KP WebScanner

KP WebScanner is a fully self-contained, Docker-based web security scanning suite. It bundles twenty-two industry-standard security tools into a single image, orchestrated by a single entrypoint script. Point it at any target and get a comprehensive security assessment covering passive recon, fingerprinting, subdomain enumeration, DNS analysis, port scanning, deep service fingerprinting, SSL/TLS auditing, HTTP security header grading, parameter discovery, XSS scanning, SQL injection testing, dependency vulnerability scanning, vulnerability detection, endpoint discovery, active scanning, and nginx bad bot blocker validation — with automatic WordPress-specific scanning when detected.

All tools install at their latest versions at image build time. No host dependencies beyond Docker or Podman are required. Results are compiled into a single report.html using UIkit at the end of each scan.

⚠️ Only scan targets you own or have explicit written permission to test. Unauthorized scanning is illegal.

---

Tools

Tool	Category	Purpose
Shodan	Passive Recon	Query Shodan's index for open ports, banners & CVEs (zero active requests, optional API key)
Censys	Passive Recon	Certificate, port & service intelligence from Censys (zero active requests, optional API credentials)
Nuclei	Vulnerability Scanning	Template-based CVE & misconfiguration detection
httpx	Fingerprinting	HTTP probing, tech detection, status codes
subfinder	Reconnaissance	Passive subdomain enumeration
naabu	Reconnaissance	Fast port scanning (top 1000, raw packet mode)
Nmap	Reconnaissance	Deep service fingerprinting and NSE vulnerability scripts against discovered ports
katana	Discovery	Web crawling & JavaScript endpoint extraction
dnsx	Reconnaissance	DNS record enumeration (A, AAAA, MX, NS, TXT, CNAME)
gobuster	Discovery	Directory & path brute-forcing
ffuf	Discovery	Fast web fuzzing
sqlmap	Injection Testing	Automated SQL injection detection & exploitation
Dalfox	XSS Scanning	Parameter analysis & XSS detection (reflected, DOM, stored)
Arjun	Discovery	Hidden HTTP parameter discovery (25,890 param dictionary)
OSV-Scanner	Dependency Scanning	Scans exposed dependency/lockfiles for known CVEs via Google's OSV.dev database
Nikto	Vulnerability Scanning	Web server misconfiguration & known vulnerability checks
WhatWeb	Fingerprinting	Web technology identification
testssl.sh	SSL/TLS	Cipher suite analysis, certificate validation, protocol weaknesses
Mozilla Observatory	Headers	HTTP security header grading (CSP, HSTS, SRI, X-Frame-Options, etc.)
WPScan	CMS	WordPress plugin/theme vuln scanning, user enumeration (auto-triggered)
nginx-ultimate-bad-bot-blocker	Validation	Verifies bad bots/referrers are blocked and good bots are not false-positived
OWASP ZAP	Active Scanning	Dynamic application security testing

---

Getting the Image

Pull from GHCR

# Specific release
docker pull ghcr.io/kpirnie/webscanner:v#.#.#

# Latest stable (main branch)
docker pull ghcr.io/kpirnie/webscanner:latest

# Development build
docker pull ghcr.io/kpirnie/webscanner:develop

Build Locally

git clone https://github.com/kpirnie/webscanner.git
cd webscanner
docker build -t webscanner .

First build takes approximately 10–20 minutes due to Go compilation and tool installation.

