2 Jun 9, 2020 · release notes

   WhatWeb v0.5.2 adds a new plugin to detect the PHP-Slim web framework.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.5.2 https://github.com/urbanadventurer/WhatWeb.git
   # already have the repo? check out this version:
   $ git checkout v0.5.2

9. v0.5.1 Feb 25, 2020 · release notes

   WhatWeb v0.5.1 adds Bootstrap detection plugin and fixes CLI issues

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.5.1 https://github.com/urbanadventurer/WhatWeb.git
   # already have the repo? check out this version:
   $ git checkout v0.5.1

   • Adds a new Bootstrap plugin to detect sites using the Bootstrap framework

   1 detail in Everything

10. v0.5.0 Oct 4, 2019 · release notes

    WhatWeb v0.5.0 adds IDN support, --cookie-jar FILE loading, and a plugin migration tool.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.0 https://github.com/urbanadventurer/WhatWeb.git
    # already have the repo? check out this version:
    $ git checkout v0.5.0

    └──▷ USE IT
    Load session cookies from a local file for authenticated scanning
    shell copy

    whatweb --cookie-jar=/path/to/cookies.txt <target>

    Run the migration script to update existing plugin files to v0.5 format
    shell copy

    ruby plugin-development/migrate-plugins-to-v0.5.rb

    • Adds --cookie-jar=FILE to load cookies from a file in document.cookie format
    • Adds International Domain Name (IDN) support
    • Adds migration tool at plugin-development/migrate-plugins-to-v0.5.rb to convert plugins to the v0.5 format

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Plugin authoring is no longer backwards compatible; private or unreleased plugins must be converted using the new migration tool
11. v0.4.9 Nov 23, 2017 · release notes

    Adds Elastic Search output format and improves logging verbosity

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.9 https://github.com/urbanadventurer/WhatWeb.git
    # already have the repo? check out this version:
    $ git checkout v0.4.9

    └──▷ TRY IT
    Export scan results directly to an Elasticsearch cluster for centralized indexing.
    copy

    $ whatweb --output-elasticsearch http://localhost:9200/target

    • Adds --output-elasticsearch to export scan results to Elasticsearch
    • Adds proxy URL and User-Agent string to log output via -v

    2 details in Everything

12. 0.4.7 Apr 5, 2011 · release notes

    Adds -q quiet flag and mailto->email plugin rename in WhatWeb 0.4.7

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.4.7 https://github.com/urbanadventurer/WhatWeb.git
    # already have the repo? check out this version:
    $ git checkout 0.4.7

    • Added --quiet, -q to not display brief logging to STDOUT.
    • Renamed mailto plugin to email
    • Changed default open and read timeouts to 15 and 30 seconds respectively

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The mailto plugin was renamed to email. References using the old name will fail.
13. 0.4.6 Mar 25, 2011 · release notes

    v0.4.6 adds MongoDB/JSON logging, HTTP auth, custom headers, redirect control, and XML reports to WhatWeb CLI

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.4.6 https://github.com/urbanadventurer/WhatWeb.git
    # already have the repo? check out this version:
    $ git checkout 0.4.6

    └──▷ USE IT
    Log scan results directly to a MongoDB instance for centralized collection aggregation.
    shell copy

    whatweb --log-mongo-database scans --log-mongo-host localhost --log-mongo-collection targets http://example.com

    Scan a site requiring authentication while respecting rate limits to avoid bans.
    shell copy

    whatweb -u 'admin:password' --wait 2 http://example.com/admin

    Suppress noisy console output and send results to JSON for programmatic parsing.
    shell copy

    whatweb -q --log-json http://example.com

    • Adds --wait SECONDS flag to control connection delay; combine with -t 1 for single-threaded pacing.
    • Adds --log-mongo-database, --log-mongo-host, --log-mongo-collection, --log-mongo-username, and --log-mongo-password flags for MongoDB logging output.
    • Adds JSON logging support (requires json ruby gem or Ruby 1.9).
    • Adds MagicTree logging support.
    • Adds XML stylesheet whatweb.xsl for formatting XML reports.

    +7 more show less

    • Adds --quiet and -q flags to suppress Brief Output on stdout.
    • Adds --max-redirects flag to control the maximum number of contiguous redirects followed.
    • Adds redirect control via internal option (values: never, http-only, meta-only, same-site, same-domain, always).
    • Adds -H or --header flags to send custom headers; can specify multiple times (e.g., 'foo:bar').
    • Adds -u and --user flags for HTTP basic authentication support.
    • Adds --debug flag to raise errors found in plugins.
    • Adds nmap-style IP address range support for target specification.

