OSINT › Module 7 › Lesson 2
Wappalyzer WhatWeb BuiltWith Observatory
Fingerprints are product names in headers and scripts — YOUR site or the loopback toy.
Visual · archive_wappalyzer
Wappalyzer, WhatWeb, BuiltWith, Observatory, securityheaders.com — YOUR URLs. GATE.
Opening
A Server header is not a confession, but it is a sticky note you forgot on the door.
Fingerprinting tools guess stacks from headers, cookies, script paths, and HTML comments. Wappalyzer (https://www.wappalyzer.com/), WhatWeb, and BuiltWith (named here) are that family. Mozilla Observatory (https://observer.mozilla.org/) and securityheaders.com score header hygiene. Cyberlium uses them on a site YOU own or on They are not a license to map a stranger's CMS for a break-in. Original Cyberlium. Never nmap /24, hydra, webcam dorks, or 0.0.0.0 binds. Next: GitHub Search and gitleaks on YOUR Repo.
1. Name the fingerprint family, then shrink the target to YOU
Wappalyzer is a browser extension and catalog. WhatWeb is a CLI fingerprint tool (https://github.com/urbanadventurer/WhatWeb). BuiltWith is a commercial-looking inventory site — name it, use it only on a property YOU own, do not scrape it as a hunting kit. Observatory and securityheaders.com tell you whether YOUR HTTPS headers look like 2014.
curl -I on YOUR site or on SAFE is the honest beginner move: read Server, Location, cookies, CSP. Guessing a stack is not exploiting it. Hydra against a guessed WordPress is still hydra.
Command guide
Name the fingerprint family, then shrink the target to YOU
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
brew install gitleaks # or go install sudo apt install whatweb sudo apt install curl
macOS:
Command — copy this
brew install gitleaks brew install whatweb
Windows:
Command — copy this
choco install gitleaks
Optional command
git clone https://github.com/urbanadventurer/WhatWeb
Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
curl -sS -m 15 -I "https://example.com/" | head -n 20
2. Observatory and securityheaders are report cards, not exploits
Paste a hostname YOU own into Mozilla Observatory or securityheaders.com. Read missing CSP or old HSTS as homework for YOUR ops, not as a vulnerability to sell. If you have no hostname, wait for the loopback toy and curl -I
WhatWeb, if installed from the official repo, may be aimed at YOUR URL only. Missing gem/binary: bookmark and skip. Do not download a “whatweb plus exploit pack.”
Command guide
Observatory and securityheaders are report cards, not exploits
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install whatweb
macOS:
Command — copy this
brew install whatweb
Windows:
Optional command
git clone https://github.com/urbanadventurer/WhatWeb
3. Wrong vs right on a shared café
Wrong: fingerprint every host in 192.168.0.0/24. Wrong: BuiltWith a competitor because you are angry. Right: curl -I YOUR site, note Server, fix YOUR headers later.
4. What you ship: named fingerprint tools plus curl -I literacy
Wappalyzer, WhatWeb, BuiltWith, Observatory, securityheaders.com named. curl -I literacy saved. YOUR site or skip. chmod 600. No /24.
5. What you record before the next lesson
Date. Fingerprints = YOUR URLs. DEMO GATE. SAFE File t12-m07-l02-fingerprints.txt.
6. Wrong vs right: strangers vs identifiers YOU own
Worked failure — same OSINT word, opposite target. Right never needs a classmate or a dump site.
Wrong
WhatWeb the café. BuiltWith a hospital. hydra because Server said nginx.
Right
Official tools on YOUR property or loopback. Next: GitHub Search and gitleaks on YOUR Repo.
Mission: read headers YOU published
1) / STOP if router. 2) Bookmark Wappalyzer, WhatWeb, BuiltWith, Observatory, securityheaders.com. 3) curl -I YOUR site or note skip until the loopback lab. Never scan the LAN. Never hydra a guessed CMS.
Stuck? Ask Cyberlium AI Mentor
If Observatory rejects loopback, that is expected — use it on a public hostname YOU own, or skip.
Knowledge Check
APPLY: Mozilla Observatory is for:
Multiple choice
Knowledge Check
APPLY: True or False: BuiltWith is named in Cyberlium as a property-inventory site you may freely scrape against strangers.
True or False
Knowledge Check
APPLY: curl -I shows Server: nginx on YOUR site. You:
Multiple choice