root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat whatweb.md
// web

WhatWeb

21 Jul 2026 · 5 min read
webcheatsheetswhatweb
WhatWeb is a web technology identifier: it sends requests to a site and, from the headers, cookies, HTML and response patterns, infers which CMS, framework, server and libraries it runs. It is the first stop in web recon because in seconds it tells you which stack you are up against.

The key to WhatWeb is the aggression level (-a): in passive mode (-a 1) it makes a single request and only reads what the server offers, while in aggressive mode (-a 3 or -a 4) it fires extra requests to confirm or guess versions. More aggression means better detection, but also more noise and footprint in the target's logs.

1. Beginner level — fingerprinting and batches

WHATWEB cheat sheet — Beginner
CommandWhat it does
whatweb https://<t>Basic fingerprinting
whatweb -v https://<t>Detailed output
whatweb -a 3 https://<t>Aggression level 3
whatweb https://<t>,https://<t2>Multiple targets
whatweb -i hosts.txtTargets from a file
whatweb --log-brief=out.txt https://<t>Saves a brief summary
whatweb --log-json=out.json https://<t>JSON output
whatweb -a 1 https://<t>Passive mode (single request)
whatweb --colour=never https://<t>No colors
whatweb -hShows the help
whatweb --versionShows the version
whatweb -U 'Mozilla/5.0' https://<t>Customizes the User-Agent
whatweb 10.10.10.0/24Scans a network range
whatweb --max-threads 50 -i hosts.txtAdjusts the threads

2. Advanced level — aggression, proxy and outputs

WHATWEB cheat sheet — Advanced
CommandWhat it does
whatweb -a 4 https://<t>Maximum aggression (forces tests)
whatweb --proxy 127.0.0.1:8080 https://<t>Routes through a proxy
whatweb --proxy-user user:pass https://<t>Proxy authentication
whatweb -H 'Cookie: s=x' https://<t>Custom headers
whatweb --user-agent-list uas.txt https://<t>Rotates User-Agents
whatweb --info-plugins Apache https://<t>Info on a specific plugin
whatweb --list-pluginsLists all plugins
whatweb --wait=2 -i hosts.txtDelay between targets
whatweb --log-xml=out.xml https://<t>XML output
whatweb --log-magictree=out https://<t>MagicTree output
whatweb --read-limit 1024 https://<t>Limits the bytes read
whatweb --follow-redirect=never https://<t>Does not follow redirects
whatweb -a 3 10.10.10.0/24 --max-threads 100Aggressive network sweep
whatweb --plugins ./mi_plugin https://<t>Loads custom plugins

3. Details people miss

  • The default aggression level is -a 1 (passive, a single request). If you get no concrete versions, bump it to -a 3; keep -a 4 in reserve because it forces noisy tests and can trigger alerts.
  • To scan network ranges (10.10.10.0/24) raise --max-threads, but bear in mind that too many threads saturate the network and cause false negatives from timeouts.
  • Combine --log-json or --log-xml with lists from -i to process results later with scripts or import them into other tools; plain-text output is hard to parse.
  • Behind a proxy like Burp (--proxy 127.0.0.1:8080) you can review exactly which requests WhatWeb sends and reuse the authenticated session via -H 'Cookie: ...'.
  • WhatWeb identifies what the server declares: headers and banners can be spoofed, so treat its results as leads, not absolute truths, and confirm them manually.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.