Is there an automated tool that takes a list of hosts and figures out which common web applications (such as Wordpress, Mediawiki, Joomla etc) they are running and - if possible - which version and which plugins are installed?

  • Some web application security scanners implement some of this functionality. But not all combinations are identifiable from the client and they need definition files to be used to define what too look for for what version. Also, easier to tell if vulnerable to a particular attack by running that attack. – ewanm89 Sep 17 '11 at 8:31
  • easier to tell, yes, but not exactly stealthy. Wordpress, for example, includes its version in the generator meta tag in the html header, so that would be quite easy. I was thinking about writing something myself, but am curious whether this hasn't been implemented yet. – Kim Sep 17 '11 at 8:35
  • Yes, but figuring all the different plugin combinations and creating definitions for those is problematic. – ewanm89 Sep 17 '11 at 16:38
  • Plugins and definition files have little to do with it. In most cases you can tell from the mark-up what CMS it is. – user81147 May 9 '18 at 10:55

Try: http://www.morningstarsecurity.com/research/whatweb

WhatWeb identifies websites. Its goal is to answer the question, “What is that Website?”. WhatWeb recognises web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 900 plugins, each to recognise something different. WhatWeb also identifies version numbers, email addresses, account IDs, web framework modules, SQL errors, and more.

  • Only 900 plugins? Nessus can do much the same stuff and has over 40,000 plugins, however it's not limited to web only. – ewanm89 Sep 17 '11 at 16:40
  • whatweb is designed for and best for fingerprinting - it is not really meant to be compared to nessus. It’s also worth noting that 35,000+ nessus checks are local checks – and the remaining 99% likely have nothing to do with web app fingerprinting. – Tate Hansen Sep 17 '11 at 17:29
  • I was just pointing out 900 is not a lot of fingerprints for the number of web applications nessus does fingerprinting as well as other checks just as your service does, I said it wasn't dedicated to web applications, but for the last decade they have been fingerprinting web applications as well as direct network services. – ewanm89 Sep 17 '11 at 23:04

In addition to Whatweb that @tate mentioned, there's a couple of other options that I'm aware of/use

wpscan is targeted at wordpress and can discover version and installed plugins. It also reports potential vulnerabilities in discovered plugins, but from what I can see that's just based on the plugin being installed, not specifically the version being vulnerable.

Nikto is still a good choice, in my opinion, as it's database has been built up over a number of years and it does a decent job at identifying a variety of installed software


There are plenty of cloud-based scanning tools and plugins that can help. Here is a list of all the free ones: 1. Qualys 2. Scan My Server 3. Sucuri 4. Web Inspector 5. Acunetix 6. UpGuard 7. Tinfoil

Reference: 7 Free Cloud Application Vulnerability Scanning Tools

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.