---
obj: application
repo: https://github.com/Lissy93/web-check
website: https://web-check.xyz
rev: 2024-05-27
---

# web-check
Get an insight into the inner-workings of a given website: uncover potential attack vectors, analyse server architecture, view security configurations, and learn what technologies a site is using

## Features
### IP Info
An IP address ([Internet Protocol](../internet/Internet%20Protocol.md) address) is a numerical label assigned to each device connected to a network / the internet. The IP associated with a given [domain](../internet/Domain.md) can be found by querying the Domain Name System ([DNS](../internet/DNS.md)) for the [domain](../internet/Domain.md)'s A (address) record.

**Use Cases**:
Finding the IP of a given server is the first step to conducting further investigations, as it allows us to probe the server for additional info. Including creating a detailed map of a target's network infrastructure, pinpointing the physical location of a server, identifying the hosting service, and even discovering other domains that are hosted on the same IP address.

### SSL Chain
SSL certificates are digital certificates that authenticate the identity of a website or server, enable secure encrypted communication (HTTPS), and establish trust between clients and servers. A valid SSL certificate is required for a website to be able to use the HTTPS protocol, and encrypt user + site data in transit. SSL certificates are issued by Certificate Authorities (CAs), which are trusted third parties that verify the identity and legitimacy of the certificate holder.

**Use Cases**:
SSL certificates not only provide the assurance that data transmission to and from the website is secure, but they also provide valuable OSINT data. Information from an SSL certificate can include the issuing authority, the [domain](../internet/Domain.md) name, its validity period, and sometimes even organization details. This can be useful for verifying the authenticity of a website, understanding its security setup, or even for discovering associated subdomains or other services.

### DNS Records
This task involves looking up the [DNS](../internet/DNS.md) records associated with a specific [domain](../internet/Domain.md). [DNS](../internet/DNS.md) is a system that translates human-readable [domain](../internet/Domain.md) names into IP addresses that computers use to communicate. Various types of [DNS](../internet/DNS.md) records exist, including `A` (address), `MX` (mail exchange), `NS` (name server), `CNAME` (canonical name), and `TXT` (text), among others.

**Use Cases**:
Extracting [DNS](../internet/DNS.md) records can provide a wealth of information in an OSINT investigation. For example, `A` and `AAAA` records can disclose IP addresses associated with a [domain](../internet/Domain.md), potentially revealing the location of servers. `MX` records can give clues about a [domain](../internet/Domain.md)'s [email](../internet/eMail.md) provider. `TXT` records are often used for various administrative purposes and can sometimes inadvertently leak internal information. Understanding a [domain](../internet/Domain.md)'s [DNS](../internet/DNS.md) setup can also be useful in understanding how its online infrastructure is built and managed.

### Cookies
The Cookies task involves examining the [HTTP](../internet/HTTP.md) cookies set by the target website. Cookies are small pieces of data stored on the user's computer by the web browser while browsing a website. They hold a modest amount of data specific to a particular client and website, such as site preferences, the state of the user's session, or tracking information.

**Use Cases**:
Cookies can disclose information about how the website tracks and interacts with its users. For instance, session cookies can reveal how user sessions are managed, and tracking cookies can hint at what kind of tracking or analytics frameworks are being used. Additionally, examining [cookie](../internet/Cookie.md) policies and practices can offer insights into the site's security settings and compliance with privacy regulations.

### Crawl Rules
`Robots.txt` is a file found (usually) at the root of a [domain](../internet/Domain.md), and is used to implement the Robots Exclusion Protocol (REP) to indicate which pages should be ignored by which crawlers and bots. It's good practice to avoid search engine crawlers from over-loading your site, but should not be used to keep pages out of search results (use the noindex meta tag or header instead).

**Use Cases**:
It's often useful to check the `robots.txt` file during an investigation, as it can sometimes disclose the directories and pages that the site owner doesn't want to be indexed, potentially because they contain sensitive information, or reveal the existence of otherwise hidden or unlinked directories. Additionally, understanding crawl rules may offer insights into a website's SEO strategies.

