plankton

A command-line web vulnerability scanner. Runs a set of checks mapped to the OWASP Top 10 (2021) against a target URL and produces a colorful terminal output and a styled HTML report.

Version: 1

Features

• OWASP Top 10 (2021) coverage across 12 checks
• Colorized terminal output with a scan summary panel
• Dark-themed HTML report with severity cards and per-finding badges
• JSON and plain-text report formats also supported
• Configurable timeout, User-Agent, and check selection
• Auto-enables ANSI colors on Windows terminals
• Zero config, single-file script

OWASP Top 10 coverage

Code	Category	Check name(s)
A01	Broken Access Control	access, redirect
A02	Cryptographic Failures	crypto
A03	Injection	sqli, xss, cmdi, lfi
A04	Insecure Design	not testable remotely
A05	Security Misconfiguration	misconfig
A06	Vulnerable and Outdated Components	components
A07	Identification and Authentication	auth
A08	Software and Data Integrity Failures	integrity
A09	Security Logging and Monitoring	not testable remotely
A10	Server-Side Request Forgery	ssrf

Install

pip install -r requirements.txt

Python 3.9+.

Usage

python plankton.py <url> [options]

Options:

-t, --timeout SEC             HTTP timeout in seconds (default: 10)
-o, --output PATH             Report file (default: plankton-report.<ext>)
-f, --format {text,json,html} Report format (default: html)
    --only  a,b,c             Only run these checks
    --skip  a,b,c             Skip these checks
    --user-agent STR          Override User-Agent
    --no-color                Disable colored terminal output
-V, --version                 Print version and exit
-h, --help                    Show help and exit

If -o is omitted, the report is written to:

• plankton-report.html when -f html (default)
• plankton-report.json when -f json
• plankton-report.txt when -f text

Examples

python plankton.py https://example.com
python plankton.py https://example.com --only sqli,xss,misconfig
python plankton.py https://example.com -f json -o report.json
python plankton.py "https://example.com/page?id=1" --only cmdi,lfi,ssrf
python plankton.py https://example.com --skip components,integrity -t 20
python plankton.py https://example.com --no-color

Output

Terminal. Purple banner, green step markers, cyan info lines, and severity-tinted tags on each finding. A boxed summary panel at the end shows duration and counts by severity.

HTML report. Dark theme, gradient header, KPI cards for Total / Critical / High / Medium / Low, and one card per finding with OWASP code, severity pill, URL, evidence, and fix. Open in any browser.

JSON report. Machine-readable, includes target, version, owasp, duration_seconds, generated_at, summary, and the full findings list.

Text report. Boxed header with metadata and counts, followed by one section per finding.

Exit codes

• 0: no findings
• 1: findings reported
• 2: report file could not be written

Legal

Only scan systems you own or have written permission to test.

License

MIT. See LICENSE.