做兼职翻译的网站,建设工程信息网评价起评分,建设网站比较好公司,国外搜索网站排名前言 WhatWeb 是一款用于识别 Web 应用程序和 Web 服务器的开源工具。它可以识别网站使用的编程语言、Web 框架、Web 服务器软件、Web 应用程序等信息#xff0c;从而帮助安全测试人员快速了解目标网站的技术特征#xff0c;发现可能存在的漏洞。 本文将对 WhatWeb 的使用方法…前言 WhatWeb 是一款用于识别 Web 应用程序和 Web 服务器的开源工具。它可以识别网站使用的编程语言、Web 框架、Web 服务器软件、Web 应用程序等信息从而帮助安全测试人员快速了解目标网站的技术特征发现可能存在的漏洞。 本文将对 WhatWeb 的使用方法进行讲解 文章目录 前言正文扫描网站指纹实例 设置扫描强度扫描内网网段批量扫描常用命令编写插件帮助 正文
Kali虚拟机自带whatweb工具不需要安装、直接使用即可。 扫描网站指纹
在终端或命令行中输入 whatweb 命令加上要扫描的网站 URL 或 IP 地址例如whatweb example.comWhatWeb 会自动识别目标网站的相关信息并输出到终端或命令行中。可以使用 -v 参数来显示所有信息例如whatweb -v example.com
实例
whatweb www.alibaba.com回显如下 解释如下
对于 http://www.alibaba.com状态码Status Code301 Moved Permanently国家Country中国CNHTTP 服务器HTTP ServerTengineIP 地址IP59.82.122.231由 Tengine 提供支持Powered By Tengine重定向地址Redirect Locationhttps://www.alibaba.com/Tengine Web 服务器页面标题Title301 Moved Permanently不常见的头部信息Uncommon Headerstiming-allow-origin、eagleid、server-timing对于 https://www.alibaba.com/状态码Status Code200 OKCookiesali_apache_id、cna、ug_se_c国家Country中国CN使用 HTML5 技术HttpOnlyug_se_cIP 地址IP59.82.122.231Open Graph Protocolsite100002227819697, 124207444332529脚本类型application/ldjson、text/javascript严格传输安全性Strict Transport Securitymax-age31536000页面标题TitleAlibaba.com: Manufacturers, Suppliers, Exporters Importers from the worlds largest online B2B marketplace不常见的头部信息Uncommon Headersrender-policy、x-content-type-options、timing-allow-origin、eagleid、server-timingX-Frame-OptionsDENYX-XSS-Protection1; modeblock
加上-v可以显示详细的输出信息
whatweb -v www.alibaba.com设置扫描强度
加上-a可以指定扫描等级WhatWeb有3种扫描级别通过数字1、3、4选择
如
whatweb www.alibaba.com -a 31表示发送1次http请求3表示发送少量http请求4表示发送大量http请求
扫描内网网段
命令行
whatweb --no-errors -t 255 内网网段批量扫描
扫描多个不同网站时将要扫描网站的域名或IP保存到文件如1.txt中再使用-i参数来连接该文件即可如
whatweb -i root/1.txt常用命令
whatweb [URL]扫描指定的 URL输出识别结果。whatweb -v [URL] 以详细模式扫描指定的 URL显示更多信息。whatweb [URL] -a User-Agent指定自定义的用户代理进行扫描。whatweb [URL] -t 10设置超时时间为 10 秒。whatweb [URL] -x /path/to/exclude指定要排除的目录或文件。whatweb [URL] -p 80,443指定要扫描的端口号多个端口使用逗号分隔。whatweb -iL [file.txt]从文件中读取多个 URL 进行扫描。whatweb --colornever禁用彩色输出。
编写插件
whatweb对国内的网站识别并不友好我们可以自己写插件兼容更多国内的网站。
whatweb的官方模板
Plugin.define Plugin-Template doauthor Enter Your Nameversion 0.1description Describe what the plugin identifies. Include the homepage of the software packageexamples %w| include-some.net example-websites.com here.com |\# a comment block here is a good place to make notes for yourself and others \# There are four types of matches: regexp, text, ghdb \# Matches are enclosed in {} brackets and separated by commas matches [{:namea brief description of the match, eg. powered by in footer,:certainty100, # 100 is certain, 75 is probably and 25 is maybe. if omitted, it defaults to 100. :regexp/This page was generated by http://www.genericcms.com\/en\/products\/generic-cms\/Generic CMS\/a/ },{:nametitle,:certainty75,:texttitleGeneric Homepage/title }]end帮助
更多语法在帮助里可以找到使用以下命令以获得帮助
whatweb -hWhatWeb - Next generation web scanner version 0.5.5.
Developed by Andrew Horton (urbanadventurer) and Brendan Coles (bcoles).
