Wappalyzer CLI: Complete Guide to Web Technology Fingerprinting and Stack Detection Using Kali Linux

Wappalyzer is a widely known technology-profiling tool, most famous as a browser extension, but also available as a Node.js-based command-line interface and library. It identifies the technology stack of a website — CMS, e-commerce platforms, JavaScript frameworks, analytics/tracking tools, web servers, programming languages, and more — by analyzing HTML source, HTTP headers, cookies, JavaScript globals, and DNS records against a large, regularly updated fingerprint database (technologies.json). The CLI version is commonly installed via npm and is scriptable, making it well suited for automated recon pipelines.

How to Install

Wappalyzer CLI is not bundled by default in Kali but installs cleanly via npm:

sudo apt update
sudo apt install nodejs npm -y
sudo npm install -g wappalyzer

# Verify installation
wappalyzer --help

Alternative — run via npx without global install:

npx wappalyzer https://example.com

Docker-based usage:

docker pull wappalyzer/cli
docker run --rm wappalyzer/cli https://example.com

Syntax

wappalyzer <url> [options]

All Command-Line Options

Option	Description
--pretty	Pretty-print JSON output
--user-agent=<string>	Custom User-Agent string
--timeout=<ms>	Overall request timeout in milliseconds
--delay=<ms>	Delay between requests (for batch mode)
--max-depth=<n>	Max crawl depth for internal links
--max-urls=<n>	Max number of URLs to analyze per site
--max-wait=<ms>	Max time to wait for page load/JS execution
--recursive	Recursively analyze internal links
--probe	Probe common paths (robots.txt, etc.) for extra signals
--proxy=<url>	Route requests through an HTTP/S proxy
--header=<key:value>	Add a custom HTTP header
--cookie=<key=value>	Add a custom cookie
--html	Include raw HTML in the output
--screenshot=<path>	Save a screenshot of the page (requires headless Chromium)
--no-scripts	Disable JavaScript execution during analysis
--no-redirect	Do not follow HTTP redirects
--batch-size=<n>	Number of concurrent site analyses in batch mode
-oJ, --output-json=<file>	Write results to a JSON file
-v, --verbose	Verbose logging

Basic Usage (Expected Output in Bash)

$ wappalyzer https://example.com --pretty

Output:

{
  "urls": {
    "https://example.com/": { "status": 200 }
  },
  "technologies": [
    {
      "name": "Cloudflare",
      "categories": [{ "name": "CDN" }],
      "confidence": 100
    },
    {
      "name": "HSTS",
      "categories": [{ "name": "Security" }],
      "confidence": 100
    }
  ]
}

Practical Examples with Output

Example 1 — Basic scan of a target

$ wappalyzer https://testphp.vulnweb.com --pretty

Output:

{
  "technologies": [
    { "name": "PHP", "version": "5.6.40", "confidence": 100 },
    { "name": "Apache", "version": "2.4.29", "confidence": 100 }
  ]
}

Example 2 — Save results to a JSON file

$ wappalyzer https://example.com -oJ wappalyzer-result.json
$ jq '.technologies[].name' wappalyzer-result.json

Output:

"Cloudflare"
"HSTS"
"HTTP/3"

Example 3 — Custom User-Agent and header

$ wappalyzer https://example.com --user-agent="Mozilla/5.0" --header="X-Test:1"

Output:

{"technologies":[{"name":"Cloudflare","confidence":100}]}

Example 4 — Recursive crawl of internal links

$ wappalyzer https://example.com --recursive --max-depth=2 --max-urls=10

Output:

Analyzing https://example.com/
Analyzing https://example.com/about
Analyzing https://example.com/contact
10 URLs analyzed, 4 technologies detected across site

Example 5 — Scan through Burp Suite proxy

$ wappalyzer https://testphp.vulnweb.com --proxy=http://127.0.0.1:8080

Output:

[+] Routed through proxy 127.0.0.1:8080
{"technologies":[{"name":"PHP","version":"5.6.40"}]}

Example 6 — Batch scanning multiple URLs

$ cat urls.txt | xargs -I{} wappalyzer {} -oJ results-{}.json

Output:

Analyzed https://example.com -> results-https://example.com.json
Analyzed https://test.com -> results-https://test.com.json

Example 7 — Take a screenshot alongside fingerprinting

$ wappalyzer https://example.com --screenshot=example.png --pretty

Output:

Screenshot saved to example.png
{"technologies":[{"name":"Cloudflare","confidence":100}]}

Example 8 — Probe extra paths for hidden fingerprints

$ wappalyzer https://example.com --probe --pretty

Output:

{"technologies":[
  {"name":"Nginx","confidence":100},
  {"name":"WordPress","confidence":80,"version":"6.5"}
]}

Common Use Cases

• Cross-validating technology fingerprints alongside WhatWeb for higher confidence.
• Automated asset inventory during bug bounty recon across large domain lists.
• Detecting outdated JavaScript libraries/CMS versions with known CVEs.
• CI-based technology drift detection (alerting when a production stack changes unexpectedly).
• Feeding structured JSON output into vulnerability-correlation tools (e.g., matching detected versions against CVE databases).

Automation with Bash

#!/bin/bash
# wappalyzer-bulk-scan.sh — fingerprint a domain list and flag outdated CMS versions

DOMAINS_FILE="domains.txt"
OUTDIR="wappalyzer-results"
mkdir -p "$OUTDIR"

while IFS= read -r domain; do
    [ -z "$domain" ] && continue
    echo "[*] Scanning $domain"
    wappalyzer "https://$domain" -oJ "$OUTDIR/${domain}.json" --timeout=15000
done < "$DOMAINS_FILE"

echo "[*] Technologies summary:"
jq -r '.technologies[] | "\(.name) \(.version // "unknown")"' "$OUTDIR"/*.json | sort | uniq -c | sort -rn

Tips and Best Practices

• Use --recursive sparingly on large sites; it can generate significant request volume.
• Combine --probe with a normal scan for higher-confidence CMS/plugin version detection.
• Always output to JSON (-oJ) for downstream automation rather than parsing terminal text.
• Keep the underlying technologies.json fingerprint database updated (npm update -g wappalyzer) for accurate detection of newer frameworks.
• Use --proxy to route scans through Burp/ZAP for correlated manual + automated recon.

Troubleshooting

Issue	Cause	Fix
command not found: wappalyzer	Global npm bin not in PATH	Add $(npm config get prefix)/bin to PATH
Empty technologies array	JS-heavy SPA not fully rendered	Increase --max-wait or ensure headless Chromium is installed
Screenshot fails	Missing Chromium dependency	sudo apt install chromium and retry
Timeout errors on slow sites	Default timeout too low	Increase --timeout value
Old/incorrect version detection	Stale fingerprint database	Update package: sudo npm update -g wappalyzer

References

• Official GitHub (CLI): https://github.com/wappalyzer/wappalyzer
• npm package page: https://www.npmjs.com/package/wappalyzer
• Wappalyzer main site: https://www.wappalyzer.com/