### Headers
The Headers task involves extracting and interpreting the [HTTP](../internet/HTTP.md) headers sent by the target website during the request-response cycle. [HTTP](../internet/HTTP.md) headers are key-value pairs sent at the start of an [HTTP](../internet/HTTP.md) response, or before the actual data. Headers contain important directives for how to handle the data being transferred, including cache policies, content types, encoding, server information, security policies, and more.

**Use Cases**:
Analyzing [HTTP](../internet/HTTP.md) headers can provide significant insights in an OSINT investigation. Headers can reveal specific server configurations, chosen technologies, caching directives, and various security settings. This information can help to determine a website's underlying technology stack, server-side security measures, potential vulnerabilities, and general operational practices.

### Quality Metrics
Using Lighthouse, the Quality Metrics task measures the performance, accessibility, best practices, and SEO of the target website. This returns a simple checklist of 100 core metrics, along with a score for each category, to gauge the overall quality of a given site.

**Use Cases**:
Useful for assessing a site's technical health, SEO issues, identify vulnerabilities, and ensure compliance with standards.

### Server Location
The Server Location task determines the physical location of the server hosting a given website based on its IP address. This is done by looking up the IP in a location database, which maps the IP to a lat + long of known data centers and ISPs. From the latitude and longitude, it's then possible to show additional contextual info, like a pin on the map, along with address, flag, time zone, currency, etc.

**Use Cases**:
Knowing the server location is a good first step in better understanding a website. For site owners this aids in optimizing content delivery, ensuring compliance with data residency requirements, and identifying potential latency issues that may impact user experience in specific geographical regions. And for security researcher, assess the risk posed by specific regions or jurisdictions regarding cyber threats and regulations.

### Associated Hosts
This task involves identifying and listing all domains and subdomains (hostnames) that are associated with the website's primary [domain](../internet/Domain.md). This process often involves [DNS](../internet/DNS.md) enumeration to discover any linked domains and hostnames, as well as looking at known DNS records.

**Use Cases**:
During an investigation, understanding the full scope of a target's web presence is critical. Associated domains could lead to uncovering related projects, backup sites, development/test sites, or services linked to the main site. These can sometimes provide additional information or potential security vulnerabilities. A comprehensive list of associated domains and hostnames can also give an overview of the organization's structure and online footprint.

### Redirect Chain
This task traces the sequence of [HTTP](../internet/HTTP.md) redirects that occur from the original [URL](../internet/URL.md) to the final destination [URL](../internet/URL.md). An [HTTP](../internet/HTTP.md) redirect is a response with a status code that advises the client to go to another [URL](../internet/URL.md). Redirects can occur for several reasons, such as [URL](../internet/URL.md) normalization (directing to the www version of the site), enforcing HTTPS, [URL](../internet/URL.md) shorteners, or forwarding users to a new site location.

**Use Cases**:
Understanding the redirect chain can be useful for several reasons. From a security perspective, long or complicated redirect chains can be a sign of potential security risks, such as unencrypted redirects in the chain. Additionally, redirects can impact website performance and SEO, as each redirect introduces additional round-trip-time (RTT). For OSINT, understanding the redirect chain can help identify relationships between different domains or reveal the use of certain technologies or hosting providers.

### TXT Records
`TXT` records are a type of [DNS](../internet/DNS.md) record that provides text information to sources outside your [domain](../internet/Domain.md). They can be used for a variety of purposes, such as verifying [domain](../internet/Domain.md) ownership, ensuring [email](../internet/eMail.md) security, and even preventing unauthorized changes to your website.

