4

Is there an automated tool that takes a list of hosts and figures out which common web applications (such as Wordpress, Mediawiki, Joomla etc) they are running and - if possible - which version and which plugins are installed?

Improve this question
4
  • Some web application security scanners implement some of this functionality. But not all combinations are identifiable from the client and they need definition files to be used to define what too look for for what version. Also, easier to tell if vulnerable to a particular attack by running that attack.
    – ewanm89
    Sep 17, 2011 at 8:31
  • easier to tell, yes, but not exactly stealthy. Wordpress, for example, includes its version in the generator meta tag in the html header, so that would be quite easy. I was thinking about writing something myself, but am curious whether this hasn't been implemented yet.
    – Kim
    Sep 17, 2011 at 8:35
  • Yes, but figuring all the different plugin combinations and creating definitions for those is problematic.
    – ewanm89
    Sep 17, 2011 at 16:38
  • Plugins and definition files have little to do with it. In most cases you can tell from the mark-up what CMS it is.
    – user81147
    May 9, 2018 at 10:55

3 Answers 3

Reset to default
3

Try: http://www.morningstarsecurity.com/research/whatweb

WhatWeb identifies websites. Its goal is to answer the question, “What is that Website?”. WhatWeb recognises web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 900 plugins, each to recognise something different. WhatWeb also identifies version numbers, email addresses, account IDs, web framework modules, SQL errors, and more.

Improve this answer
3
  • Only 900 plugins? Nessus can do much the same stuff and has over 40,000 plugins, however it's not limited to web only.
    – ewanm89
    Sep 17, 2011 at 16:40
  • whatweb is designed for and best for fingerprinting - it is not really meant to be compared to nessus. It’s also worth noting that 35,000+ nessus checks are local checks – and the remaining 99% likely have nothing to do with web app fingerprinting.
    – Tate Hansen
    Sep 17, 2011 at 17:29
  • I was just pointing out 900 is not a lot of fingerprints for the number of web applications nessus does fingerprinting as well as other checks just as your service does, I said it wasn't dedicated to web applications, but for the last decade they have been fingerprinting web applications as well as direct network services.
    – ewanm89
    Sep 17, 2011 at 23:04
2

In addition to Whatweb that @tate mentioned, there's a couple of other options that I'm aware of/use

wpscan is targeted at wordpress and can discover version and installed plugins. It also reports potential vulnerabilities in discovered plugins, but from what I can see that's just based on the plugin being installed, not specifically the version being vulnerable.

Nikto is still a good choice, in my opinion, as it's database has been built up over a number of years and it does a decent job at identifying a variety of installed software

Improve this answer
0

There are plenty of cloud-based scanning tools and plugins that can help. Here is a list of all the free ones: 1. Qualys 2. Scan My Server 3. Sucuri 4. Web Inspector 5. Acunetix 6. UpGuard 7. Tinfoil

Reference: 7 Free Cloud Application Vulnerability Scanning Tools

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .