/CHANGELOG

  1Version 0.4.8-dev Unreleased
  2* Added support for Ruby 1.9.1
  3* Added over 700 new plugins
  4* Added aggressive version detection using md5 static file matches to several plugins
  5* Added support for raw HTTP headers when scanning local files
  6* Added --dorks <plugin name> to return google dorks for the selected plugin
  7* Added google dorks to more than 500 plugins
  8* Added ./addons/hunter
  9* Added ./addons/gggooglescan
 10* Added ./addons/country-scanner
 11* Added SQL logging with `--log-sql` and `--log-sql-create` arguments. These are not listed in the usage.
 12* Added raw header support by monkey patching the net/http library
 13* Added context searching for plugin matches[]. Added the matches keyword, :search. Values can be "headers","headers[server]"(or any other HTTP header),"body"(default), "all" (the raw headers + body)
 14* Added methods for aggressive plugins to send HEAD and POST requests
 15* Added --grep, -g option to be easier than --custom-plugin. (Requested by Scott Bell)
 16* Removed the spidering feature and dependence on the customised and unsupported Anemone gem
 17* Removed the extra_urls feature
 18* Removed dependency on em-resolv-replace
 19* Updated whatweb.xsl
 20* Fixed a bug causing Mongo DB logging to fail
 21* Fixed a bug causing brief logging to not escape special characters
 22* Fixed meta refresh redirection but with HTML entities in the URL
 23* Redesigned and refactored much of Whatweb's code. Introduced the Target class
 24* Targets from input files are now executed ascending order
 25* Better support for UTF-8 encoded strings in plugins.
 26* :status and :url are now logical AND with other matches. They cannot match in isolation unless with each other.
 27* Updated Country plugin. Fixed IPv6 bug
 28* Changed version from 0.4.8 to 0.4.8-dev to show development version
 29* Plugin brief output is now sorted alphabetically by plugin name
 30
 31Version 0.4.7 Released April 5th 2011
 32* Performance enhancements & bug fixes
 33* Added -p + as a shortcut for -p +plugins-disabled
 34* Added --quiet, -q - to not display brief logging to STDOUT
 35* Fix Makefile - you can now install whatweb over an old version
 36* Removed certainty from Mongo and JSON output unless certainty < 100
 37* Removed certainty info from verbose output unless certainty <100
 38* Bugfixes for error reporting
 39* Updated some error messages
 40* Changed default open and read timeouts to 15 and 30 seconds respectively
 41* Updated slow plugins
 42* Added plugins: TVersity, Ultimate-Bulletin-Board, 
 43* Moved plugins to plugins-disabled: atom_feed, meta-city, meta-contact, meta-country, meta-geography, meta-state, meta-zipcode and script
 44* Renamed mailto plugin to email
 45
 46Version 0.4.6 Released March 25th 2011
 47* Updated ~230 plugins
 48* Added ~600 new plugins
 49* Added Escenic CMS plugin from Erik Inge Bolsø
 50* Added EscenicEngine5 plugin by nikosk
 51* Added barracuda-load-balancer, binarysec-firewall, citrix-netscaler, cloudflare, evercookie, juniper-netscreen-secure-access, juniper-load-balancer, profense-firewall, vTigerCRM, watchguard-firewall, www-authenticate plugins by Aung Khant
 52* Moved some plugins into disabled-plugins, as they clutter output. adobe_flash.rb, footer-hash.rb, frame.rb, header-hash.rb, md5.rb, script.rb, shortcut-icon.rb, tagpattern-hash.rb
 53* Renamed disabled-plugins/ to plugins-disabled/
 54* Changed $ANEMONE_SKIP_REGEX=Regexp.union line to be compatible with Ruby 1.8.6. Thanks to Michal Ambroz
 55* Added plugin reporting support for  :model=>, :firmware=>, :module=>
 56* Added --wait SECONDS between connections. Combine with -t 1 if preferred.
