Web Application Vulnerability Scanner

A comprehensive web application vulnerability scanner with a graphical user interface, designed for educational purposes and ethical security testing. This tool helps identify common web vulnerabilities such as SQL Injection, Cross-Site Scripting (XSS), and Path Traversal.

⚠️ Disclaimer

This tool is for EDUCATIONAL PURPOSES and ETHICAL SECURITY TESTING ONLY.

• Only use this scanner on applications you have explicit permission to test
• Unauthorized scanning of websites may be illegal in your jurisdiction
• The authors are not responsible for any misuse of this software

🚀 Features

• User-friendly GUI for easy configuration and result analysis
• Multi-threaded scanning for improved performance
• Vulnerability detection for:
  • SQL Injection (SQLi)
  • Cross-Site Scripting (XSS)
  • Path Traversal
• Customizable scan options:
  • Custom payloads support
  • HTTP cookies and headers configuration
  • Adjustable thread count and timeout settings
• Comprehensive reporting with detailed vulnerability information
• Export functionality for scan results

📋 Requirements

• Python 3.6+
• Required Python packages:
  • requests>=2.28.0
  • urllib3>=1.26.0
  • beautifulsoup4>=4.11.0
  • tkinter (usually included with Python)
  • argparse (included in Python standard library)
  • typing (included in Python standard library)

🔧 Installation

1. Clone this repository or download the source code:

   git clone https://github.com/yourusername/vulnerability-scanner.git
   cd vulnerability-scanner
   

2. Install the required dependencies:

   pip install -r requirements.txt
   

🖥️ Usage

Starting the Application

Run the main script to launch the GUI:

python vuln_scanner_gui.py

Configuration Tab

1. Enter the target URL (e.g., http://example.com)
2. Select vulnerability types to scan for
3. Configure advanced options:
   • Max threads: Controls the number of concurrent scanning threads
   • Timeout: Maximum time to wait for HTTP responses
   • Verbose logging: Enable detailed logging during the scan
4. Set HTTP options (optional):
   • Cookies: Format as name1=value1; name2=value2
   • Headers: Format as name1: value1; name2: value2
5. Configure custom payloads (optional)
6. Click "Start Scan" to begin

Scan Progress Tab

• View real-time scan progress and statistics
• Monitor the log for detailed information
• Stop the scan at any time if needed

Results Tab

• Review discovered vulnerabilities in the table
• Double-click on a vulnerability to see detailed information
• Export results to JSON format for further analysis

🔍 How It Works

1. Crawling: The scanner crawls the target website to discover URLs and forms
2. Parameter Analysis: Each parameter in forms and URLs is tested with various payloads
3. Vulnerability Detection: Responses are analyzed for signs of successful exploitation
4. Reporting: Detected vulnerabilities are presented with detailed information

🛡️ Best Practices

• Always obtain proper authorization before scanning any website
• Start with a low thread count to avoid overwhelming the target
• Use the verbose logging option to understand the scanning process
• Review the results carefully to avoid false positives

🔄 Extending the Scanner

You can extend the scanner's capabilities by:

1. Adding custom payloads for existing vulnerability types
2. Implementing new vulnerability detection methods in the VulnerabilityScanner class
3. Enhancing the GUI with additional features

📝 License

This project is licensed under the MIT License - see the LICENSE file for details.

🤝 Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

📞 Support

For questions, issues, or feature requests, please open an issue in the GitHub repository.

---

Remember: This tool is meant for educational purposes and ethical security testing only. Always scan responsibly and with proper authorization.