Web Vulnerability Scanner

A modular, multi-threaded web vulnerability scanner with a Flask web UI. Scans a target URL for common web vulnerabilities using pluggable detection modules, running checks concurrently and polling for live status/results.

Features

• Concurrent scanning engine (ThreadPoolExecutor) that runs multiple vulnerability modules in parallel
• Detection modules for:
  • SQL Injection (SQLi)
  • Cross-Site Scripting (XSS)
  • Cross-Site Request Forgery (CSRF)
  • Directory Traversal
  • Server-Side Request Forgery (SSRF)
  • Remote Code Execution (RCE)
• REST API for starting scans, polling status, and fetching results
• Web UI for submitting a target and viewing results

Tech Stack

• Python, Flask
• requests, beautifulsoup4 (HTTP + HTML parsing)
• pyOpenSSL

Setup

git clone https://github.com/zulqarnain2004/Web-Vulnerability-Scanner.git
cd Web-Vulnerability-Scanner/web_vuln_scanner
pip install -r requirements.txt
python app.py

Then open http://localhost:5000 in your browser.

API

• POST /scan — body: { "target": "https://example.com", "scan_types": ["xss", "sqli"] } — starts a background scan, returns a scan_id
• GET /scan/status?scan_id=... — returns current scan status and progress
• GET /scan/results?scan_id=... — returns findings for a completed scan

Project Structure

web_vuln_scanner/ ├── app.py # Flask routes ├── scanner/ │ ├── core.py # Scan orchestration (thread pool, status tracking) │ ├── utils.py │ └── modules/ │ ├── xss.py │ ├── sqli.py │ ├── csrf.py │ ├── directory_traversal.py │ ├── ssrf.py │ └── rce.py ├── templates/ ├── static/ └── requirements.txt

Disclaimer

For educational and authorized security testing only. Only scan targets you own or have explicit permission to test.

License

MIT