    12 details in Everything

14. 0.4.5 Aug 17, 2010 · release notes

    WhatWeb 0.4.5 adds URL manipulation flags, custom plugins via --custom-plugin, and new plugin system internals.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.4.5 https://github.com/urbanadventurer/WhatWeb.git
    # already have the repo? check out this version:
    $ git checkout 0.4.5

    └──▷ TRY IT
    Scan a list of targets for specific URL patterns without hardcoding them in config.
    copy

    $ whatweb --url-pattern 'example.com/%s%.html' -i target_list.txt

    Define a one-off detection rule for a specific text string on the command line.
    copy

    $ whatweb --custom-plugin "{:text=>'powered by abc'}" -i ./targets

    • Adds --url-prefix, --url-suffix, and --url-pattern flags to control how target URLs are constructed
    • Adds --custom-plugin flag to define detection logic directly on the CLI
    • Adds @md5sum instance variable and :md5 key in matches array for all plugins
    • Adds @tagpattern instance variable and :tagpattern key in matches array for all plugins

    4 details in Everything

15. 0.4.4 Jun 29, 2010 · release notes

    WhatWeb 0.4.4 adds author metadata to plugins and introduces the :certainty config key.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.4.4 https://github.com/urbanadventurer/WhatWeb.git
    # already have the repo? check out this version:
    $ git checkout 0.4.4

    └──▷ TRY IT
    View which developers wrote the detection plugins for a target.
    copy

    $ whatweb -I example.com

    • -I flag displays author names in plugin info output
    • :certainty keyword replaces :probability in plugins, defaulting to 100

    2 details in Everything

16. 0.4.3 May 24, 2010 · release notes

    New CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly. detections, --version, --no-redirect flag, and my-plugins/ folder for custom plugins

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.4.3 https://github.com/urbanadventurer/WhatWeb.git
    # already have the repo? check out this version:
    $ git checkout 0.4.3

    └──▷ USE IT
    Scan a site without following redirect chains to analyze the initial response body
    shell copy

    whatweb --no-redirect http://example.com

    Store custom detection logic in a dedicated directory separate from WhatWeb's core plugins
    shell copy

    mkdir -p ~/my-plugins && echo '# My Plugin' > ~/my-plugins/my_custom.plg

    Capture tool output and version information in a structured XML format for downstream processing
    shell copy

    whatweb --log-xml report.xml http://example.com

    • Adds --no-redirect option to prevent following HTTP 3xx redirects
    • Adds my-plugins/ folder support to keep personal plugins separate from core
    • Adds XML (naive) logging capability
    • Adds new CMS detection plugins: Concrete5, CushyCMS, FrogCMS, ModxCMS, TypoLight, ExpressionEngine
    • Adds @cookie variable to plugins for cookie data extraction

    +1 more show less

    • Adds --version flag for version reporting

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Merged the google analytics GA and Urchin plugins into a single detection path
17. 0.4.2 Apr 30, 2010 · release notes

    Adds header-hash, footer-hash, and div-span-structure plugins for identifying unknown systems

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.4.2 https://github.com/urbanadventurer/WhatWeb.git
    # already have the repo? check out this version:
    $ git checkout 0.4.2

    └──▷ USE IT
    Scan a target to identify unknown systems using content hashing plugins
    shell copy

    whatweb --plugin=header-hash,footer-hash,div-span-structure https://example.com

    • Adds header-hash plugin that creates a hash of the first 500 characters to help identify unknown systems.
    • Adds footer-hash plugin that hashes the last 500 characters if page length exceeds 1000, aiding identification of unknown systems.
    • Adds div-span-structure plugin that generates a signature hash from div and span tag structures.

    3 details in Everything

18. 0.4.1 Apr 28, 2010 · release notes

    WhatWeb 0.4.1 adds SilverStripe, DotNetNuke, HTML5 and PHP error detection plugins plus proxy support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.4.1 https://github.com/urbanadventurer/WhatWeb.git
    # already have the repo? check out this version:
    $ git checkout 0.4.1

    └──▷ TRY IT
    Scan a site through an HTTP proxy to identify frameworks like SilverStripe or HTML5 features.
    copy

    $ whatweb --proxy=http://proxy:8080 http://example.com

    • Added support for detecting SilverStripe applications
    • Added support for detecting DotNetNuke applications
    • Added support for detecting HTML5 pages
    • Added detection for PHP error outputs via the new PHP error plugin
    • Added proxy support for outbound requests

    5 details in Everything

19. 0.4 Mar 13, 2010 · release notes

    v0.4 adds HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. support, new plugins (OpenCMS, Tomcat, php-nuke), and aggressive version detection for FluxBB.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.4 https://github.com/urbanadventurer/WhatWeb.git
    # already have the repo? check out this version:
    $ git checkout 0.4

    • whatweb now supports scanning over HTTPS
    • Added new plugins: php-nuke (passive module recognition), OpenCMS, and TomCat

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Output format changed from single quotes to square brackets for all strings