WebCheck
title: web-check type: tool created: 2026-05-26 last_updated: 2026-05-26 related: ["radar/techniques/SelfHostedSecurityReview", "radar/techniques/DockerSecuritySelfHosting"] sources: ["https://github.com/Lissy93/web-check"] radar_quadrant: Tools radar_ring: Assess radar_position: inner
All-in-one OSINT tool for analysing the infrastructure and security posture of any website. Given a URL, web-check runs dozens of parallel checks and presents the results in a single visual dashboard.
The tool aggregates information that is publicly accessible but ordinarily scattered across separate utilities:
- DNS records (A, MX, NS, TXT, SPF, DMARC)
- TLS certificate details, validity, and issuer chain
- HTTP security headers (CSP, HSTS, X-Frame-Options, etc.)
- Open ports via service detection
- Hosting provider and ASN attribution
- WHOIS registration data
- Redirects and canonical URL resolution
- Robots.txt, sitemap, and crawl directives
- Social media and linked account references
- Carbon footprint estimate via third-party API
Each check is independent; partial results are shown as they complete.
web-check is self-hostable via Docker:
docker run -p 3000:3000 lissy93/web-check
A hosted public instance also exists. The self-hosted option is preferred for any target where query privacy matters, as each check generates identifiable outbound traffic from the host.
The primary audience is security practitioners and infrastructure teams. Concrete uses:
- Pre-engagement reconnaissance — mapping an organisation's publicly visible attack surface before a penetration test
- Self-audit — verifying that a newly deployed service exposes no unintended open ports, has correct security headers, and presents a valid certificate chain
- Competitive research — inspecting hosting provider and CDN choices of peer services
- Incident investigation — quickly correlating domain, ASN, and certificate data during an active incident
web-check sits in the Assess ring of the Tools quadrant, at inner position. First studied via the GitHub repository (2024-07-29). The tool consolidates reconnaissance checks that would otherwise require running nmap, dig, curl, ssllabs, and several other utilities manually. Self-hosted deployment is straightforward and the output is immediately readable without domain expertise. Inner position reflects low installation friction, broad applicability to any security or infrastructure workflow, and direct complementarity with radar/techniques/SelfHostedSecurityReview and radar/techniques/DockerSecuritySelfHosting already on the radar. Remaining gate before Trial is use in at least one real security review or self-audit where the dashboard findings drove a concrete remediation action.
