lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 25 May 2010 00:49:54 +1200
From: Andrew Horton <>
Subject: WhatWeb version 0.4.3 released

I've just released a new version of WhatWeb with new features and plugins.

You can read more and download it from

Identify content management systems (CMS), blogging platforms, stats/analytics packages, javascript
libraries, servers and more. When you visit a website in your browser the transaction includes many
unseen hints about how the webserver is set up and what software is delivering the webpage. Some of
these hints are obvious, eg. "Powered by XYZ" and others are more subtle. WhatWeb recognises these
hints and reports what it finds.

WhatWeb has over 90 plugins and needs community support to develop more. Plugins can identify
systems with obvious identifying hints removed by also looking for subtle clues. For example, a
WordPress site might remove the tag <meta name="generator" content="WordPress 2.6.5"> but the
WordPress plugin also looks for "wp-content" which is less easy to disguise. Plugins are flexible
and can return any datatype, for example plugins can return version numbers, email addresses,
account ID's and more.

There are both passive and aggressive plugins, passive plugins use information on the page, in
cookies and in the URL to identify the system. A passive request is as light weight as a simple GET
/ HTTP/1.1 request. Aggressive plugins guess URLs and request more files. Plugins are easy to write,
you don't need to know ruby to make them.

Version 0.4.3 Released May 24th 2010

* Added GPLv2 notices
* Added Makefile (Thanks Michal Ambroz <rebus AT>)
* Added man pages (Thanks Michal Ambroz <rebus AT>)
* Added --version
* Added Invalid command line argument handling
* Added @cookie variable to plugins but is not availble for recursive use
* Changed output colour of page titles
* Changed plugin names to use a CamelCase convention
* Merged the google analytics GA and Urchin plugins
* Modified MovableType plugin
* Added Cookie names plugin
* Added Concrete5 CMS plugin
* Added CushyCMS plugin
* Added FrogCMS plugin
* Added ModxCMS plugin
* Added TypoLight plugin
* Added ExpressionEngine plugin
* Fixed a bug in Tomcat plugin
* New feature, my-plugins/ folder. Keep your personal plugins separate.
* Usage info shows correct defaults
* Fixed a bug where aggressive plugins didn't use the proxy settings
* Added XML (naive) logging
* Updated usage to show how to pipe HTML to /dev/stdin
* Added --no-redirect option. Do not follow HTTP 3xx redirects



Andrew Horton

MorningStar Security
Mobile +64 (0) 272 646 959

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Powered by blists - more mailing lists