 57* Added meta-refresh redirect support. eg. <meta http-equiv="refresh" content="0;url=../default/mail/index.html">. Only for non-spidering
 58* Added {:version=>/regexp/, :offset} to remove cargo cult programming. eg.
 59{:version=>/<meta name="Generator" (content|CONTENT)="(ASPNUKE|ASP-Nuke) ([^->"]+)/, :offset=>2,  :name=>"meta generator tag" }
 60* Replaced :probability with :certainty in my-plugins/plugin-template.rb.txt. Thanks Erik Inge Bolsø
 61* Added support for em-resolv-replace which speeds up whatweb many times. http://github.com/mperham/em-resolv-replace
 62* Added XML stylesheet "whatweb.xsl" for XML reports
 63* Added reporting of version detection with matches to the Plugin Info, eg. whatweb -I
 64* Changed whatweb -I behaviour to search plugins for keywords. eg. './whatweb -I nuke' brings up ASP-Nuke, PHPNuke, DotNetNuke, etc.
 65* Bugfix: Changed webpage data for when working with files, not URIs. Now it passes empty hashes, etc instead of nil which caused plugins to report errors.
 66* Added MongoDB logging. Use with --log-mongo-database, --log-mongo-host, --log-mongo-collection, --log-mongo-username, --log-mongo-password. Only database has no default.
 67* Added JSON logging. Must have the json ruby gem installed or be using Ruby 1.9
 68* Added MagicTree logging.
 69* MagicTree logging updated by Gremwell.
 70* Added error logging.
 71* Added Verbose logging.
 72* Added XML header and footer to XML logs
 73* Modified XML logging to record modules separately
 74* Bug fix: Escaping the XML log properly for &, <, >, "
 75* All logs are now flushed/synced
 76* Bug fix: References to :probability instead of :certainty in some logging
 77* Changed error message for non resolving hostnames from "undefined method `closed?' for nil:NilClass" to "Cannot resolve hostname"
 78* Added ascii whatweb logo
 79* Moved Plugin class into lib/plugins.rb
 80* Added startup and shutdown for plugins
 81* Model and Firmware results now display in dark green
 82* Added :filepath match type
 83* Added vulnerability matching support, this is still in the experimental phase and not supported.
 84* Added vulnerability matching code to the awstats plugin.
 85* Precompiled regular expressions in matches[] for speed improvement
 86* Changed internal sleep times from 1s to 0.5s
 87* Added --debug to raise errors found in plugins
 88* Usage displays faster when no arguments are provided
 89* Added version string to the help usage
 90* Added advanced plugin template
 91* Removed How to write whatweb plugins text file as it's deprecated by the wiki
 92* Brief output escapes [] and all characters before SPACE with URL encoding
 93* Added --quiet, -q to suppress Brief Output on stdout by default. Thanks to cdybedahl for this idea.
 94* Improved OSX compatibility with a patch from matti for symlinks
 95* Added :status for HTTP Status codes to match[]. :status has a logical AND with a :url, it can't be by itself.
 96* Updated plugin list and plugin info output
 97* Bug fix: Now redirects for HTTP statuses 300 through 399. Previously redirected for 301,302 and 307.
