An automated Python-based reconnaissance and vulnerability discovery tool for web applications. Built for authorised security assessments — maps the attack surface, detects misconfigurations, and prioritises findings by severity.
This tool is for authorised security testing only. Always obtain written permission before scanning any web application. Unauthorised scanning may violate computer fraud and cybercrime laws. The authors assume no liability for misuse.
This tool is for authorized security testing only. All development and testing conducted on intentionally vulnerable environments (DVWA, WebGoat) owned by the developer.
Explore the scanner's reporting capabilities, dashboard layout, and verification logs through our interactive live demo:
🔗 Launch Interactive Showcase Landing Page
- 🧪 DVWA Lab Scan Report: Scan of Damn Vulnerable Web Application showing browser-verified SQLi, CMDi, and XSS findings.
- 🛍️ OWASP Juice Shop Report: Scan of modern Node/Angular application showing CORS, SSRF, and authentication observations.
- 🏢 Sanitized SMB Scan Report: Realistic production-style report with sensitive company domains and network identifiers sanitized to
example-smb.local.
The scanner automates the reconnaissance, vulnerability mapping, active verification, and attack chain reasoning phases of a web application penetration test. It operates across a structured seven-phase penetration testing sequence:
- Phase 0: Target Profiling: Identification of framework fingerprints, technology mappings, brain advisories, and knowledge graph vulnerability reasoning.
- Phase 1: Recon: Active DNS and subdomain enumeration.
- Phase 2: Crawl: Recursive page discovery and route mapping.
- Phase 2.5: Form Intelligence: Schema parsing of fields/parameters and input surface mapping (initial status as "Not Tested Yet").
- Phase 3: Scan: Parameter reflection canary analysis, active injection scans (SQLi, CMDi, LFI, SSRF), and CSRF verification.
- Phase 4: Verification: Proof validation via headless Playwright execution and findings classification.
- Phase 5: Data Flow Mapping: Stored data discovery (Stored XSS) and form workflow path mapping.
- Phase 6: Attack Chains: Shortest path attack graphs mapping to high-impact administrative targets.
| Feature | Description |
|---|---|
| Threat Intelligence Brain | 7-module cognitive engine mapping vulnerabilities, caching advisories, and dynamically evolutionizing payloads. |
| Form Intelligence Layer | Parses input/select/textarea schema metadata, logging them as Input Surfaces to guide scanning. |
| Active Parameter Reflection | Injects canaries to classify reflection states (raw vs encoded) and avoid blind payload firing. |
| CSRF Analysis | Detects anti-CSRF tokens, tests dynamic token rotation, and attempts bypasses to confirm vulnerabilities. |
| Stored Data Discovery | Tracks inputs across administrative and visited endpoints to actively verify Stored XSS. |
| Playwright Browser Verifier | Executes headless Playwright checks to verify XSS using dialogs, DOM mutation, cookie, and postMessage signals. |
| Route Permission Matrix | Probes candidate admin/API paths anonymously and authenticated to determine role requirements. |
| HTTP Method Prober | Actively scans and verifies unsafe methods (PUT/DELETE/PATCH) with safe permission validation. |
| Endpoint Risk Heatmap | Maps vulnerabilities by dynamic URL paths and computes maximum BusinessRiskScores for exposure hotspots. |
| Machine Learning Scoring | Extracts 43-dimension feature vectors to predict True/False Positives via trained classification. |
| Multi-format Reporting | Generates Jinja2 HTML dashboards, machine-readable JSON exports, and print-ready A4 PDF reports. |
| OWASP Category | How Scanner Detects It |
|---|---|
| A01 – Broken Access Control | Open redirect testing, HTTP method probing, Route Permission Matrix |
| A02 – Cryptographic Failures | Exposed secrets detection, missing HSTS, predictable tokens |
| A03 – Injection | Parameter reflection canary check, SQLi, CMDi, LFI, SSRF testing |
| A05 – Security Misconfiguration | Missing security headers, wildcard CORS, Debug mode exposures |
| A06 – Vulnerable Components | Technology fingerprinting & Outdated/EOL runtimes verification |
