Wappalyzer

[Sh4d0wHunt3rX]

The number and the accuracy of technologies, even with some detailed version numbers I can see in the wappalyzer chrome extension is really different than what we get in bbot.

For example for this link, wappalyzer shows these in extension

https://flightio.com/_next/static/chunks/1185.7623cc08b888fa76.js

I was wondering if there is any way to get the tech info directly from the browser extension without using API.

Not sure if these are related:
projectdiscovery/httpx#959 (comment)
https://github.com/ethicalhackingplayground/wappalyzer

[TheTechromancer]

Part of the reason is because our wappalyzer signatures are out of date. Right now we're using python-wappalyzer, which is no longer being maintained, and hasn't seen an update in a while. I've been working to update this, but met some resistance:

projectdiscovery/wappalyzergo#70
lissy93/wapalyzer#6

With wappalyzer suddenly going closed-source, there's a lot of chaos. I'd like to bring our wappalyzer signatures fully up-to-date, and also implement a headless browser with the wappalyzer extension (possibly replacing gowitness with playwright). These are tasks that definitely need doing, but right now they're not high priority.

In the meantime you might have better luck using gowitness or nuclei's tech detection.

[Sh4d0wHunt3rX]

Woow, thanks a lot for this great info 🙏

[Sh4d0wHunt3rX]

So, this is new, seems get info from a headless browser:
https://github.com/s0md3v/wappalyzer-next

[TheTechromancer]

With Webcap released, we're back to thinking about technology detection:

• Technology Detection webcap#43

Wappalyzer isn't super reliable in the browser. Nuclei's tech detection is fine but isn't portable to other code. Wappalyzergo is CPU heavy because it uses regex.

Ideally the signatures should be aggregated and converted to YARA rules or something similar, but nobody has time to do that.

@Sh4d0wHunt3rX do you have any tricks for this?

[Sh4d0wHunt3rX]

Hey, unfortunately, my knowledge is low : ( , but maybe these are helpful to look at:

https://github.com/enthec/webappanalyzer
https://github.com/s0md3v/wappalyzer-next