A terminal scanner tells you what powers a website without opening a browser. For developers, security engineers, and automation builders, detecting a stack straight from the command line beats reading headers by hand or digging through HTML. A lightweight CLI does the whole job.
This guide builds a fast website technology scanner in Go using ProjectDiscovery's open-source library. If you're new to detection, read our detecting website technologies using Go guide first.
External resources:
What we are building
By the end of this tutorial you'll have a CLI that:
- accepts a target URL
- fetches the HTTP response
- detects technologies
- prints results in the terminal
That's the same approach recon pipelines and developer tooling use as a foundation.
Why build a CLI scanner?
CLI tools are fast, scriptable, and drop into automation without the repetitive manual checks. Common uses:
- security reconnaissance
- attack surface discovery
- competitive research
- automation pipelines
- developer diagnostics
For the concepts behind detection, our technology fingerprinting explained for developers article goes deeper.
Step 1: Create the project
Start by creating a new directory:
mkdir tech-scanner-cli
cd tech-scanner-cli
Initialize a Go module:
go mod init tech-scanner-cli
Step 2: Install Wappalyzergo
Run:
go get github.com/projectdiscovery/wappalyzergo
This pulls in the fingerprinting engine ProjectDiscovery maintains.
Step 3: Write the CLI tool
Create a main.go file and add the following code:
package main
import (
"flag"
"fmt"
"io"
"log"
"net/http"
wappalyzer "github.com/projectdiscovery/wappalyzergo"
)
var target = flag.String("url", "", "Target URL to scan")
func main() {
flag.Parse()
if *target == "" {
log.Fatal("Please provide a URL using -url")
}
resp, err := http.Get(*target)
if err != nil {
log.Fatalf("failed to fetch target: %v", err)
}
defer resp.Body.Close()
body, err := io.ReadAll(resp.Body)
if err != nil {
log.Fatalf("failed to read response: %v", err)
}
client, err := wappalyzer.New()
if err != nil {
log.Fatalf("failed to create client: %v", err)
}
technologies := client.Fingerprint(resp.Header, body)
fmt.Println("Detected technologies:")
for tech := range technologies {
fmt.Println("-", tech)
}
}
Step 4: Build the CLI
Compile the binary:
go build
That drops an executable into your project directory.
Step 5: Run the scanner
./tech-scanner-cli -url https://example.com
Expected output:
Detected technologies:
- Cloudflare
- React
- Nginx
That's a working detector in under 50 lines of Go.
Optional: Install it globally
To run the tool from anywhere:
sudo cp tech-scanner-cli /usr/local/bin/
Then:
tech-scanner-cli -url https://example.com
Improve the CLI (recommended enhancements)
Once the basic scanner works, add:
Output formats
- JSON for automation
- CSV for reporting
Concurrency
Scan multiple targets at once.
Timeout controls
Stop slow sites from blocking scans.
Category detection
Use FingerprintWithCats to group technologies.
Using custom fingerprints
Wappalyzergo ships an embedded dataset, but you can load your own if you need to:
client, err := wappalyzer.NewFromFile("fingerprints.json", true, true)
That covers internal tooling or specialized detection without writing a matcher yourself.
When should you use a CLI scanner?
A terminal scanner earns its place when you're:
- running reconnaissance at scale
- automating security workflows
- integrating into CI pipelines
- building developer utilities
For a tooling comparison, watch for our Wappalyzergo vs Wappalyzer guide.
Conclusion
You now have a fast, scriptable website technology scanner built entirely in Go.
ProjectDiscovery's open-source libraries let developers wire reliable detection into their workflows without rebuilding the engine. If this guide was useful, the repository is worth a look:
Next, detecting website technologies using Go explains the fingerprinting process behind the scanner.
This article was originally published on ToolSura. For more on technology detection, read How Technology Detection Works and Technology Fingerprinting for Developers.
Top comments (1)
This is the kind of tutorial I love—straight to the point, no fluff, and a working tool in under 50 lines of Go. I have used ProjectDiscovery's libraries before for other recon work, and they are solid, but I never thought to wrap Wappalyzergo into such a clean little CLI. Definitely adding this to my toolkit.
One thing that would make this even more approachable for folks who are not deep into security workflows: a simple "summary" mode that prints a one-line overview instead of the full list. Something like "React + Nginx + Cloudflare detected" feels more digestible when you are just curious about a site and do not need the full report. You could keep the detailed output as default and add a -summary flag for the quick glance.
Also, since you already support scanning a single URL, have you considered adding a -list flag that accepts a file with multiple targets? I find myself wanting to scan a batch of competitor websites or internal services at once, and having the tool loop through them with a clean separator would save a lot of scripting on my end. Bonus points if it shows a small progress indicator so I know it is not frozen.
I actually built something similar a while back for a client who wanted to track tech stack changes across their vendors over time. We ended up scheduling a daily scan and piping the JSON output into a small dashboard. That little CLI saved us from constantly asking "did they switch to something new?" every week. So yeah, this approach definitely scales beyond just one-off curiosity.
Solid work putting this together—and thanks for sharing it openly. Already bookmarking the repo for future reference.