Does your website have vulnerabilities? If a hacker tells you first, it's too late. Web-Vuln-Scanner is a lightweight web vulnerability scanner in Python, ethics-first: it only scans targets you own or are explicitly authorized to test. It crawls the target, runs a set of independent checks, and produces a console plus JSON report.
Small sites get hit the hardest: one reflected XSS can steal user cookies, one SQL injection can dump the whole database. A professional pentest is expensive; cleaning up after a breach costs more. Scanning it yourself first and picking the low-hanging fruit is the cheapest security habit there is.
Four steps. First, the crawler: same-host only, collecting pages, links, forms, and URLs with parameters. Second, the checks: four independent modules — reflected XSS injects a unique token into params and watches for unescaped reflection; error-based SQLi fires quote payloads and matches error signatures from five database engines; the headers check flags missing security response headers; the sensitive-files prober knocks on .git, .env, /admin and similar paths. Third, the ethics gate: you must pass an explicit target, type SCAN to confirm, and optionally use an allowlist. Fourth, the report: console table plus JSON.
I ran it against the bundled vulnerable demo app: a Flask app on 127.0.0.1:5000. Results matched expectations — reflected XSS on /search, error-based SQLi on /user, and a pile of missing security headers. All four checks verified against the demo target.
Honest note: this is a scaffold v0.1 learning project, built alongside a cybersecurity master's program. Stored XSS, blind SQLi, CSRF, and authenticated scanning are NOT implemented — marked as TODOs, not claimed features. Only scan targets you own or are authorized to test; unauthorized scanning is illegal in most places. MIT licensed, link in the description. Run it against your test site and see the score. See you next time!
S6: Take a breather. The Chinese character 安 (peace) holds 'woman' under a 'roof' — with loved ones home, the heart is at peace. Cybersecurity guards exactly that peace. May God, the Creator of heaven and earth, bless the work of your hands.
S7: The Lord bless you and keep you. Numbers 6:24 Technology becomes outdated, but love never ends. May God bless you and your family. If this project helped you, please give it a Star and share it with more people.
Top comments (0)