# andy25x/web-vuln-scanner architecture

> Architecture diagram of the GitHub repository andy25x/web-vuln-scanner, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/andy25x/web-vuln-scanner
- Repository: https://github.com/andy25x/web-vuln-scanner

## Overview

web-vuln-scanner is a command-line web vulnerability scanner. Its main workflow takes a target and scan options, fingerprints and crawls the site, runs concurrent vulnerability checks over the discovered URLs and forms, then presents findings and writes reports. The checks cover injection, security headers, sensitive paths, CSRF, HTTPS, and information disclosure. The runner excerpt is partial and the tree omits the README’s described checks/base.py, so the shared check model is not represented as a source node; some runner-to-check wiring is documented rather than visible in the excerpt.

Main entry points: [`scanner/runner.py`](https://github.com/andy25x/web-vuln-scanner/blob/main/scanner/runner.py) (Scan orchestrator), [`main.py`](https://github.com/andy25x/web-vuln-scanner/blob/main/main.py) (CLI options), [`scanner/http.py`](https://github.com/andy25x/web-vuln-scanner/blob/main/scanner/http.py) (URL and form crawler), [`config.py`](https://github.com/andy25x/web-vuln-scanner/blob/main/config.py) (Scan settings)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["Scan entry"]
  node_cli["CLI options<br/>[main.py]"]
  node_config["Scan settings<br/>[config.py]"]
  node_runner["Scan orchestrator<br/>[runner.py]"]
end

subgraph group_discovery["Site discovery"]
  node_fingerprint["Fingerprinting<br/>[http.py]"]
  node_crawler["URL and form crawler<br/>[http.py]"]
end

subgraph group_checks["Security checks"]
  node_sqli["SQL injection<br/>[sqli.py]"]
  node_xss["Reflected XSS<br/>[xss.py]"]
  node_headers["Header checks<br/>[headers.py]"]
  node_dirs["Sensitive path checks<br/>[dirs.py]"]
  node_misc["CSRF, HTTPS, disclosure<br/>[misc.py]"]
end

subgraph group_results["Findings and reports"]
  node_report["HTML and JSON reports<br/>[runner.py]"]
end

node_user(("Scanner user"))
node_target(("Target web app"))
node_output["Report files"]
node_terminal["Terminal summary"]

node_user -->|"provides target"| node_cli
node_cli -->|"reads defaults"| node_config
node_cli -->|"starts scan"| node_runner
node_runner -->|"fingerprints target"| node_fingerprint
node_runner -->|"crawls target"| node_crawler
node_fingerprint -->|"requests page"| node_target
node_crawler -->|"fetches pages"| node_target
node_runner -.->|"runs check"| node_sqli
node_runner -.->|"runs check"| node_xss
node_runner -.->|"runs check"| node_headers
node_runner -.->|"runs check"| node_dirs
node_runner -.->|"runs check"| node_misc
node_crawler -->|"provides URLs, forms"| node_runner
node_runner -->|"formats findings"| node_report
node_cli -->|"requests report"| node_report
node_report -->|"writes files"| node_output
node_cli -->|"prints summary"| node_terminal