Homepage: https://www.morningstarsecurity.com/research/whatwebUsage: whatweb [options] URLsTARGET SELECTION:TARGETs Enter URLs, hostnames, IP addresses, filenames orIP ranges in CIDR, x.x.x-x, or x.x.x.x-x.x.x.xformat.--input-fileFILE, -i Read targets from a file. You can pipehostnames or URLs directly with -i /dev/stdin.TARGET MODIFICATION:--url-prefix Add a prefix to target URLs.--url-suffix Add a suffix to target URLs.--url-pattern Insert the targets into a URL.e.g. example.com/%insert%/robots.txtAGGRESSION:
The aggression level controls the trade-off between speed/stealth and
reliability.--aggression, -aLEVEL Set the aggression level. Default: 1.1. Stealthy Makes one HTTP request per target and alsofollows redirects.3. Aggressive If a level 1 plugin is matched, additionalrequests will be made.4. Heavy Makes a lot of HTTP requests per target. URLsfrom all plugins are attempted.HTTP OPTIONS:--user-agent, -UAGENT Identify as AGENT instead of WhatWeb/0.5.5.--header, -H Add an HTTP header. eg Foo:Bar. Specifying adefault header will replace it. Specifying anempty value, e.g. User-Agent: will remove it.--follow-redirectWHEN Control when to follow redirects. WHEN may benever, http-only, meta-only, same-site,or always. Default: always.--max-redirectsNUM Maximum number of redirects. Default: 10.AUTHENTICATION:--user, -uuser:password HTTP basic authentication.--cookie, -cCOOKIES Use cookies, e.g. namevalue; name2value2.--cookie-jarFILE Read cookies from a file.PROXY:--proxy hostname[:port] Set proxy hostname and port.Default: 8080.--proxy-user username:password Set proxy user and password.PLUGINS:--list-plugins, -l List all plugins.--info-plugins, -I[SEARCH] List all plugins with detailed information.Optionally search with keywords in a commadelimited list.--search-pluginsSTRING Search plugins for a keyword.--plugins, -pLIST Select plugins. LIST is a comma delimited setof selected plugins. Default is all.Each element can be a directory, file or pluginname and can optionally have a modifier, /-.Examples: /tmp/moo.rb,/tmp/foo.rbtitle,md5,./plugins-disabled/./plugins-disabled,-md5-p is a shortcut for -p plugins-disabled.--grep, -gSTRING|REGEXP Search for STRING or a Regular Expression. Showsonly the results that match.Examples: --grep hello--grep /he[l]*o/--custom-pluginDEFINITION Define a custom plugin named Custom-Plugin,Examples: :textpowered by abc:version/powered[ ]?by ab[0-9]/:ghdbintitle:abc \powered by abc\:md58666257030b94d3bdb46e05945f60b42{:textpowered by abc}--dorksPLUGIN List Google dorks for the selected plugin.OUTPUT:--verbose, -v Verbose output includes plugin descriptions.Use twice for debugging.--colour,--colorWHEN control whether colour is used. WHEN may benever, always, or auto.--quiet, -q Do not display brief logging to STDOUT.--no-errors Suppress error messages.LOGGING:--log-briefFILE Log brief, one-line output.--log-verboseFILE Log verbose output.--log-errorsFILE Log errors.--log-xmlFILE Log XML format.--log-jsonFILE Log JSON format.--log-sqlFILE Log SQL INSERT statements.--log-sql-createFILE Create SQL database tables.--log-json-verboseFILE Log JSON Verbose format.--log-magictreeFILE Log MagicTree XML format.--log-objectFILE Log Ruby object inspection format.--log-mongo-database Name of the MongoDB database.--log-mongo-collection Name of the MongoDB collection.Default: whatweb.--log-mongo-host MongoDB hostname or IP address.Default: 0.0.0.0.--log-mongo-username MongoDB username. Default: nil.--log-mongo-password MongoDB password. Default: nil.--log-elastic-index Name of the index to store results. Default: whatweb--log-elastic-host Host:port of the elastic http interface. Default: 127.0.0.1:9200PERFORMANCE STABILITY:--max-threads, -t Number of simultaneous threads. Default: 25.--open-timeout Time in seconds. Default: 15.--read-timeout Time in seconds. Default: 30.--waitSECONDS Wait SECONDS between connections.This is useful when using a single thread.HELP MISCELLANEOUS:--short-help Short usage help.--help, -h Complete usage help.--debug Raise errors in plugins.--version Display version information.EXAMPLE USAGE:
* Scan example.com../whatweb example.com* Scan reddit.com slashdot.org with verbose plugin descriptions../whatweb -v reddit.com slashdot.org* An aggressive scan of wired.com detects the exact version of WordPress../whatweb -a 3 www.wired.com* Scan the local network quickly and suppress errors.whatweb --no-errors 192.168.0.0/24* Scan the local network for https websites.whatweb --no-errors --url-prefix https:// 192.168.0.0/24* Scan for crossdomain policies in the Alexa Top 1000../whatweb -i plugin-development/alexa-top-100.txt \--url-suffix /crossdomain.xml -p crossdomain_xmlTARGET SELECTION: 设置目标选择可以输入URL、主机名、IP地址、文件名或CIDR格式的IP范围。TARGET MODIFICATION: 目标修改选项可以添加URL前缀或后缀也可以将目标插入到URL中的指定位置。AGGRESSION: 设置扫描侵入性级别控制速度、隐蔽性和可靠性之间的平衡。HTTP OPTIONS: 设置HTTP选项如自定义User-Agent、添加HTTP头、控制重定向行为等。AUTHENTICATION: 设置HTTP基本身份验证和cookie。PROXY: 设置代理服务器包括主机名、端口和身份验证信息。PLUGINS: 插件相关选项如列出插件、查看插件信息、搜索插件、选择插件等。OUTPUT: 设置输出选项如详细与简要输出、是否使用颜色、日志记录等。LOGGING: 设置日志记录选项包括日志文件格式和存储位置。PERFORMANCE STABILITY: 设置性能和稳定性选项如线程数、连接超时时间等。HELP MISCELLANEOUS: 帮助和其他杂项选项如显示帮助信息、调试模式、显示版本号等。EXAMPLE USAGE: 示例用法演示了几个常见的命令用法和参数组合。