**Use Cases**:
The `TXT` records often reveal which external services and technologies are being used with a given [domain](../internet/Domain.md). They may reveal details about the [domain](../internet/Domain.md)'s [email](../internet/eMail.md) configuration, the use of specific services like Google Workspace or Microsoft 365, or security measures in place such as SPF and DKIM. Understanding these details can give an insight into the technologies used by the organization, their [email](../internet/eMail.md) security practices, and potential vulnerabilities.

### Server Status
Checks if a server is online and responding to requests.

### Open Ports
Open ports on a server are endpoints of communication which are available for establishing connections with clients. Each port corresponds to a specific service or protocol, such as [HTTP](../internet/HTTP.md) (port 80), HTTPS (port 443), [FTP](../internet/FTP.md) (port 21), etc. The open ports on a server can be determined using techniques such as port scanning.

**Use Cases**:
Knowing which ports are open on a server can provide information about the services running on that server, useful for understanding the potential vulnerabilities of the system, or for understanding the nature of the services the server is providing.

### Traceroute
Traceroute is a network diagnostic tool used to track in real-time the pathway taken by a packet of information from one system to another. It records each hop along the route, providing details about the IPs of routers and the delay at each point.

**Use Cases**:
In OSINT investigations, traceroute can provide insights about the routing paths and geography of the network infrastructure supporting a website or service. This can help to identify network bottlenecks, potential censorship or manipulation of network traffic, and give an overall sense of the network's structure and efficiency. Additionally, the IP addresses collected during the traceroute may provide additional points of inquiry for further OSINT investigation.

### Carbon Footprint
This task calculates the estimated carbon footprint of a website. It's based on the amount of data being transferred and processed, and the energy usage of the servers that host and deliver the website. The larger the website and the more complex its features, the higher its carbon footprint is likely to be.

**Use Cases**:
From an OSINT perspective, understanding a website's carbon footprint doesn't directly provide insights into its internal workings or the organization behind it. However, it can still be valuable data in broader analyses, especially in contexts where environmental impact is a consideration. For example, it can be useful for activists, researchers, or ethical hackers who are interested in the sustainability of digital infrastructure, and who want to hold organizations accountable for their environmental impact.

### Server Info
This task retrieves various pieces of information about the server hosting the target website. This can include the server type (e.g., Apache, [Nginx](../applications/web/nginx.md)), the hosting provider, the Autonomous System Number (ASN), and more. The information is usually obtained through a combination of IP address lookups and analysis of [HTTP](../internet/HTTP.md) response headers.

**Use Cases**:
In an OSINT context, server information can provide valuable clues about the organization behind a website. For instance, the choice of hosting provider could suggest the geographical region in which the organization operates, while the server type could hint at the technologies used by the organization. The ASN could also be used to find other domains hosted by the same organization.

### Whois Lookup
This task retrieves Whois records for the target [domain](../internet/Domain.md). Whois records are a rich source of information, including the name and contact information of the [domain](../internet/Domain.md) registrant, the [domain](../internet/Domain.md)'s creation and expiration dates, the [domain](../internet/Domain.md)'s nameservers, and more. The information is usually obtained through a query to a Whois database server.

**Use Cases**:
In an OSINT context, Whois records can provide valuable clues about the entity behind a website. They can show when the [domain](../internet/Domain.md) was first registered and when it's set to expire, which could provide insights into the operational timeline of the entity. The contact information, though often redacted or anonymized, can sometimes lead to additional avenues of investigation. The nameservers could also be used to link together multiple domains owned by the same entity.

### Domain Info
This task retrieves Whois records for the target [domain](../internet/Domain.md). Whois records are a rich source of information, including the name and contact information of the [domain](../internet/Domain.md) registrant, the [domain](../internet/Domain.md)'s creation and expiration dates, the [domain](../internet/Domain.md)'s nameservers, and more. The information is usually obtained through a query to a Whois database server.

