🛡️ Basic Web Vulnerability Scanner

A lightweight Python scanner that checks web applications for common OWASP Top 10 style issues — missing security headers, exposed sensitive files, SQL Injection indicators, and Reflected XSS.

⚠️ Disclaimer: This tool is built for educational purposes and authorized security testing only. Scanning applications/systems you don't own or without explicit permission is illegal in most countries, including Pakistan under the Prevention of Electronic Crimes Act (PECA) 2016. Only use this against systems you own or have written permission to test, such as intentionally vulnerable apps like DVWA or bWAPP.

---

✨ Features

• Security header checks — flags missing headers like X-Frame-Options, Content-Security-Policy, Strict-Transport-Security, etc.
• Sensitive path discovery — checks for commonly exposed files (.env, .git/config, backup files, phpinfo.php, etc.)
• SQL Injection detection — sends common SQLi payloads and analyzes responses for database error signatures
• Reflected XSS detection — tests input parameters with script payloads and checks whether they're reflected unescaped
• Supports authenticated scanning via session cookies

---

🛠️ Requirements

• Python 3.7+
• requests library (pip install requests)
• A target application to test — this project was built and tested against DVWA running locally via Docker

---

🚀 Usage

Clone the repository:

git clone https://github.com/rayan-407/Vulnerability-Scanner.git
cd Vulnerability-Scanner

Install dependencies:

pip3 install requests --break-system-packages

Basic scan (headers + exposed paths)

python3 vuln_scanner.py http://localhost

Authenticated scan with SQL Injection test

python3 vuln_scanner.py http://localhost \
  --cookie "PHPSESSID=your_session_id; security=low" \
  --sqli-url "http://localhost/vulnerabilities/sqli/" \
  --sqli-param id

Authenticated scan with XSS test

python3 vuln_scanner.py http://localhost \
  --cookie "PHPSESSID=your_session_id; security=low" \
  --xss-url "http://localhost/vulnerabilities/xss_r/" \
  --xss-param name

Options

Flag	Description
url	Base target URL (required)
--cookie	Session cookie string for authenticated scans
--sqli-url	Full URL of a page with a testable parameter for SQLi
--sqli-param	Parameter name to test for SQLi (default: id)
--xss-url	Full URL of a page with a testable parameter for XSS
--xss-param	Parameter name to test for XSS (default: name)

---

📊 Sample Output

============================================================
Scanning target: http://localhost
============================================================

[*] Checking security headers...
  [!] Missing header: X-Frame-Options
  [!] Missing header: Content-Security-Policy

[*] Checking for exposed sensitive files/paths...
  [!] Accessible: http://localhost/phpinfo.php (status 200)

[*] Testing SQL Injection on 'id' at http://localhost/vulnerabilities/sqli/
  [!] Possible SQLi with payload: ' OR 1=1--

[*] Testing Reflected XSS on 'name' at http://localhost/vulnerabilities/xss_r/
  [!] Payload reflected unescaped: <script>alert(1)</script>

============================================================
Scan complete.
============================================================

---

📚 How It Works

• Header checks compare the response headers against a list of recommended security headers.
• SQLi detection sends payloads like ' OR 1=1-- and checks the response body for common database error signatures (e.g. MySQL syntax errors).
• XSS detection sends script-based payloads and checks whether they appear unescaped in the response — indicating the application doesn't sanitize user input before rendering it.

This is a detection-based scanner, not an exploitation framework — it flags potential issues for manual verification, which mirrors how real-world vulnerability scanners (like Nikto or basic Burp Suite scans) operate at a foundational level.

---

🔮 Future Improvements

• Add support for POST-based form testing
• Blind/time-based SQLi detection
• Stored XSS detection across multiple pages
• Export results to JSON/HTML report
• Multi-threaded scanning for faster results

---

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

---

👤 Author

Rayan - Cybersecurity enthusiast learning through hands-on projects.

Check out my other projects:

• Password Strength Checker
• Port Scanner
• Packet Sniffer