Skip to content

Releases: RanaKhan77/Website-Vulnerability-Scanner

Release list

v2.0.0 — One-command install, threat-intel modules, FP-hardening waves

v2.0.0 — One-command install, threat-intel modules, FP-hardening waves Latest
Latest

Choose a tag to compare

View all tags
@RanaKhan77 RanaKhan77 released this 16 Oct 17:35
v2.0.0
007c4ba

The short version

One command installs the full stack. Wordfence + Shodan InternetDB intel landed. Three waves of false-positive hardening shipped. The engine stayed 100% deterministic — still zero AI, zero API keys required.

git clone https://github.com/RanaKhan77/Website-Vulnerability-Scanner.git
cd Website-Vulnerability-Scanner && ./install.sh

🆕 New since v1.0.0

  • One-command installer (./install.sh) — auto-generated passwords, full Docker stack build, migrations, admin bootstrap
  • Wordfence Intelligence v3 local mirror — WordPress vuln feed as a first-class local corpus + scanners:refresh-wordfence command
  • ip_reputation v2.0.0 — Shodan InternetDB keyless intel: open ports, CPEs, tags, known vulns per IP
  • AtDork dork corpora for WordPress/Joomla content discovery
  • GitHub Action published — 2mny-security-scan + demo workflow in-repo
  • Animated README banners — live attack-surface globe + evidence-card scan demo (pure SVG)

⬆️ Module upgrades

Module Version What changed
js_secret_extraction 1.7.0 h5i disclosure taxonomy + Mapbox token patterns
sensitive_paths 2.15.0 expanded exposure paths
wp_plugin_vuln 2.1.0 Wordfence-mirror enrichment
ip_reputation 2.0.0 Shodan InternetDB keyless intel
idor 2.0.0 auth-aware differential testing
rate_limit 1.9.0 FP-accuracy tuning
content_anomaly 1.3.0 FP-accuracy tuning
nikto 2.1.0 robots.txt soft-404 re-verification
live secret verification (gitleaks / js_secret / open_dir) — findings now re-verified live before reporting

🎯 Accuracy engineering (three sync waves)

  • 25-module false-positive hardening pass (thresholds, baselines, re-verification)
  • 12 scanners pinned to explicit deep scan-type (no behavior change, clearer gating)
  • Ownership-gated intrusive tests unchanged: deep tests still only run on sites you prove you own
  • Honest counts pass: community edition pinned to 200 shipping modules (every one in this repo, every one enabled)

📚 Also

  • Contributor Covenant, Hacktoberfest 2026 notes, GitHub Sponsors + Support section
  • Cross-link to Awesome Cyber Security Heaven — 438 license-verified free tools across 14 realms, now with 425 pages of deep-research PDF dossiers

Full history: see CHANGELOG.md and the commit list below.

Assets 2
Loading

v1.0.0 — First Public Release

v1.0.0 — First Public Release

Choose a tag to compare

View all tags
@RanaKhan77 RanaKhan77 released this 11 Oct 06:35
v1.0.0
628cd18

The largest fully-deterministic, self-hostable web vulnerability scanning suite ever open-sourced.

What this is

Point it at a domain and get an evidence-backed, CVSS-scored, remediation-ready security report — generated entirely from your own server. 200 deterministic scanner modules, zero AI at scan time: no API keys, no token billing, no vendor lock, works air-gapped.

Highlights

  • 200 scanner modules — every one ships in this repo, every one enabled
  • Ownership-gated intrusive testing (43 modules) — deep tests only run on sites you prove you own
  • Report engine — HTML + PDF, internal (technical) and customer (redacted) variants
  • Continuous monitoring — page watches, attack-surface diffing, scheduled rescans
  • Tor routing fallback + engine-independent dork semantics for search-engine-blocked targets
  • AI-exposure detection — while we use no AI, 8 dedicated modules fingerprint exposed AI stacks on your targets (LLM gateways, agent panels, vector DBs, leaked API keys)

Quick start (≈10 minutes)

git clone https://github.com/RanaKhan77/Website-Vulnerability-Scanner.git
cd Website-Vulnerability-Scanner
cp .env.example .env && nano .env
docker compose --project-directory . -f docker/docker-compose.yml up -d --build
docker compose --project-directory . -f docker/docker-compose.yml exec app composer install --no-dev
docker compose --project-directory . -f docker/docker-compose.yml exec app php artisan key:generate
docker compose --project-directory . -f docker/docker-compose.yml exec app php artisan migrate --seed
docker compose --project-directory . -f docker/docker-compose.yml exec app php artisan admin:create

Then open http://localhost:8080, add a website under Admin → Websites and hit Scan Now.

Full documentation: README · Tool Matrix · INSTALL.md

Stack

PHP 8.4 · Laravel 12 · MySQL 8 · Redis · Docker (app + worker + scheduler + nginx) · nuclei · nmap · nikto

License

Apache 2.0 — see LICENSE.

Read the launch story on our blog: 2MNY Website Vulnerability Scanner Is Now Open Source

Loading