Instructor: Welcome back.
Now we are going to discuss a tool called WhatWeb.
This tool is used to gather information
and to scan any website on the internet.
So it is primarily used to scan websites,
since this tool recognizes web technologies,
including web servers,
embedded devices,
JavaScript libraries
and many more things.
They explain it really well on the website page
for this tool.
So we can read right here,
about all of the details that this tool has.
We can notice they have over 1,700 plugins.
Each one of them used to recognize something different.
So they use these plugins
to perform this scan on the website,
and discover what technologies does that website run.
What is important for us is the second paragraph,
since down here it tells us that default level
of aggression called stealthy is the fastest
and requires only one HTTP request of a website.
Now what this simply means is that
this WhatWeb tool has different levels for scanning,
and the default level is the level of aggression
that is called stealthy,
which we can use on any website that we want.
The other levels of scanning are more aggressive,
and should only be performed during penetration tests.
So we should not use the more aggressive scans
on the websites that we do not have permission to scan.
We can however, use the stealthy scan on any website
that we want on the internet.
And don't worry,
we are going to see all of these options in just a second.
For now, it's good that we know what we can or cannot do.
So let's test this tool out in our Kali Linux.
To do it, open up your terminal,
and to check out all of the options we can do with WhatWeb,
you can simply just type whatweb in your terminal,
and press enter.
This will give you a smaller help menu,
with some of the basic features that WhatWeb has.
As we can see, we can specify targets,
which can be anything from URL's,
host names or IP addresses,
here is that aggression level which we specify like this,
there is the aggression level one,
which is stealthy,
and the aggression level three,
which is aggressive.
The default level is level one,
which is good to notice.
So we don't want to change this if we scan a random website
on the internet.
We can also list all of the plugins that it uses,
but we are not currently interested in this.
And we can have also a verbose output.
But these are just some of the options
for the WhatWeb tool.
To get even more available options with WhatWeb,
we can type the command,
whatweb --help
Press Enter,
and this will give us a much larger help menu,
with all of the possible options
that we can use for WhatWeb.
And down here, here is the aggression level.
We can see besides this stealthy,
that we are going to use on random websites,
and besides the aggressive scan,
that you would use in a penetration test,
there is even more aggressive scan called heavy,
and it says right here makes a lot of HTTP requests
per target.
URLs from all plugins are attempted.
So this is basically the deepest scan
that WhatWeb tool can perform on a website.
Up here are also the targets,
so we specify a target first,
and if I go all the way down,
you will notice right here we got some of the examples
of usage of WhatWeb.
So we can see right here
that the most simple example is running
whatweb and then the domain name.
So for the first run, let us go with this one.
We are only going to specify website as an option.
So just type down here whatweb,
and since we are using the aggression level one,
we can scan any website that we want,
so I'm going to go with this one,
and this is just another university website from my country.
Feel free to scan any website that you want,
or you can also go with this one if you'd like.
If I press here Enter,
in just a few seconds,
we should get response for this website.
And here it is,
we already got something, we got two responses,
as we can see by the links, right here.
The command has finished executing,
so let us just go through these results
and see what we got.
It tells us that it most likely performed a redirect
as soon as we tried getting this link.
We can also see that we got the Apache web server,
we even get the version which is 2.4.6,
we got some cookies right here,
which the website uses,
we got from which country it is,
which type of HTTP server it uses.
If I go down here, here is the IP address of this website.
Here's the PHP version that they use,
and the redirect location,
if you remember I told you
that it most likely redirected us to a different page,
here is to where it redirected us.
And once we got redirected we got the response of 200 OK,
and this is just an HTTP response code,
which tells us that we successfully loaded a page.
We got the same Apache version,
the Bootstrap version,
which cookies it uses,
down here we got the country,
and we also managed to extract some of the emails.
As we can see down here,
these are some of the emails from the page
that belong to this domain.
Down here we also see that it uses HTML5,
which HTTP server it has,
which Apache version it has,
once again, which PHP version,
the IP address,
it also uses Jquery, Lightbox
and bunch of other things we can see right here.
But I don't really like how this is outputted.
It is hard to read.
To output this a little bit prettier,
we can use this verbose option that I saw
in the help menu.
Here it is.
And what this verbose option does is
it also includes plugin descriptions.
It'll also tell us for each plugin,
that the WhatWeb tool managed to discover,
it'll tell us what exactly that plugin is.
So let's try it out.
If I type whatweb and then the same website,
but I add -v option at the end and press Enter,
it'll pretty much give us the same result,
just it'll be outputted a whole lot better,
and easier to read.
If I scroll all the way up to the beginning of the command,
remember we got two responses.
Here is the IP address and this is the first request,
or first response which tells us to move,
to the actual website.
So the redirect response,
we get all of this information
that we got previously,
but we also get this section right here
which says Detected Plugins.
And for example, if we didn't know what Apache was,
we could read right here what Apache is.
And down here we get the version
that this website has of the Apache.
We also get for cookies, same thing.
For HTTP server, we can see which operating system,
which Apache server it is,
which PHP version it is,
it tells us right here what PHP is,
for example, if we didn't know,
PHP is a widely-used general-purpose scripting language,
redirect location,
so after this request,
it redirects us to this location,
and down here we get the response 200 for the actual page.
We get once again the country,
the IP address,
and all of the detected plugins,
and we can read through this
and discover what is this website running.
And it is outputted a whole lot better
and easier to read than the previous command.
Okay, good.
So we managed to get the information
as to what a certain website is running,
which technologies it has.
And in the next video,
we're going to deeply go into this tool
and try to perform some of the more aggressive scans
as well as experiment with some of the different options
of WhatWeb as well.