This project is a Web Vulnerability Scanner that aims to identify common security vulnerabilities in web applications. The scanner first crawls a target website, builds a site map, and then checks for various security issues, such as XSS, SQL Injection, SSRF, IDOR, and common misconfigurations.
- Crawls a target website, extracting internal links and forms.
- Scans for common web application vulnerabilities:
- Cross-Site Scripting (XSS)
- SQL Injection
- Server-Side Request Forgery (SSRF)
- Insecure Direct Object Reference (IDOR)
- Checks for common security misconfigurations:
- Unnecessary open ports
- Default or missing security headers
- Default credentials
- Supports rate-limiting and follows robots.txt rules.
- Uses multithreading to improve crawling performance.
- Provides logging and report generation.
- Python 3.7+
- Install required packages using pip: pip install -r requirements.txt
- Update the config.json file with your desired crawl delay (in seconds).
- Run the scanner using the following command: python main.py <target_url> <known_user_id> Replace <target_url> with the URL of the website you want to scan and <known_user_id> with a known user ID for IDOR testing.
- After the scanner has finished, review the scan.log file for any logging information and the report.txt file for a summary of identified vulnerabilities.
- main.py: The main script to run the Web Vulnerability Scanner.
- crawler.py: Contains the Crawler class responsible for crawling the target website and extracting links and forms.
- vulnerability_scanner.py: Contains the VulnerabilityScanner class responsible for scanning the target website for common web application vulnerabilities and misconfigurations.
- config.json: Configuration file that stores settings such as crawl delay.
- requirements.txt: Contains the required packages for the project.
This tool is intended for educational purposes and security testing. Please ensure that you have the appropriate permissions before scanning a target website. I am not responsible for any misuse or damage caused by this tool.
This project is licensed under the MIT License.