**Use Cases**:
In an OSINT context, Whois records can provide valuable clues about the entity behind a website. They can show when the [domain](../internet/Domain.md) was first registered and when it's set to expire, which could provide insights into the operational timeline of the entity. The contact information, though often redacted or anonymized, can sometimes lead to additional avenues of investigation. The nameservers could also be used to link together multiple domains owned by the same entity.

### DNS Security Extensions
Without DNSSEC, it's possible for MITM attackers to spoof records and lead users to phishing sites. This is because the [DNS](../internet/DNS.md) system includes no built-in methods to verify that the response to the request was not forged, or that any other part of the process wasn’t interrupted by an attacker. The [DNS](../internet/DNS.md) Security Extensions (DNSSEC) secures [DNS](../internet/DNS.md) lookups by signing your [DNS](../internet/DNS.md) records using public keys, so browsers can detect if the response has been tampered with. Another solution to this issue is DoH (DNS over HTTPS) and DoT (DNS over TLD).

**Use Cases**:
DNSSEC information provides insight into an organization's level of cybersecurity maturity and potential vulnerabilities, particularly around [DNS](../internet/DNS.md) spoofing and cache poisoning. If no [DNS](../internet/DNS.md) secururity (DNSSEC, DoH, DoT, etc) is implemented, this may provide an entry point for an attacker.

### Site Features
Checks which core features are present on a site. If a feature as marked as dead, that means it's not being actively used at load time

**Use Cases**:
This is useful to understand what a site is capable of, and what technologies to look for

### HTTP Strict Transport Security
[HTTP](../internet/HTTP.md) Strict Transport Security (HSTS) is a web security policy mechanism that helps protect websites against protocol downgrade attacks and [cookie](../internet/Cookie.md) hijacking. A website can be included in the HSTS preload list by conforming to a set of requirements and then submitting itself to the list.

**Use Cases**:
There are several reasons why it's important for a site to be HSTS enabled:
1. User bookmarks or manually types `http://example.com` and is subject to a man-in-the-middle attacker HSTS automatically redirects [HTTP](../internet/HTTP.md) requests to HTTPS for the target [domain](../internet/Domain.md)
2. Web application that is intended to be purely HTTPS inadvertently contains [HTTP](../internet/HTTP.md) links or serves content over [HTTP](../internet/HTTP.md) HSTS automatically redirects [HTTP](../internet/HTTP.md) requests to HTTPS for the target [domain](../internet/Domain.md) 
3. A man-in-the-middle attacker attempts to intercept traffic from a victim user using an invalid certificate and hopes the user will accept the bad certificate HSTS does not allow a user to override the invalid certificate message 

### DNS Server
This check determines the [DNS](../internet/DNS.md) server(s) that the requested URL / IP resolves to. Also fires off a rudimentary check to see if the [DNS](../internet/DNS.md) server supports DoH, and weather it's vulnerable to [DNS](../internet/DNS.md) cache poisoning.

### Tech Stack
Checks what technologies a site is built with. This is done by fetching and parsing the site, then comparing it against a bit list of [RegEx](../tools/Regex.md) maintained by Wappalyzer to identify the unique fingerprints that different technologies leave.

**Use Cases**:
Identifying a website's tech stack aids in evaluating its security by exposing potential vulnerabilities, informs competitive analyses and development decisions, and can guide tailored marketing strategies. Ethical application of this knowledge is crucial to avoid harmful activities like data theft or unauthorized intrusion.

### Listed Pages
This job finds and parses a site's listed sitemap. This file lists public sub-pages on the site, which the author wishes to be crawled by search engines. Sitemaps help with SEO, but are also useful for seeing all a sites public content at a glance.

**Use Cases**:
Understand the structure of a site's public-facing content, and for site-owners, check that you're site's sitemap is accessible, parsable and contains everything you wish it to.

### Security.txt
The `security.txt` file tells researchers how they can responsibly disclose any security issues found on your site. The standard was proposed in RFC 9116, and specifies that this file should include a point of contact ([email](../internet/eMail.md) address), as well as optionally other info, like a link to the security disclosure policy, [PGP](../cryptography/GPG.md) key, preffered language, policy expiry and more. The file should be located at the root of your [domain](../internet/Domain.md), either at `/security.txt` or `/.well-known/security.txt`.

