WebApp Information Gatherer – WIG

Footprinting and information gathering, the first and most
important step of penetration testing. To become a successful ethical hacker
you need to implement every step and process of pentesting, not only implement but
to implement it efficiently. If we talk about web application penetration testing then it is very important to identify the software running behind a
target website, most of the websites are now based on CMS (content management
system) so we need to identify the name and version of the CMS.

These information are very helpful to identify the
vulnerabilities on a website, imagine if you know the software name with its
version then you can find the exploits available on Internet (how easy is to
hack into a website). But CMS identification requires some time and effort,
this is why developers have created automatic tools to do the job.

You might have heard about whatweb and blindelephant, yes
these tools are used to identify the CMS running on a website; whether it is
wordpress, Joomla and any other. Now at this stage I would like to share
another tool called WIG.

WebApp Information Gatherer

wig identifies a websites CMS by searching for
fingerprints of static files and extracting version numbers from known files.
OS identification is done by using the value of
the ‘server’ and ‘X-Powered-By’ in the response header. These values are
compared to a database of which package versions are include with different
operating systems.
There are currently three profiles:
1. Only send one request: wig only sends a request for ‘/’. All
fingerprints matching this url are tested.
2. Only send one request per plugin: The url used in most fingerprints is used
4. All fingerprints: All fingerprints are tested
Example of

# python3 wig.py www.example.com
Drupal CMS: [7.25, 7.24, 7.26, 7.23, 7.22]
Operating System    
Microsoft Windows Server: [2008 R2]
Server Info         
Microsoft-IIS: [7.5, 6.0]
Time: 18.0 sec | Plugins: 65 | Urls: 324 | Fingerprints: 14178

Ehacking Staff
With more than 50 global partners, we are proud to count the world’s leading cybersecurity training provider. EH Academy is the brainchild of Ehacking, which has been involved in the field of training since the past Five years and continues to help in creating professional IT experts.

Most Popular

What Makes ICS/OT Infrastructure Vulnerable?

Infrastructure security for operational technologies (OT) and industrial control systems (ICS) varies from IT security in several ways, with the inverse confidentiality, integrity, and...

Everything You Must Know About IT/OT Convergence

What is an Operational Technology (OT)? Operational technology (OT) is a technology that primarily monitors and controls physical operations. It can automate and control machines,...

Understand the OT Security and Its Importance

This article discusses OT security and why it is essential for protecting industrial systems from cyberattacks. We will also discuss common control objectives that can...

What is Deepfake, and how does it Affect Cybersecurity?

Producing deepfake is easy. It is hard to detect. They operate with a description of reality rather than reality itself (e.g., a video). Any...