 98* Bug fix: :account didn't have regular expression support
 99* Changed :modules to :module, deprecated :accounts to :account
100* Added redirect control. options are 'never',`http-only', `meta-only', `same-site', `same-domain', 'always'
101* Added --max-redirects. Control the maximum number of contiguous redirects followed
102* Added custom headers. Can be used multiple times. Examples: --header or -H. eg. "foo:bar" or "user-agent: blinky". Specifying a default header will replace it. Specifying an empty value removes hte header, eg. "User-Agent:"
103* Added support for HTTP basic authentication. -u and --user
104* Added plugin-development/get-pattern by Aung Khant
105* Added to plugin-development/: wget-alexa-top-1m, wget-ip-to-country, alexa-top-1000.txt, alexa-top-100.txt, wikipedia-top-1000.txt
106* Added nmap-style IP address range support
107
108Version 0.4.5 Released August 17th 2010
109* Added 5 plugins from Tonmoy Saikia. They are: Commonspot, TextPattern, Mediawiki, DUclassified and Mailman
110* Added 119 plugins from Brendan Coles. They are: Alcatel-Lucent-Omniswitch, Allinta-CMS, anyInventory, Arab-Portal, AVTech-Video-Web-Server, Barracuda-Spam-Firewall, Basilic, Biromsoft-WebCam, BlueNet-Video-Server, BM-Classifieds, Brother-Printer, BusinessSpace, BXR, Campsite, Canon-Network-Camera, Cisco-VPN-3000-Concentrator, CMSQLite, ColdFusion, coWiki, cpCommerce, CruxCMS, CruxPA, Dell-Printer, D-Link-Network-Camera, DMXReady, DT-Centrepiece, EazyCMS, eLitius, EMO-Realty-Manager, Empire-CMS, envezion~media, eSyndiCat, Evo-Cam, FestOS, Flax-Article-Manager, FluentNET, Forest-Blog, GuppY, HP-LaserJet-Printer, i-Catcher-Console, iDVR, Intellinet-IP-Camera, Interspire-Shopping-Cart, IPCop-Firewall, IQeye-Netcam, iRealty, iScripts-CyberMatch, iScripts-EasySnaps, iScripts-MultiCart, iScripts-ReserveLogic, iScripts-SocialWare, JAMM-CMS, Jamroom, Linksys-NAS, Linksys-Network-Camera, Linksys-Wireless-G-Camera, LocazoList-Classifieds, Lucky-Tech-iGuard, Mobotix-Network-Camera, MyioSoft-Ajax-Portal, My-PHP-Indexer, My-WebCamXP-Server, NetBotz-Network-Monitoring-Device, Netious-CMS, Netsnap-Web-Camera, Nukedit, Open-Blog, ORCA-Platform, ORITE-301-Camera, PageUp-People, Panasonic-Network-Camera, Parked-Domain, PHPDirector, PHPEasyData, phPhotoAlbum, Pixel-Ads-Script, Pixie, Pligg-CMS, PortalApp, Pressflow, RunCMS, sabros.us, samPHPweb, SHOUTcast-Administrator, SimpNews, SkaLinks, SmodCMS, Snap-Appliance-Server, Softbiz-Freelancers-Script, Softbiz-Online-Auctions-Script, Softbiz-Online-Classifieds, Sony-Network-Camera, Sony-Video-Network-Station, Stardot-Express, StarDot-NetCam, Star-Network, Subdreamer-CMS, Subrion-CMS, SyndeoCMS, syntaxCMS, TaskFreak, Team-Board, The-PHP-Real-Estate-Script, TomatoCMS, Toshiba-Network-Camera, Veo-Observer, VisionGS-Webcam, WebDVR, WebEye-Network-Camera, WebPress, WhiteBoard, Winamp-Web-Interface, Windows-Internet-Printing, Xerox-Printers, xGB, XHP-CMS, Zeus-Cart, Zoph, Zyxel-Vantage-Service-Gateway
111* Added 11 plugins from Caleb Anderson. They are: AdobeFlash, AtomFeed, CodeIgniterProfiler, DublinCore, MicrosoftODBCError, MysqlSyntaxError, OpenGraphProtocol, OpenID, OpenSearch, PasswordField, RSSFeed
112* Updated plugins: Aardvark-Topsites-PHP, Confluence, Open-Source-Ticket-Request-System, PHP-Link-Directory, PHP-Shell, Vulnerable-to-XSS, Zoph
113* Updated mailto plugin
114* Verbose output now shows which patterns were matched within a plugin
115* Fixed bug: Removed Makefile reference to 'disabled-plugins' folder
116* Ruby 1.9 compatability fix. requires digest/md5 instead of md5
117* Ruby 1.9 compatability fix. Replace UTF8 chars in frog-cms, dotnetnuke and mno-go-search and wordpress-supercache
118* Fixed spelling error of verion in help information
119* Fixed a typo where -t is shown as the command line option for proxies
120* Modified command line usage and is now in 80x24 terminal format