---

Usage

docker run --rm --network host --cap-add NET_ADMIN --cap-add NET_RAW \
    [-v /host/output/path:/output] \
    ghcr.io/kpirnie/webscanner:latest <target-uri> [options]

Examples

# Quick scan — condensed findings summary to stdout
docker run --rm --network host --cap-add NET_ADMIN --cap-add NET_RAW \
    ghcr.io/kpirnie/webscanner:latest https://example.com

# Full scan — all results + HTML report written to host directory
docker run --rm --network host --cap-add NET_ADMIN --cap-add NET_RAW \
    -v $(pwd)/results:/output \
    ghcr.io/kpirnie/webscanner:latest https://example.com -o results

# Fast scan — skip slow steps, high/critical findings only
docker run --rm --network host --cap-add NET_ADMIN --cap-add NET_RAW \
    -v $(pwd)/results:/output \
    ghcr.io/kpirnie/webscanner:latest https://example.com \
    -o results --skip-zap --skip-brute --skip-arjun --severity high,critical

# Recon only — no active scanning
docker run --rm --network host --cap-add NET_ADMIN --cap-add NET_RAW \
    -v $(pwd)/results:/output \
    ghcr.io/kpirnie/webscanner:latest https://example.com \
    -o results --skip-nikto --skip-xss --skip-sqlmap --skip-nuclei --skip-zap

# WordPress site with full vulnerability data (requires free API token)
docker run --rm --network host --cap-add NET_ADMIN --cap-add NET_RAW \
    -e WPSCAN_API_TOKEN=your_token_here \
    -v $(pwd)/results:/output \
    ghcr.io/kpirnie/webscanner:latest https://example.com -o results

---

Options

Flag	Description
<target-uri>	Target to scan. Accepts bare domain (example.com) or full URI (https://example.com:8443)
-o PATH	Write all results to /output/PATH on the host. Requires a -v volume mount. Omit to print a condensed summary to stdout.
--severity LEVEL	Nuclei severity filter. Comma-separated. Default: low,medium,high,critical

Skip Flags

Every scan step can be individually skipped:

Flag	Skips
--skip-fingerprint	WhatWeb + httpx
--skip-recon	Shodan + Censys passive lookup
--skip-subdomains	subfinder subdomain enumeration
--skip-dns	dnsx DNS record enumeration
--skip-ports	naabu port scanning
--skip-nmap	Nmap service & script scan
--skip-ssl	testssl.sh SSL/TLS analysis
--skip-headers	Mozilla Observatory header grading
--skip-nikto	Nikto web server scan
--skip-cms	CMS detection + WPScan
--skip-crawl	katana web crawling
--skip-brute	gobuster + ffuf directory brute-forcing
--skip-arjun	Arjun parameter discovery
--skip-xss	Dalfox XSS scanning
--skip-sqlmap	sqlmap SQL injection testing
--skip-osv	OSV-Scanner dependency scanning
--skip-nuclei	Nuclei vulnerability scanning
--skip-botblocker	nginx bad bot blocker validation
--bot-sample N	Bad-bot random sample size per category (default: 50)
--skip-zap	OWASP ZAP active scan

Optional API Keys

Passed at runtime via -e:

Variable	Tool	Get one at
WPSCAN_API_TOKEN	WPScan	wpscan.com/register — 25 req/day free
SHODAN_API_KEY	Shodan	account.shodan.io — free tier available
CENSYS_APP_ID + CENSYS_TOKEN	Censys	censys.io — free tier available

---

CMS Auto-Detection

KP WebScanner fingerprints the CMS during step 1 and automatically triggers WPScan when WordPress is detected. Drupal and Joomla are identified and logged — CVE coverage for both is handled by Nuclei's template library and ZAP's active scan.

Detected CMS	Action
WordPress	WPScan (full plugin/theme/user enumeration)
Drupal	Detected & logged — Nuclei + ZAP provide coverage
Joomla	Detected & logged — Nuclei + ZAP provide coverage

