How congtuan2503/vulnscanner works
VulnScanner is a command-line web reconnaissance scanner. A user supplies a target and scan options; main.py runs HTTP security-header checks and recursive, multithreaded path discovery, summarizes findings, and optionally generates an HTML report. The fuzzer reads a wordlist, checks catch-all behavior, and can compare response hashes or sizes to reduce false positives. The README also describes API, framework, and DevOps path discovery as wordlist coverage. Implementation detail beyond the sampled files is not inferred.
Main entry points: main.py Scan coordinator · fuzzer.py Recursive path fuzzer · scanner.py Header analysis · reporter.py HTML report generator
Components 14
CLI orchestration
- Scan coordinator
main.py
Scanning and discovery
- Header analysis
modules/scanner.py - Recursive path fuzzer
modules/fuzzer.py - Catch-all detection
modules/fuzzer.py - Path probing
modules/fuzzer.py - Header findings
modules/scanner.py - Discovered assets
modules/fuzzer.py
Reporting
- HTML report generator
modules/reporter.py - Report template
templates/report_template.html - HTML report output
report.html
Scan inputs
- Common path wordlist
wordlists/common.txt
Other components
- Security researcher
- Target web application
- Terminal output
Connections 18
- Security researcher → Scan coordinator: configures and starts
- Scan coordinator → Header analysis: calls header check
- Scan coordinator → Recursive path fuzzer: starts fuzzing
- Header analysis → Target web application: requests headers
- Header analysis → Header findings: produces findings
- Scan coordinator → Header findings: reads results
- Recursive path fuzzer → Catch-all detection: checks baseline
- Catch-all detection → Target web application: probes fake path
- Recursive path fuzzer → Common path wordlist: reads paths
- Recursive path fuzzer → Path probing: dispatches probes
- Path probing → Target web application: requests paths
- Path probing → Discovered assets: classifies responses
- Recursive path fuzzer → Discovered assets: collects results
- Scan coordinator → Discovered assets: reads results
- Scan coordinator → Terminal output: prints summary
- Scan coordinator → HTML report generator: generates report
- HTML report generator → Report template: renders template
- HTML report generator → HTML report output: writes HTML