Skip to content

WebScan v2.6.0 — Risk Score + OWASP Compliance Mapping

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Jun 00:14
v2.6.0
27fd093

WebScan v2.6.0 — Risk Score + OWASP Compliance Mapping

🎯 Killer features

Two enterprise-grade features that make WebScan competitive with commercial DAST tools.

1. Risk Score (0-100, like SSL Labs)

A single number that summarises the security posture of the scanned target. No other open-source DAST tool has this — Nuclei, ZAP, Nikto all leave you to triage findings manually.

webscan -t https://example.com --risk-score
  Risk score   : 62/100 (C)
                Moderate risk — several medium/high issues. Prioritise remediation this week.

How it works:

  • Starts at 100 (perfect), reduced by each finding
  • Formula: severity × confidence × exposure × diminishing-returns
  • Critical = -25 pts, High = -12, Medium = -5, Low = -1.5, Info = -0.2
  • FIRM findings weigh 100%, TENTATIVE 60%, INFORMATIONAL 20%
  • Findings on root URL (/) weigh 30% more (exposure multiplier)
  • Diminishing returns: each subsequent finding weighs 5% less (floor 30%) — prevents "death by a thousand cuts"

Grading:

Score Grade Meaning
90-100 A 🟢 Excellent — no critical/high issues
75-89 B 🔵 Good — a few medium issues
55-74 C 🟡 Moderate — several medium/high
30-54 D 🟠 High risk — critical or multiple high
0-29 F 🔴 Critical — immediate remediation

CI gate:

# Block deployment if risk score < 70
webscan -t https://staging.example.com --fail-on-risk 70
echo $?  # 1 if score < 70, 0 if OK

2. OWASP Top 10 2021 Compliance Mapping

Enterprises need to show OWASP Top 10 coverage for security audits. Now WebScan produces a compliance dashboard out of the box.

webscan -t https://example.com --compliance
  Compliance   : OWASP Top 10 2021
  Category                                    Findings  Severity breakdown
  ─────────────────────────────────────────── ────────  ──────────────────────────────
  A03 Injection                                      2  1 critical, 1 high
  A05 Security Misconfiguration                      4  3 high, 1 medium
  A02 Cryptographic Failures                         1  1 high

  Clean (no findings): A04 Insecure Design, A06 Vulnerable Components, ...

Plugin → OWASP mapping:

OWASP Category WebScan plugins
A01 Broken Access Control idor, mass_assignment, csrf, cookies, clickjacking
A02 Cryptographic Failures ssl_tls, jwt_audit, secrets
A03 Injection sql_injection, xss, ssti, lfi_rfi, xxe, path_traversal, graphql_depth, prototype_pollution
A05 Security Misconfiguration headers, cors, config_files, directories, backup_files, http_methods, security_txt, robots_sitemap, verbose_errors, file_upload, websocket_security, web_cache_deception, cache_poisoning, host_header_injection, request_smuggling, race_condition
A06 Vulnerable Components cve_lookup, tech_fingerprint
A07 Auth Failures jwt_audit, cookies
A10 SSRF ssrf, subdomains

compliance_gap_analysis() also shows which categories were tested but came back clean — useful for audit reports.

📊 Numbers

  • 38 plugins (unchanged)
  • 887 tests passed (+29 new for risk + compliance)
  • 97% coverage (risk.py: 100%, compliance.py: 98%)
  • 63 source files (added webscan/risk.py + webscan/compliance.py)
  • ruff clean, mypy --strict clean
  • CI passing on Python 3.10 / 3.11 / 3.12

📦 New files

  • webscan/risk.py — risk scoring engine (71 lines, 100% coverage)
  • webscan/compliance.py — OWASP Top 10 2021 mapping (56 lines, 98% coverage)
  • tests/test_risk_compliance.py — 29 tests covering all scoring + mapping logic

🔧 New CLI flags

Flag Description
--risk-score Print 0-100 risk score + letter grade after scan
--fail-on-risk N Exit code 1 if score < N (CI gate)
--compliance Print OWASP Top 10 2021 compliance table

⬆️ Upgrade

pip install --upgrade webscan-security==2.6.0

📋 Why these are killer features

Risk score — a single number that summarises security posture. Executives love it. CI pipelines can use --fail-on-risk 70 to block bad deployments. No other open-source DAST tool has this.

Compliance mapping — enterprises must show OWASP Top 10 coverage for audits (PCI-DSS, ISO 27001, SOC 2). Now WebScan produces this automatically. Commercial tools charge $10,000+/year for equivalent functionality.

Assets 2
Loading