**Use Cases**:
This is important, as without a defined point of contact a security researcher may be unable to report a critical security issue, or may use insecure or possibly public channels to do so. From an OSINT perspective, you may also glean info about a site including their posture on security, their CSAF provider, and meta data from the [PGP](../cryptography/GPG.md) public key.

### Linked Pages
Displays all internal and external links found on a site, identified by the `href` attributes attached to anchor elements.

**Use Cases**:
For site owners, this is useful for diagnosing SEO issues, improving the site structure, understanding how content is inter-connected. External links can show partnerships, dependencies, and potential reputation risks. From a security standpoint, the outbound links can help identify any potential malicious or compromised sites the website is unknowingly linking to. Analyzing internal links can aid in understanding the site's structure and potentially uncover hidden or vulnerable pages which are not intended to be public. And for an OSINT investigator, it can aid in building a comprehensive understanding of the target, uncovering related entities, resources, or even potential hidden parts of the site.

### Social Tags
Websites can include certain meta tags, that tell search engines and social media platforms what info to display. This usually includes a title, description, thumbnail, keywords, author, social accounts, etc.

**Use Cases**:
Adding this data to your site will boost SEO, and as an OSINT researcher it can be useful to understand how a given web app describes itself

### Email Configuration
DMARC (Domain-based Message Authentication, Reporting & Conformance): DMARC is an [email](../internet/eMail.md) authentication protocol that works with SPF and DKIM to prevent [email](../internet/eMail.md) spoofing and phishing. It allows [domain](../internet/Domain.md) owners to specify how to handle unauthenticated mail via a published policy in [DNS](../internet/DNS.md), and provides a way for receiving mail servers to send feedback about [emails](../internet/eMail.md)' compliance to the sender. BIMI (Brand Indicators for Message Identification): BIMI is an emerging [email](../internet/eMail.md) standard that enables organizations to display a logo in their customers' [email](../internet/eMail.md) clients automatically. BIMI ties the logo to the [domain](../internet/Domain.md)'s DMARC record, providing another level of visual assurance to recipients that the [email](../internet/eMail.md) is legitimate. DKIM (DomainKeys Identified Mail): DKIM is an [email](../internet/eMail.md) security standard designed to make sure that messages were not altered in transit between the sending and recipient servers. It uses digital signatures linked to the [domain](../internet/Domain.md) of the sender to verify the sender and ensure message integrity. SPF (Sender Policy Framework): SPF is an [email](../internet/eMail.md) authentication method designed to prevent [email](../internet/eMail.md) spoofing. It specifies which mail servers are authorized to send [email](../internet/eMail.md) on behalf of a [domain](../internet/Domain.md) by creating a [DNS](../internet/DNS.md) record. This helps protect against spam by providing a way for receiving mail servers to check that incoming mail from a [domain](../internet/Domain.md) comes from a host authorized by that [domain](../internet/Domain.md)'s administrators.

**Use Cases**:
This information is helpful for researchers as it helps assess a [domain](../internet/Domain.md)'s [email](../internet/eMail.md) security posture, uncover potential vulnerabilities, and verify the legitimacy of [emails](../internet/eMail.md) for phishing detection. These details can also provide insight into the hosting environment, potential service providers, and the configuration patterns of a target organization, assisting in investigative efforts.

### Firewall Detection
A WAF or web application firewall helps protect web applications by filtering and monitoring [HTTP](../internet/HTTP.md) traffic between a web application and the Internet. It typically protects web applications from attacks such as cross-site forgery, cross-site-scripting (XSS), file inclusion, and [SQL](../dev/programming/languages/SQL.md) injection, among others.