121* MD5sum of body is now available as @md5sum to all plugins
122* :md5 is available in matches[], eg. {:name=>"must be treshna.com",:md5=>"8666257030b94d3bdb46e05945f60b42"}
123* tag pattern of HTML elements in body is now available as @tagpattern to all plugins
124* :tagpattern is available in matches[], eg. {:name=>"must be google.com",:tagpattern=>""!doctype,html,head,meta,title,/title,script,/script,style,/style, etc...."}
125* :url is available in plugins. eg. {:url=>"/wp-login.php", :text=>'action=lostpassword'}, this will match the url and the text passively and when scanning aggressively, it will request the specified url and check for the text. Another example, {:url=>"/readme.html", :md5=>'9ea06ab0184049bf4ea2410bf51ce402', :version=>"3.0"},
126* Added --url-prefix, eg. whatweb --url-prefix www.morningstarsecurity.com/ -i ./guess-files
127* Added --url-suffix, eg. whatweb --url-suffix /robots.txt -i ./target-urls
128* Added --url-pattern, eg. whatweb --url-pattern www.example.com/%insert%/.htaccess -i ./folder-list
129* Added --custom-plugin to define a plugin on the command line. eg, ./whatweb --custom-plugin ":text=>'powered by abc'" -i ./targets   or    --custom-plugin "{:text=>'powered by abc'},{:regexp=>/meta abc/i}" -i ./targets
130* Plugin errors are now in red, added target name
131* Added --open-timeout and --read-timeout
132* Removed div-span plugin, replaced with HTML tag pattern hash
133* Added --spider-skip-extensions. Redefine the file extensions that Anemone will skip. The list is comma delimited.
134* Moved plugin-template.rb to my-plugins and added more example, comments, etc
135* Added $DEBUG = false. If set to true, it will raise errors in plugins to assist plugin development.
136
137Version 0.4.4 Released June 29th 2010
138* :probability is renamed to :certainty. :certainty in plugins is no longer required, it defaults to 100 if not specified.
139* Fixed bug with ruby 1.8.5 when loading plugins
140* Added author names to plugin info, eg. whatweb -I
141* Added 67 plugins from Brendan Coles, bringing WhatWeb up to 163 plugins. 360-Web-Manager,ANECMS,AWStats,Aardvark-Topsites-PHP,ArGoSoft-Mail-Server,Axis-Network-Camera,BeEF,BlognPlus,Burning-Board-Lite,CGI,CGIProxy,CMScontrol,CMSimple,Confluence,DUforum,DUgallery,F3Site,File-Upload-Manager,Google-API,Google-Hack-Honeypot,IMGallery,JGS-Portal,Kloxo,Liferay,Lime-Survey,Linksys-USB-HDD,Loggix,Microsoft-Sharepoint,Open-Freeway,Open-Source-Ticket-Request-System,PG-Roomate-Finder-Solution,PHP-Fusion,PHP-Layers,PHP-Link-Directory,PHP-Shell,PHPFM,PHPraid,PhilBoard,Piwik,QNAP-NAS,Saurus-CMS,Site-Sift,TWiki,Trac,Turbo-Seek,Umbraco,VideoShareEnterprise,Virtualmin,Vulnerable-To-XSS,WWWBoard,Web-Calendar-System,Web-Data-Administrator,WoW-Raid-Manager,X7-Chat,Zen-Cart,Zikula,boastMachine,ezBOO-WebStats,jobberBase,mojoPortal,php-ping,phpFreeChat,phpMyAdmin,phpPgAdmin,phpSysInfo,phpinfo,uPortal
142* Added references to Security-Assessment.com
143* Updates to README, CHANGELOG, plugin-template.rb.txt
144
145Version 0.4.3 Released May 24th 2010
146* Added GPLv2 notices
147* Added Makefile (Thanks Michal Ambroz <rebus AT seznam.cz>)
148* Added man pages (Thanks Michal Ambroz <rebus AT seznam.cz>)
149* Added --version
150* Added Invalid command line argument handling
151* Added @cookie variable to plugins but is not availble for recursive use
152* Changed output colour of page titles
153* Changed plugin names to use a CamelCase convention
154* Merged the google analytics GA and Urchin plugins
155* Modified MovableType plugin
156* Added Cookie names plugin
157* Added Concrete5 CMS plugin
158* Added CushyCMS plugin
159* Added FrogCMS plugin
160* Added ModxCMS plugin
161* Added TypoLight plugin
162* Added ExpressionEngine plugin
163* Fixed a bug in Tomcat plugin
164* New feature, my-plugins/ folder. Keep your personal plugins separate.
165* Usage info shows correct defaults
166* Fixed a bug where aggressive plugins didn't use the proxy settings
167* Added XML (naive) logging
168* Updated usage to show how to pipe HTML to /dev/stdin
169* Added --no-redirect option. Do not follow HTTP 3xx redirects
170
171Version 0.4.2 Released April 30th 2010
172* Added header-hash plugin. Makes a hash of the first 500 characters. This is useful to identify unknown systems
173* Added footer-hash plugin. Makes a hash of the last 500 characters, only if the page has > 1000 characters. This is useful to identify unknown systems
174* Added div-span-structure plugin. Makes a hash of a signature of div and span tags. This is useful to identify unknown systems
175* Added MikroTik Router plugin. Recognises version
176* Fixed a bug where the URL had a ? suffix. This caused some types of http servers to repspond incorrectly.
177* Added SquirrelMail plugin. Recognises version
178* Added SearchFitShoppingCart plugin. Recognises version
179* Added RoundCube plugin.
180* Modified OSCommerce plugin. Recognises security warnings about file permissions and installation directory.
181* Changed output colour to be more readable. Plugins that create hashes are in grey
182* Changed output order of plugins, so plugins that create hashes come last
183
184Version 0.4.1 Released April 28th 2010
185* Removed dependency on rubygems and libxslt by modifying and locally including the Anemone gem. This also simplified installation
186* Fixed a bug which didn't send URL parameters. eg. would send /index.php instead of /index.php?q=foo
187* Improved installation instructions. Henri Salo contacted me to say ruby-dev is required for Anemone
188* Removed UTF-8 character in formmail
189* Changed require 'md5' to require 'digest/md5' for compatibility with ruby 1.9 
190* Fixed bug in Tomcat plugin
191* Added SilverStripe plugin
192* Added DotNetNuke plugin
193* Added HTML5 plugin
194* Added PHP error plugin
195* Modified PHP-Nuke plugin
196* Changed the plugin development script, wget-list to retry only twice
197* Added proxy support
198* Default threads is now 25
199* Default max recursive spidering depth is now 10
200* Default max number of links to follow on a single page is now 250
201
202Version 0.4 Released March 13th 2010
203* Added HTTPS support
204* Improved installation instructions
205* Improved documentation
206* Better compatibility with ruby 1.9. Changed a case statement syntax, changed when 0: to when 0 then.
207* Removed UTF-8 characters in plugins that were causing crashes
208* Added php-nuke plugin, passively recognises modules
209* Added Fluxbb plugin, can identify versions aggressively
210* Added meta powered-by plugin. Matches tags like <meta name="powered-by" content="abc/1.23" />
211* Added powered by plugin. Matches "Powered by BobsCMS", any text following powered by
212* Improved plugin info listing invoked by ./whatweb -I. Shows number of examples and matches, and shows presence of passive and aggressive functions
213* Changed output style. Before strings are surrounded by single quotes, now all strings are surrounded by square brackets
214* Added OpenCMS plugin submitted by Emilio Casbas
215* Added TomCat plugin submitted by Louis Nyffenegger
216* Improved meta-generator plugin
217* Fixed a bug in processing a target list from a file where a trailing space would be interpreted incorrectly
218
219Version 0.3 Released November 2nd 2009 at Kiwicon III
220