Ultimate WhatWeb Cheat Sheet

A reference guide for the web fingerprinting tool. Identify everything about a website.

Jump To Section

• Basic Syntax
• Aggression Levels
• Scanning Modes
• Output Formats
• Plugin Management
• Advanced Features

1. Basic Syntax

The fundamental structure of a WhatWeb command.

whatweb [options] [target]

Basic Scan

• whatweb example.com : Quick scan
• whatweb https://example.com : Specify protocol
• whatweb 192.168.1.1 : IP address
• whatweb example.com:8080 : Custom port

Multiple Targets

• whatweb example.com test.com : Multiple URLs
• whatweb --input-file=targets.txt : From file
• whatweb 192.168.1.0/24 : CIDR range
• whatweb 192.168.1.1-100 : IP range

2. Aggression Levels

Stealthy Scan (Level 1)

Single HTTP request per target. Minimal footprint.

whatweb -a 1 example.com

Normal Scan (Level 3 - Default)

Balanced scanning. Multiple requests but not aggressive.

whatweb -a 3 example.com

Aggressive Scan (Level 4)

Heavy scanning. More HTTP requests and plugin checks.

whatweb -a 4 example.com

Pro Tip: Aggression Trade-off
Higher aggression levels provide more detailed results but increase detection risk and scan time. Use level 1 for reconnaissance on sensitive targets.

3. Scanning Modes

Verbose Output

Show detailed information about what's being detected.

whatweb -v example.com

Very Verbose

Show even more detail including errors and redirects.

whatweb -vv example.com

Custom User Agent

Mimic different browsers or devices.

whatweb --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64)" example.com

Random User Agent

Use a random UA for each request to avoid detection.

whatweb --user-agent=random example.com

4. Output Formats

WhatWeb supports multiple output formats for different needs.

JSON Output

whatweb --log-json=results.json example.com

XML Output

whatweb --log-xml=results.xml example.com

CSV Output

whatweb --log-csv=results.csv example.com

SQL Output (MySQL)

whatweb --log-sql=results.db example.com

Format Flag	Description
--log-json=FILE	Save results in JSON format
--log-xml=FILE	Save results in XML format
--log-csv=FILE	Save results in CSV format
--log-sql=FILE	Save results in SQL format
--log-verbose=FILE	Save verbose output

5. Plugin Management

List All Plugins

whatweb --list-plugins

Search for Specific Plugins

Find plugins related to WordPress, Joomla, etc.

whatweb --list-plugins | grep -i wordpress

Run Specific Plugin

Run only WordPress-related plugins.

whatweb -p WordPress example.com

Run Plugin Category

Run all CMS detection plugins.

whatweb -p CMS example.com

Plugin Categories:

CMS, JavaScript, SQL, Ecommerce, Blog, Framework, etc. Use --list-plugins to see all available options.

6. Advanced Features

Proxy Support

Route traffic through proxy (Burp Suite, etc.).

whatweb --proxy=http://127.0.0.1:8080 example.com

Custom Headers

Add custom HTTP headers to requests.

whatweb --header="Authorization: Bearer TOKEN123" example.com

Cookie Support

Send cookies with requests for authenticated scanning.

whatweb --cookie="session=abc123; theme=dark" example.com

Timeout Control

Adjust timeout for slow servers.

whatweb --timeout=30 example.com

Parallel Scanning

Use multiple threads for faster scanning.

whatweb --max-threads=10 example.com

Advanced Flag	Description
--proxy=PROXY	Use proxy for scanning
--header=HEADER	Add custom HTTP header
--cookie=COOKIE	Send cookies
--timeout=SECONDS	Request timeout (default 30)
--max-threads=N	Parallel threads (default 25)
--follow-redirect=never	Don't follow redirects

Warning:

Using high thread counts (--max-threads=100) can trigger rate limiting or WAF blocks. Start with default settings and increase gradually.

⇧