PAGES
← all tools
◆ Reconnaissance & OSINT

wig

0.6 open-source

Web application information gatherer that fingerprints CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly. versions, platforms, and OS by analyzing known file checksums and HTTP headers.

Summary

wig is an open-source command-line tool that fingerprints the content management system, platform, and operating system behind a web application by matching checksums of known files against a bundled database and reading server response headers. It is free to use, written in Python 3, and run directly against a target URL or a file of URLs, making it a fit for penetration testers and recon-focused security researchers profiling a site before deeper testing. Options let a user throttle threads, skip subdomain enumeration, or export results to JSON for further processing.

Web application information gatherer that fingerprints CMS versions, platforms, and OS by analyzing known file checksums and HTTP headers.

How wig helps

Which content management system is actually running behind this URL?

matches checksums of known files against a bundled database and scores each candidate CMS by weight and hit count, then reports the most probable version

Which operating system is this server likely running?

reads the server and x-powered-by response headers and compares them against a database of known header values to guess Windows versions or Linux distributions

Is the CMS hiding in a non-standard location on this site?

fetches all static resources encountered during the scan and tests every fingerprint against every fetched URL instead of only the default paths

Can I check a whole list of sites without babysitting each scan?

accepts a file of URLs and runs the same fingerprinting pass across all of them, throttled by a configurable number of threads

Am I only getting the surface-level guess, or the full picture?

by default it stops after identifying the CMS and its version to limit traffic, but switching to test all known fingerprints surfaces every other platform or application it can match

How do I get these results into another tool in my recon pipeline?

writes the detected CMS, version, and OS findings out to a file as JSON for downstream processing

all 11 features, with the evidence for each →

Languages

Not documented

Features

11 capabilities · 6 backed by code, an API document or a real run

Built from wig's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • wig covers 2 of the 13 network discovery and scanning capabilities we track.

What wig offers you

  • Command-line interface3
  • JSON data export1
All capabilities 11 capabilities
URL target input verified suggested Accepts a target URL to scan directly on the command line. 3 releases · 2 other sources · first seen Jul 2014

Suggested capability: Attack surface inventory. This is our guess, not confirmed.

Also counts toward: Command-line interface

release

  • Adds detection for interesting files such as admin pages and readmes. 0.3 · Sep 2014 · source · release history
  • Adds detection for ZenPhoto, Django, Prestashop, phpPgAdmin, and RoundCube Webmail CMS platforms 0.2 · Jul 2014 · source · release history
  • Improves detection accuracy for Debian OS via updated OS database structure 0.2 · Jul 2014 · source · release history

command line

example

  • Basic scan of a target URL python3 wig.py example.com
Site information extraction shipped Extracts metadata such as page title, IP address, and cookies from target sites. 2 releases · 1 other source · first seen Mar 2015

Shared capability: Attack surface inventory

release

  • Enables usage of wig as a library (importable module) 0.6 · Mar 2016 · source · release history
  • Adds site_info feature to extract title, IP address, and cookies from target sites 0.5 · Mar 2015 · source · release history

docs

  • Web application information gatherer that fingerprints CMS versions, platforms, and OS by analyzing known file checksums and HTTP headers.
Vulnerability lookup shipped Checks discovered services against known vulnerabilities to identify potential security issues. 3 releases · first seen Mar 2015

release

  • Adds detection capability for ColdFusion 0.6 · Mar 2016 · source · release history
  • Adds detection capability for initial Magento version 0.6 · Mar 2016 · source · release history
  • Adds vulnerability_lookup capability to check discovered services against known vulnerabilities 0.5 · Mar 2015 · source · release history
Multi-threaded scanning verified Runs scans using a configurable number of threads to control concurrency. 1 release · 1 other source · first seen Mar 2015

Also counts toward: Command-line interface

release

command line

Non-interactive mode verified Suppresses prompts for user input so the tool can run unattended. 2 other sources · first seen Jul 2014

command line

example

  • Run the tool in desperate mode to perform a simple resource crawl for targets with limited initial access. wig --target example.com --desperate-mode 0.2 · Jul 2014 · source
Subdomain discovery verified Searches for subdomains of the target during a scan, with an option to disable this behaviour. 1 release · 1 other source · first seen Mar 2016

Shared capability: Subdomain enumeration

release

  • Adds -d flag to disable the default sub domain search functionality 0.6 · Mar 2016 · source · release history

command line

Results export verified Writes scan results to a file in JSON format. 1 release · 1 other source · first seen Sep 2014

Also counts toward: JSON data export

release

  • Adds detection for popular JavaScript libraries to the scan output. 0.3 · Sep 2014 · source · release history

command line

Directory Listing Detection shipped suggested Detects when directory listings are enabled on the target server. 1 release · first seen Mar 2016

Suggested capability: Attack surface inventory. This is our guess, not confirmed.

release

Platform Anomaly Reporting shipped Identifies discrepancies between detected platforms and lists separate URLs for each detection. 1 release · first seen Mar 2016

release

  • Adds platform anomaly detection listing separate URLs for detected platforms 0.6 · Mar 2016 · source · release history
Bulk URL input verified suggested Reads a list of URLs from a file, one per line, as scan targets. 1 other source · first seen Mar 2015

Suggested capability: Attack surface inventory. This is our guess, not confirmed.

Also counts toward: Command-line interface

command line

Proxy support shipped Routes scan traffic through a proxy server for anonymization or network configuration requirements. 1 release · first seen Mar 2015

release

  • Adds proxy support for routing traffic through a proxy server 0.5 · Mar 2015 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for wig, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail wig puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

4 entries

  1. March 20161
  2. March 20151
  3. September 20141
  4. July 20141

    4 entries

    Project health

    Issue, contributor and maintainer activity in jekyc/wig, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors not measured distinct committers, last 12 months
    2. Maintainers not measured core set, last 12 months
    3. Bus factor not measured committers behind half the commits
    4. Community-filed not measured of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog 10 of 26 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 10
    3. Contributors / month not measured
    4. Commits / month not measured
    5. Stars 553
    Issue themes, last 12 months not measured

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →