How nimaturana/vulnhunter works
VulnHunter is an authorized web-security assessment MVP. An API client submits a scan and selected detectors; the scan service runs them in FastAPI background tasks, combines findings into scan results, and exposes status, history, statistics, and PDF reports. It keeps live scans in memory and attempts to persist scan metadata and findings to PostgreSQL. Documented detector capabilities include XSS, SQL injection, security headers, TLS, and directory exposure. The frontend, authentication, and worker queue are future work, not active runtime components. Some detector and report wiring is documented but their source was not sampled.
Main entry points: service.py Scan Service · routes.py Scan Endpoints · router.py API Router · main.py FastAPI App
Components 19
API and Status
- FastAPI App
backend/vulnhunter/main.py - API Router
backend/vulnhunter/router.py - Scan Endpoints
backend/vulnhunter/scans/routes.py - System Endpoints
backend/vulnhunter/system/routes.py
Scan Workflow
- Scan Service
backend/vulnhunter/scans/service.py - Scan Models
backend/vulnhunter/scans/models.py - Risk Assessment
backend/vulnhunter/scans/risk.py
Security Detectors
- Directory Scanner
backend/vulnhunter/scanners/directory_scanner.py - Headers Scanner
backend/vulnhunter/scanners/security_headers_scanner.py - SQL Injection Scanner
backend/vulnhunter/scanners/sql_injection_scanner.py - XSS Scanner
backend/vulnhunter/scanners/xss_scanner.py - TLS Scanner
backend/vulnhunter/scanners/ssl_scanner.py
Results and Reports
- In-Memory Scans
backend/vulnhunter/scans/service.py - Database Connection
backend/vulnhunter/database/connection.py - Scan CRUD
backend/vulnhunter/database/crud.py - Database Models
backend/vulnhunter/database/models.py - PostgreSQL
- PDF Generator
backend/vulnhunter/reports/pdf_generator.py
Other components
- API Client
Connections 20
- API Client → FastAPI App: sends requests
- FastAPI App → API Router: mounts routes
- API Router → Scan Endpoints: dispatches scans
- API Router → System Endpoints: dispatches status
- Scan Endpoints → Scan Service: creates and queries
- Scan Endpoints → Scan Service: schedules scan
- Scan Service → Scan Models: uses models
- Scan Service → In-Memory Scans: reads and writes
- Scan Service → Directory Scanner: dispatches scan
- Scan Service → Headers Scanner: dispatches scan
- Scan Service → SQL Injection Scanner: dispatches scan
- Scan Service → XSS Scanner: dispatches scan
- Scan Service → TLS Scanner: dispatches scan
- System Endpoints → Scan Service: reads statistics
- Scan Service → Database Connection: opens session
- Scan Service → Scan CRUD: saves scan results
- Scan CRUD → Database Models: uses mappings
- Database Connection → PostgreSQL: connects
- Scan Service → PDF Generator: generates report
- Scan Endpoints → API Client: returns results