HackDev-WebScan

Modular web application vulnerability scanner — crawler, XSS, SQLi (error-based + blind time-based), SSTI, open redirect, CORS misconfiguration, cookie security, and missing security headers. Part of the HackDev cybersecurity toolkit.

HackDev-WebScan crawls a target site (bounded depth/page count), discovers query parameters and HTML forms across every page it finds, and runs a configurable set of vulnerability modules against every discovered injection point — all with configurable concurrency, rate limiting, and structured JSON output for pipelining into other tools.

Features

• Same-origin crawler — discovers additional in-scope pages and HTML forms (bounded by --max-pages/--max-depth) so the scanner isn't limited to exactly the one URL given
• Reflected XSS probe — injects benign marker payloads and detects unescaped reflection
• SQL injection — two independent techniques:
  • Error-based: injects common trigger characters, matches the response against a signature library covering MySQL, PostgreSQL, MSSQL, SQLite, and Oracle error messages
  • Blind/time-based: sends a SLEEP/pg_sleep-style payload and measures response time against a baseline; requires the delay to reproduce on a second independent attempt before reporting, to rule out ordinary network jitter
• SSTI probe — injects arithmetic marker expressions ({{7*7}}, ${7*7}, <%= 7*7 %>, etc.) covering Jinja2/Twig, FreeMarker/JSP EL, ERB, and Thymeleaf syntax, and confirms the expression was actually evaluated (not just echoed back) before reporting
• Open redirect probe — auto-detects redirect-like parameters (redirect, url, next, return, dest, etc.), checks both the raw Location header and the final URL after following the redirect chain
• CORS misconfiguration checker — sends a crafted Origin header and flags reflection combined with Access-Control-Allow-Credentials: true as high severity
• Cookie security audit — flags any Set-Cookie missing Secure/HttpOnly/SameSite
• Security headers audit — flags missing Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy
• Plugin architecture — every module self-registers via @register_module; enable/disable individually with --modules xss,sqli,ssti
• Multi-target scanning — scan a single URL or a whole file of URLs via --url-list
• Concurrent + rate-limited — ThreadPoolExecutor-based concurrency with a sleep-based throttle
• Structured findings — every finding has url, type, severity, param, payload, evidence, and detail, ready for JSON output and downstream tooling

Installation

git clone https://github.com/raghubirrajmahato15/HackDev-WebScan.git
cd HackDev-WebScan
pip install -r requirements.txt

Requires Python 3.10+, httpx, and beautifulsoup4 (for the crawler's HTML parsing).

Usage

Full scan (crawl + all modules) of a target with a seed query parameter:

python webscan.py "https://example.com/search?q=test"

Only run specific modules, skip the crawler, explicit extra parameters:

python webscan.py "https://example.com/profile?id=1" --no-crawl --modules sqli,xss --params ref

Scan a list of URLs from a file, verbose logging, 16 threads, a rate cap, JSON to a file:

python webscan.py --url-list targets.txt -v --threads 16 --rate 5 --format json -o results.json

Deeper crawl for a larger site:

python webscan.py "https://example.com/" --max-pages 100 --max-depth 3

CLI flag reference

Flag	Description	Default
url	Target URL to scan (positional)	—
--url-list FILE	File of additional target URLs (one per line)	—
--params P1,P2	Extra parameter names to test on every URL	auto-detected
--modules mod1,mod2	Comma-separated modules to run	all
--no-crawl	Disable the crawler; only scan the given URL(s)	off
--max-pages N	Max pages the crawler visits	25
--max-depth N	Max link-hop depth for the crawler	2
-o, --output	Write output to this file instead of stdout	stdout
--format {text,json}	Output format	text
-v, --verbose	Enable verbose (debug) logging	off
--threads N	Concurrency level (worker threads)	8
--timeout N	Per-request timeout, in seconds	10
--rate N	Max requests per second, 0 = unlimited	0
--version	Show the program's version and exit	—

Exit codes: 0 = scan completed with no findings, 2 = scan completed and findings were reported.

Project layout

webscan.py                 Thin CLI entrypoint
hackdev_webscan/
  core.py                   Finding/ScanContext/InjectionPoint models, plugin registry, HTTP helpers
  crawler.py                 Bounded same-origin crawler (pages + forms)
  cli.py                      argparse wiring, injection-point discovery, orchestration
  modules/
    headers.py, cookies.py, cors.py    Passive checks (single request, no injection)
    xss.py, sqli.py, ssti.py, redirect.py   Active injection-based probes
tests/                      pytest suite (see below)

Testing

pip install -r requirements-dev.txt
pytest -q

The suite includes a small, deliberately-vulnerable local HTTP server (tests/conftest.py) implementing one real flaw per route — unescaped XSS reflection, a MySQL-style SQL error, a SLEEP()-based blind-SQLi delay, an evaluated {{7*7}} SSTI expression, an open redirect, a reflected-Origin CORS misconfiguration, and a flagless cookie. Every module is run against this real server (not a mock) and the tests assert the actual findings produced, which is the real proof each detection technique works — including the blind-timing SQLi module correctly distinguishing a genuinely slow endpoint from noise.

Legal

This tool is intended for authorized security testing only — against systems you own, or for which you have obtained explicit written permission to test. Running vulnerability probes (XSS, SQLi, SSTI, header enumeration, redirect testing, CORS probing) against systems without authorization may violate computer misuse laws in your jurisdiction. The authors and contributors accept no liability for misuse or damage caused by this tool. Always operate within the scope of an agreed engagement or bug bounty program.