**Use Cases**:
It's useful to understand if a site is using a WAF, and which firewall software / service it is using, as this provides an insight into the sites protection against several attack vectors, but also may reveal vulnerabilities in the firewall itself.

### HTTP Security Features
Correctly configured security [HTTP](../internet/HTTP.md) headers adds a layer of protection against common attacks to your site. The main headers to be aware of are: [HTTP](../internet/HTTP.md) Strict Transport Security (HSTS): Enforces the use of HTTPS, mitigating man-in-the-middle attacks and protocol downgrade attempts. Content Security Policy (CSP): Constrains web page resources to prevent cross-site scripting and data injection attacks. X-Content-Type-Options: Prevents browsers from [MIME](../files/MIME.md)-sniffing a response away from the declared content type, curbing [MIME](../files/MIME.md)-type confusion attacks. X-Frame-Options: Protects users from clickjacking attacks by controlling whether a browser should render the page in a `<frame>`, `<iframe>`, `<embed>`, or `<object>`.

**Use Cases**:
Reviewing security headers is important, as it offers insights into a site's defensive posture and potential vulnerabilities, enabling proactive mitigation and ensuring compliance with security best practices.

### Archive History
Fetches full history of archives from the Wayback machine of the [Internet Archive](../internet/websites/clearnet/Internet%20Archive.md).

**Use Cases**:
This is useful for understanding the history of a site, and how it has changed over time. It can also be useful for finding old versions of a site, or for finding content that has been removed.

### Global Ranking
This check shows the global rank of the requested site. This is only accurate for websites which are in the top 100 million list. We're using data from the Tranco project (see below), which collates the top sites on the web from Umbrella, Majestic, Quantcast, the Chrome User Experience Report and [Cloudflare](../internet/websites/clearnet/Cloudflare.md) Radar.

**Use Cases**:
Knowing a websites overall global rank can be useful for understanding the scale of the site, and for comparing it to other sites. It can also be useful for understanding the relative popularity of a site, and for identifying potential trends.

### Block Detection
Checks access to the [URL](../internet/URL.md) using 10+ of the most popular privacy, malware and parental control blocking [DNS](../internet/DNS.md) servers.

### Malware & Phishing Detection
Checks if a site appears in several common malware and phishing lists, to determine it's threat level.

**Use Cases**:
Knowing if a site is listed as a threat by any of these services can be useful for understanding the reputation of a site, and for identifying potential trends.

### TLS Cipher Suites
These are combinations of cryptographic algorithms used by the server to establish a secure connection. It includes the key exchange algorithm, bulk encryption algorithm, MAC algorithm, and PRF (pseudorandom function).

**Use Cases**:
This is important info to test for from a security perspective. Because a cipher suite is only as secure as the algorithms that it contains. If the version of encryption or authentication algorithm in a cipher suite have known vulnerabilities the cipher suite and TLS connection may then vulnerable to a downgrade or other attack

### TLS Security Config
This uses guidelines from [Mozilla](../internet/websites/clearnet/Mozilla.md)'s TLS Observatory to check the security of the TLS configuration. It checks for bad configurations, which may leave the site vulnerable to attack, as well as giving advice on how to fix. It will also give suggestions around outdated and modern TLS configs

**Use Cases**:
Understanding issues with a site's TLS configuration will help you address potential vulnerabilities, and ensure the site is using the latest and most secure TLS configuration.

### TLS Handshake Simulation
This simulates how different clients (browsers, operating systems) would perform a TLS handshake with the server. It helps identify compatibility issues and insecure configurations.

### Screenshot
This check takes a screenshot of webpage that the requested URL / IP resolves to, and displays it.

**Use Cases**:
This may be useful to see what a given website looks like, free of the constraints of your browser, IP, or location.

## [Docker Compose](../tools/Docker%20Compose.md)
```yml
version: "3"
services:
    web-check:
        ports:
            - 3000:3000
        image: lissy93/web-check
```
