Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite
4

Is there an automated tool that takes a list of hosts and figures out which common web applications (such as Wordpress, Mediawiki, Joomla etc) they are running and - if possible - which version and which plugins are installed?

share|improve this question
Some web application security scanners implement some of this functionality. But not all combinations are identifiable from the client and they need definition files to be used to define what too look for for what version. Also, easier to tell if vulnerable to a particular attack by running that attack. – ewanm89 Sep 17 '11 at 8:31
easier to tell, yes, but not exactly stealthy. Wordpress, for example, includes its version in the generator meta tag in the html header, so that would be quite easy. I was thinking about writing something myself, but am curious whether this hasn't been implemented yet. – Kim Sep 17 '11 at 8:35
Yes, but figuring all the different plugin combinations and creating definitions for those is problematic. – ewanm89 Sep 17 '11 at 16:38

2 Answers

up vote 2 down vote

Try: http://www.morningstarsecurity.com/research/whatweb

WhatWeb identifies websites. Its goal is to answer the question, “What is that Website?”. WhatWeb recognises web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 900 plugins, each to recognise something different. WhatWeb also identifies version numbers, email addresses, account IDs, web framework modules, SQL errors, and more.

share|improve this answer
Only 900 plugins? Nessus can do much the same stuff and has over 40,000 plugins, however it's not limited to web only. – ewanm89 Sep 17 '11 at 16:40
whatweb is designed for and best for fingerprinting - it is not really meant to be compared to nessus. It’s also worth noting that 35,000+ nessus checks are local checks – and the remaining 99% likely have nothing to do with web app fingerprinting. – Tate Hansen Sep 17 '11 at 17:29
I was just pointing out 900 is not a lot of fingerprints for the number of web applications nessus does fingerprinting as well as other checks just as your service does, I said it wasn't dedicated to web applications, but for the last decade they have been fingerprinting web applications as well as direct network services. – ewanm89 Sep 17 '11 at 23:04
up vote 1 down vote

In addition to Whatweb that @tate mentioned, there's a couple of other options that I'm aware of/use

wpscan is targeted at wordpress and can discover version and installed plugins. It also reports potential vulnerabilities in discovered plugins, but from what I can see that's just based on the plugin being installed, not specifically the version being vulnerable.

Nikto is still a good choice, in my opinion, as it's database has been built up over a number of years and it does a decent job at identifying a variety of installed software

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.