Web Vulnerability Scanner

A modular CLI tool for automated web application security scanning. Checks for common vulnerabilities including missing security headers, SSL/TLS issues, open ports, and basic injection vectors.

Features

• Security Header Analysis — CSP, HSTS, X-Frame-Options, X-Content-Type-Options
• SSL/TLS Verification — Certificate validity, expiration, protocol version
• Port Scanning — Common service ports with banner grabbing
• SQL Injection Detection — Parameter-based SQLi testing with common payloads
• Colored Terminal Output — Clear risk-level indicators

Installation

git clone https://github.com/Abdijamaal17/web-vuln-scanner.git
cd web-vuln-scanner
pip install -r requirements.txt

Usage

# Full scan
python -m scanner.main scan --target example.com

# Header analysis only
python -m scanner.main headers --target example.com

# Port scan
python -m scanner.main ports --target example.com --range 1-1000

# SSL check
python -m scanner.main ssl --target example.com

Example Output

[*] Starting security scan on example.com
[*] ============================================

[+] Security Headers Analysis
    ✓ X-Frame-Options: SAMEORIGIN
    ✗ Content-Security-Policy: MISSING        [HIGH]
    ✓ X-Content-Type-Options: nosniff
    ✗ Strict-Transport-Security: MISSING       [HIGH]
    ✓ X-XSS-Protection: 1; mode=block

[+] SSL/TLS Check
    ✓ Certificate valid until 2026-08-15
    ✓ TLS 1.3 supported

[+] Open Ports
    22/tcp   SSH      OpenSSH 8.9
    80/tcp   HTTP     nginx/1.18
    443/tcp  HTTPS    nginx/1.18

[*] Scan complete. 2 issues found.

Architecture

scanner/
├── main.py              # CLI entry point (argparse)
├── modules/
│   ├── header_check.py  # Security header analysis
│   ├── port_scanner.py  # TCP port scanner
│   ├── ssl_check.py     # SSL/TLS verification
│   └── sqli_detector.py # SQL injection detection
└── requirements.txt

Disclaimer

This tool is intended for authorized security testing only. Always obtain proper authorization before scanning any target. Unauthorized scanning may be illegal.

License

MIT