How andy25x/web-vuln-scanner works
web-vuln-scanner is a command-line web vulnerability scanner. Its main workflow takes a target and scan options, fingerprints and crawls the site, runs concurrent vulnerability checks over the discovered URLs and forms, then presents findings and writes reports. The checks cover injection, security headers, sensitive paths, CSRF, HTTPS, and information disclosure. The runner excerpt is partial and the tree omits the README’s described checks/base.py, so the shared check model is not represented as a source node; some runner-to-check wiring is documented rather than visible in the excerpt.
Main entry points: runner.py Scan orchestrator · main.py CLI options · http.py URL and form crawler · config.py Scan settings
Components 15
Scan entry
- CLI options
main.py - Scan settings
config.py - Scan orchestrator
scanner/runner.py
Site discovery
- Fingerprinting
scanner/http.py - URL and form crawler
scanner/http.py
Security checks
- SQL injection
scanner/checks/sqli.py - Reflected XSS
scanner/checks/xss.py - Header checks
scanner/checks/headers.py - Sensitive path checks
scanner/checks/dirs.py - CSRF, HTTPS, disclosure
scanner/checks/misc.py
Findings and reports
- HTML and JSON reports
scanner/runner.py
Other components
- Scanner user
- Target web app
- Report files
- Terminal summary
Connections 17
- Scanner user → CLI options: provides target
README.md - CLI options → Scan settings: reads defaults
main.py - CLI options → Scan orchestrator: starts scan
main.py - Scan orchestrator → Fingerprinting: fingerprints target
scanner/runner.py - Scan orchestrator → URL and form crawler: crawls target
scanner/runner.py - Fingerprinting → Target web app: requests page
scanner/http.py - URL and form crawler → Target web app: fetches pages
scanner/http.py - Scan orchestrator → SQL injection: runs check
README.md - Scan orchestrator → Reflected XSS: runs check
README.md - Scan orchestrator → Header checks: runs check
README.md - Scan orchestrator → Sensitive path checks: runs check
README.md - Scan orchestrator → CSRF, HTTPS, disclosure: runs check
README.md - URL and form crawler → Scan orchestrator: provides URLs, forms
scanner/runner.py - Scan orchestrator → HTML and JSON reports: formats findings
scanner/runner.py - CLI options → HTML and JSON reports: requests report
main.py - HTML and JSON reports → Report files: writes files
README.md - CLI options → Terminal summary: prints summary
main.py