Discovery
Map CMS, frameworks, and servers on a URL
Identify CMS, frameworks, analytics, and servers on a website.
overview
What wappalyzer does
Feed wappalyzer a URL to learn the CMS, JavaScript frameworks, analytics packages, and web server behind the page. It matches HTML, headers, cookies, and script tags against a signature set and writes JSON.
Stay on one URL or follow links with --recursive. Bound crawls with --max-depth and --max-urls, space requests with --delay, and use --pretty for readable JSON.
Trickest runs wappalyzer as a managed Discovery node that takes a URL and emits a file plus a results folder. Prefer webanalyze or httpx tech-detect when you need stack tags across a large host list.
use cases
Where wappalyzer fits
Fingerprint a target's stack
Analyse a URL to learn the CMS, framework, analytics, and server behind it before deciding how to test it.
Build a technology inventory
Run wappalyzer across discovered hosts and collect the JSON to map which stacks the estate runs.
Profile a whole site recursively
Enable recursive crawling with a depth and URL cap so the analysis covers more than the landing page.
Route by detected technology
Use the JSON output to send hosts running a known-vulnerable platform into a targeted scanning workflow.
reference
wappalyzer inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | · | URL to be analysed. |
| recursive | BOOLEAN | --recursive | Follow links on pages (crawler). |
| max-depth | STRING | --max-depth | Don't analyse pages more than num levels deep. |
| max-urls | STRING | --max-urls | Exit when num URLs have been analysed. |
| delay | STRING | --delay | Wait for ms milliseconds between requests. |
| pretty | BOOLEAN | --pretty | Pretty-print JSON output. |
| max-wait | STRING | --max-wait | Wait no more than ms milliseconds for page resources to load. |
| user-agent | STRING | --user-agent | Set the user agent string. |
Showing key inputs. wappalyzer exposes 12 inputs in total.
Full flag reference (12 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | · | URL to be analysed |
| debug | BOOLEAN | --debug | Output debug messages |
| delay | STRING | --delay | Wait for ms milliseconds between requests |
| pretty | BOOLEAN | --pretty | Pretty-print JSON output |
| max-urls | STRING | --max-urls | Exit when num URLs have been analysed |
| max-wait | STRING | --max-wait | Wait no more than ms milliseconds for page resources to load |
| max-depth | STRING | --max-depth | Don't analyse pages more than num levels deep |
| recursive | BOOLEAN | --recursive | Follow links on pages (crawler) |
| batch-size | STRING | --batch-size | Process links in batches |
| user-agent | STRING | --user-agent | Set the user agent string |
| html-lines-limit | STRING | --html-max-rows | Limit the number of HTML lines processed |
| html-chars-per-line-limit | STRING | --html-max-cols | Limit the number of HTML characters per line processed |
example
Run wappalyzer
# fingerprint example.com with a shallow recursive crawlwappalyzer https://example.com --recursive --max-depth 2 --max-urls 20 --delay 500 --pretty{ "urls": { "https://example.com/": { "status": 200 } }, "technologies": [ { "name": "Nginx", "categories": ["Web servers"] }, { "name": "React", "categories": ["JavaScript frameworks"] }, { "name": "Google Analytics", "categories": ["Analytics"] }, { "name": "OpenSSL", "categories": ["Security"] } ]}guidance
Choosing wappalyzer
Use wappalyzer to identify what a single site is built with. It is a deep, recursive fingerprinter for one target at a time. For technology detection across a large host list, use webanalyze or httpx tech-detect.
webanalyze
Go port of wappalyzer built for testing huge host lists fast.
whatweb
Plugin-based identifier with adjustable aggression. Broader recon, similar fingerprinting goal.
httpx
Probes liveness and runs Wappalyzer-style tech detection inline at scale.
faq
wappalyzer questions
related
More Discovery tools
apkurlgrep
Extract URLs and endpoints from Android APK files.
cariddi
Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.
crawlergo
Browser-driven crawler that harvests requests for downstream scanners.
dirsearch
Web path scanner.
fallparams
Crawl pages, harvest potential parameters, write a custom wordlist.
feroxbuster
Recursive content discovery with smart defaults and rich response filters.
Run wappalyzer yourself
A URL feeds Wappalyzer, which fingerprints the stack and writes the detected technologies as a queryable output.
Facts on this page come from the live Trickest tool library.