---

Scan Pipeline

 1/18  Fingerprinting              WhatWeb, httpx
 2/18  Passive Recon               Shodan, Censys (optional API keys, zero active requests)
 3/18  Subdomain Enum              subfinder + httpx live probe
 4/18  DNS Enumeration             dnsx  (A, AAAA, CNAME, MX, NS, TXT)
 5/18  Port Scanning               naabu (top 1000, raw packet mode)
 6/18  Service Fingerprinting      Nmap (-sV -sC + vuln/safe NSE scripts on discovered ports)
 7/18  SSL/TLS Analysis            testssl.sh
 8/18  HTTP Security Headers       Mozilla Observatory
 9/18  Web Server Scan             Nikto (all CGI dirs, full tuning)
10/18  CMS Scanning                WPScan (WordPress only, auto-triggered)
11/18  Endpoint Discovery          katana, gobuster, ffuf
12/18  Parameter Discovery         Arjun (25,890 param dictionary)
13/18  XSS Scanning                Dalfox (reflected, DOM, stored)
14/18  SQL Injection               sqlmap (crawls + feeds katana endpoints)
15/18  Dependency Scanning         OSV-Scanner (scans exposed lockfiles via OSV.dev)
16/18  Vulnerability Scan          Nuclei
17/18  Bot Blocker Validation      nginx-ultimate-bad-bot-blocker (random sample, live lists)
18/18  Active Scan                 OWASP ZAP

---

Output Structure

When using -o, each run creates a timestamped subdirectory containing all raw tool outputs plus a consolidated report.html:

results/
└── example.com_20260318_153000/
    ├── scan.log
    ├── report.html                          ← consolidated UIkit HTML report
    ├── whatweb.txt
    ├── httpx.txt
    ├── shodan.txt                           ← if SHODAN_API_KEY set
    ├── censys.txt                           ← if CENSYS_APP_ID/TOKEN set
    ├── subdomains.txt / subdomains_live.txt
    ├── dns.txt
    ├── ports.txt
    ├── nmap.txt / nmap.xml
    ├── testssl.txt / testssl.json
    ├── observatory.json
    ├── nikto.txt / nikto.json
    ├── wpscan.txt / wpscan.json             ← WordPress only
    ├── endpoints.txt
    ├── gobuster.txt
    ├── ffuf.json
    ├── arjun.json
    ├── dalfox.txt
    ├── sqlmap/
    ├── osv_scanner.txt / osv_scanner.json   ← if exposed lockfiles found
    ├── nuclei.txt / nuclei.json
    ├── botblocker_test.txt
    └── zap_report.html

report.html aggregates all tool outputs into a single dark-themed UIkit page with a summary dashboard, per-step accordion sections, and a direct link to the ZAP report. Skipped steps are clearly indicated inline.

---

Technical Notes

• --network host and NET_ADMIN/NET_RAW capabilities are required for naabu and Nmap raw packet scanning
• Nmap runs against ports discovered by naabu — if naabu finds nothing it falls back to common ports 80, 443, 8080, 8443
• OSV-Scanner downloads any exposed lockfiles/manifests found during endpoint discovery and scans them against the OSV.dev database; silently skipped if none are found
• OWASP ZAP runs directly inside the image — no nested container required
• ZAP heap is capped at 512MB via JAVA_OPTS to prevent OOM on memory-constrained hosts
• ZAP home directories are pre-created at build time to eliminate first-run initialization hangs
• Nuclei templates are baked into the image at build time and refreshed on each scan run
• Shodan and Censys do zero active scanning — both query existing indexes only; steps are silently skipped if no API keys are provided
• Arjun runs against the first 50 discovered endpoints to avoid excessive runtime
• Dalfox runs in file mode against all katana-discovered endpoints, falling back to the base URL if none found
• sqlmap runs at --level=2 --risk=1 by default — safe for authorized testing without being overly aggressive
• Drupal and Joomla are detected and logged; CVE coverage is provided by Nuclei templates and ZAP rather than abandoned dedicated scanners
• Bot blocker validation fetches live bad-bot lists from mitchellkrogza/nginx-ultimate-bad-bot-blocker at runtime and samples 50 random entries per bad-bot category; the full whitelist-ua.list and whitelist-ip.list from kpirnie-me/bots-for-scanner are fetched and tested in their entirety (no sampling) to guarantee no false positives are missed
• All Go-based tools are compiled in a separate builder stage; only binaries are copied to the final image, keeping image size lean

---

License

MIT © 2026 Kevin Pirnie