| A07 – Authentication Failures | Exposed credentials, token detection, lack of CSRF protection |
# Clone the repository
git clone https://github.com/your-username/web-vulnerability-scanner.git
cd web-vulnerability-scanner
# Install dependencies
pip install -r requirements.txt
# Ensure Playwright browser is installed
python3 -m playwright install chromiumRequirements:
- Python 3.8+
- Node.js (for Playwright browser execution)
- Python packages:
requests,beautifulsoup4,python-whois,tqdm,jinja2,networkx,playwright
# Basic scan
python main.py -u http://localhost:8000/
# Full scan with active browser verification and PDF report generation
python main.py -u http://localhost:8000/ --full-scan --browser-verify --pdf
# Authenticated scan using session cookies
python main.py -u http://localhost:8000/ --cookies "PHPSESSID=tvuq4qp0i9sibc61as574g0b03; security=medium" --full-scan
# WAF evasion with custom delay
python main.py -u http://localhost:8000/ --waf-evasion --waf-min-delay 1 --waf-max-delay 5Command Line Arguments:
| Argument | Default | Description |
|---|---|---|
-u, --url |
required | Target URL to scan |
-d, --depth |
2 |
Crawl depth |
--delay |
0 |
Delay (seconds) between requests |
-o, --output |
current dir | Output directory for reports |
--cookies |
— | Session cookies for authenticated scanning |
--bearer-token |
— | Bearer token for authorization |
--headers |
— | Custom JSON headers to inject |
--waf-evasion |
— | Enable multi-signal WAF evasion delays |
--browser-verify |
— | Enable Playwright browser verification for XSS |
--full-scan |
— | Enable SQLi, SSRF, DOM-XSS, Subdomain, and CSRF analysis |
--pdf |
— | Automatically generate PDF output of the scan report |
web-vulnerability-scanner/
│
├── main.py # Core scanner entry point & phase orchestrator
├── requirements.txt # Python dependencies
├── sanitize_report.py # Report sanitization/redaction utility
│
├── demo/ # Public Demo Showcase
│ ├── index.html # Interactive demo landing page
│ ├── assets/ # Mock screenshots & assets
│ └── reports/ # Sanitized/lab scan reports
│
├── scanners/ # Scanner cores & modules
│ ├── finding.py # Subclassed findings (Observation, Potential, Verified)
│ ├── threat_brain.py # 7-stage Threat Intelligence Brain
│ ├── target_profiler.py # Technology fingerprinting & advisories
│ ├── attack_planner.py # Target-specific scan prioritization
│ ├── browser_verifier.py # Headless Playwright verification
│ └── ...
│
├── ml/ # Machine learning engine
│ ├── features.py # 43-dimension feature engineering
│ ├── train.py # Classifier training
│ └── ...
│
├── templates/
│ └── report_template.html # Jinja2 HTML report template
│
├── scan_results/ # Default output directory
│ ├── scan_report.html # Visual pentest report
│ ├── scan_report.pdf # Print-ready PDF report
│ ├── scan_results.json # Machine-readable findings
│ └── priority_report.txt # Severity-sorted findings
│
└── README.md
Vulnerabilities are scored on a BusinessRiskScore scale of 0.0 - 10.0 and grouped into Confidence Classes:
- VerifiedVulnerability: Actively exploited/verified findings (high severity/confidence).
- PotentialVulnerability: Inferred vulnerabilities lacking proof-of-concept validation.
- Observation: Technology fingerprints, exposures, and headers mapped to the target.
Features like Evidence Strength (calculated from replay reliability) and ML Probability feed into the classification engine to filter false positives into the Appendix.
- CSRF simulation parity: Bypass detection expects consistent HTTP responses when tokens are omitted; custom client-side validations may require manual verification.
- Subdomain scope: Active reconnaissance treats out-of-scope targets as restricted unless explicitly authorized.
- Authenticated JS flows: Playwright session injection supports cookie/bearer persistence, but complex multi-factor authentication flows must be pre-authenticated.
Gudimella Shivprasad
- OWASP Top 10 Project
- OWASP Web Security Testing Guide (WSTG)
- PortSwigger Web Security Academy
- HackerOne Public Vulnerability Dataset
Built for learning, research, and authorised security assessments. Always obtain explicit authorization before testing remote hosts.