Skip to content

WebScan v2.7.0 — 6 Killer Features

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Jun 00:47
v2.7.0
b6dbaa6

WebScan v2.7.0 — 6 Killer Features

🎯 6 new features that no other open-source DAST tool has

1. Diff Mode — CI Regression Detection

webscan diff baseline.json current.json --fail-on-new

Compares two scan reports: shows new (regressions), fixed (improvements), and changed (severity shifts) findings. --fail-on-new exits 1 if any new CRITICAL/HIGH appeared — perfect CI gate.

2. Webhook Notifications — Slack/Discord/Teams

webscan -t https://example.com --webhook-url https://hooks.slack.com/services/...

Auto-detects webhook type from URL. Sends scan summary with risk score, severity breakdown, and top 3 findings. Works with Slack, Discord, Microsoft Teams, and generic HTTP endpoints.

3. Auto-Fix Suggestions — Copy-Paste Remediation

webscan -t https://example.com --suggest-fixes

For each finding, generates a concrete, copy-paste-ready fix: nginx config, Python code, or shell command. Covers 11 plugin types (headers, CORS, cookies, SSL/TLS, SQLi, XSS, secrets, etc.). No other scanner does this.

4. DNS Security Audit — DNSSEC/CAA/SPF/DMARC/DKIM

New plugin dns_security — checks DNS security records that no other DAST scanner covers:

  • SPF — email sending policy (missing = spoofable domain)
  • DMARC — email auth enforcement (missing = no SPF/DKIM enforcement)
  • CAA — which CAs can issue certificates (missing = any CA)
  • DKIM — email signing (checks common selectors)

5. CSP Deep Analyzer — Semantic Content-Security-Policy Analysis

New plugin csp_analyzer — goes beyond "header present/absent":

  • Detects 'unsafe-inline' and 'unsafe-eval' in script-src
  • Flags wildcard * in any *-src directive
  • Checks for missing object-src, base-uri, frame-ancestors, report-uri
  • Provides specific remediation per issue

6. WAF Detection — Fingerprint Web Application Firewalls

New plugin waf_detect — detects and fingerprints WAFs:

  • Cloudflare, AWS CloudFront, Akamai, Imperva/Incapsula, Sucuri, F5 BIG-IP, ModSecurity, Wordfence, Fastly, Varnish, Azure Front Door
  • Sends SQLi probe to check if WAF blocks it
  • Helps interpret scan results (WAFs cause false negatives)

📊 Numbers

  • 41 plugins (was 38 — added dns_security, csp_analyzer, waf_detect)
  • 925 tests passed (+38 new)
  • 69 source files (was 63 — added 6 new modules)
  • ruff clean, mypy --strict clean
  • CI passing on Python 3.10/3.11/3.12

📦 New files

File Description
webscan/diff.py Report comparison engine (94 lines)
webscan/notify.py Webhook notifications — Slack/Discord/generic (94 lines)
webscan/autofix.py Auto-fix suggestion engine (71 lines)
webscan/plugins/dns_security.py DNS security audit plugin
webscan/plugins/csp_analyzer.py Deep CSP analysis plugin
webscan/plugins/waf_detect.py WAF detection + fingerprinting plugin
tests/test_v270_killer.py 38 tests covering all new features

🔧 New CLI flags

Flag Description
--webhook-url URL Send scan summary to Slack/Discord/Teams
--suggest-fixes Print copy-paste-ready fix commands per finding
diff old.json new.json Compare two reports (subcommand)
diff --fail-on-new Exit 1 if new CRITICAL/HIGH findings appeared

⬆️ Upgrade

pip install --upgrade webscan-security==2.7.0

📋 Why these beat Nuclei/Nikto/Burp

Feature WebScan Nuclei Nikto Burp Suite
Risk score (0-100) ✅ ❌ ❌ ❌
OWASP compliance mapping ✅ ❌ ❌ ❌
AI triage (GLM 5.2) ✅ ❌ ❌ ❌
Diff mode (CI regression) ✅ ❌ ❌ ❌
Webhook notifications ✅ ❌ ❌ ❌
Auto-fix suggestions ✅ ❌ ❌ ❌
DNS security audit ✅ ❌ ❌ ❌
CSP deep analyzer ✅ ❌ ❌ ❌
WAF detection ✅ ❌ ❌ ❌
Price Free MIT Free MIT Free GPL $475/year
Assets 2
Loading