click node_cli "https://github.com/andy25x/web-vuln-scanner/blob/main/main.py"
click node_config "https://github.com/andy25x/web-vuln-scanner/blob/main/config.py"
click node_runner "https://github.com/andy25x/web-vuln-scanner/blob/main/scanner/runner.py"
click node_fingerprint "https://github.com/andy25x/web-vuln-scanner/blob/main/scanner/http.py"
click node_crawler "https://github.com/andy25x/web-vuln-scanner/blob/main/scanner/http.py"
click node_sqli "https://github.com/andy25x/web-vuln-scanner/blob/main/scanner/checks/sqli.py"
click node_xss "https://github.com/andy25x/web-vuln-scanner/blob/main/scanner/checks/xss.py"
click node_headers "https://github.com/andy25x/web-vuln-scanner/blob/main/scanner/checks/headers.py"
click node_dirs "https://github.com/andy25x/web-vuln-scanner/blob/main/scanner/checks/dirs.py"
click node_misc "https://github.com/andy25x/web-vuln-scanner/blob/main/scanner/checks/misc.py"
click node_report "https://github.com/andy25x/web-vuln-scanner/blob/main/scanner/runner.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_config,node_runner,node_user toneBlue
class node_fingerprint,node_crawler toneAmber
class node_sqli,node_xss,node_headers,node_dirs,node_misc toneMint
class node_report toneRose
class node_target,node_output,node_terminal toneIndigo
```

## Components

### Scan entry

- [CLI options](https://github.com/andy25x/web-vuln-scanner/blob/main/main.py): `main.py`
- [Scan settings](https://github.com/andy25x/web-vuln-scanner/blob/main/config.py): `config.py`
- [Scan orchestrator](https://github.com/andy25x/web-vuln-scanner/blob/main/scanner/runner.py): `scanner/runner.py`

### Site discovery

- [Fingerprinting](https://github.com/andy25x/web-vuln-scanner/blob/main/scanner/http.py): `scanner/http.py`
- [URL and form crawler](https://github.com/andy25x/web-vuln-scanner/blob/main/scanner/http.py): `scanner/http.py`

### Security checks

- [SQL injection](https://github.com/andy25x/web-vuln-scanner/blob/main/scanner/checks/sqli.py): `scanner/checks/sqli.py`
- [Reflected XSS](https://github.com/andy25x/web-vuln-scanner/blob/main/scanner/checks/xss.py): `scanner/checks/xss.py`
- [Header checks](https://github.com/andy25x/web-vuln-scanner/blob/main/scanner/checks/headers.py): `scanner/checks/headers.py`
- [Sensitive path checks](https://github.com/andy25x/web-vuln-scanner/blob/main/scanner/checks/dirs.py): `scanner/checks/dirs.py`
- [CSRF, HTTPS, disclosure](https://github.com/andy25x/web-vuln-scanner/blob/main/scanner/checks/misc.py): `scanner/checks/misc.py`

### Findings and reports

- [HTML and JSON reports](https://github.com/andy25x/web-vuln-scanner/blob/main/scanner/runner.py): `scanner/runner.py`

### Other components

- **Scanner user**
- **Target web app**
- **Report files**
- **Terminal summary**

## Connections

- Scanner user → CLI options: provides target (evidence: `README.md`)
- CLI options → Scan settings: reads defaults (evidence: `main.py`)
- CLI options → Scan orchestrator: starts scan (evidence: `main.py`)
- Scan orchestrator → Fingerprinting: fingerprints target (evidence: `scanner/runner.py`)
- Scan orchestrator → URL and form crawler: crawls target (evidence: `scanner/runner.py`)
- Fingerprinting → Target web app: requests page (evidence: `scanner/http.py`)
- URL and form crawler → Target web app: fetches pages (evidence: `scanner/http.py`)
- Scan orchestrator → SQL injection: runs check (evidence: `README.md`)
- Scan orchestrator → Reflected XSS: runs check (evidence: `README.md`)
- Scan orchestrator → Header checks: runs check (evidence: `README.md`)
- Scan orchestrator → Sensitive path checks: runs check (evidence: `README.md`)
- Scan orchestrator → CSRF, HTTPS, disclosure: runs check (evidence: `README.md`)
- URL and form crawler → Scan orchestrator: provides URLs, forms (evidence: `scanner/runner.py`)
- Scan orchestrator → HTML and JSON reports: formats findings (evidence: `scanner/runner.py`)
- CLI options → HTML and JSON reports: requests report (evidence: `main.py`)
- HTML and JSON reports → Report files: writes files (evidence: `README.md`)
- CLI options → Terminal summary: prints summary (evidence: `main.py`)