mirror of
https://github.com/davidalvarezp/websec-audit.git
synced 2026-06-23 11:48:28 +02:00
v1.0.1
This commit is contained in:
davidalvarezp
@@ -0,0 +1,73 @@
|
||||
---
|
||||
name: Bug Report
|
||||
about: Report a bug or unexpected behaviour in websec-audit
|
||||
title: "[BUG] "
|
||||
labels: bug
|
||||
assignees: davidalvarezp
|
||||
---
|
||||
|
||||
## Description
|
||||
|
||||
<!-- A clear and concise description of the bug -->
|
||||
|
||||
## Steps to Reproduce
|
||||
|
||||
```bash
|
||||
# Exact command you ran (redact the target)
|
||||
./websec-audit.sh -t https://REDACTED --option
|
||||
```
|
||||
|
||||
1. Run the above command
|
||||
2. See error / unexpected behaviour in module: **[MODULE NAME]**
|
||||
|
||||
## Expected Behaviour
|
||||
|
||||
<!-- What you expected to happen -->
|
||||
|
||||
## Actual Behaviour
|
||||
|
||||
<!-- What actually happened. Include relevant log output below -->
|
||||
|
||||
<details>
|
||||
<summary>Log output (redact sensitive data)</summary>
|
||||
|
||||
```
|
||||
paste relevant log lines here
|
||||
```
|
||||
|
||||
</details>
|
||||
|
||||
## Environment
|
||||
|
||||
| Item | Details |
|
||||
|------|---------|
|
||||
| websec-audit version | `./websec-audit.sh -V` |
|
||||
| OS / Distro | e.g. Debian 12, Ubuntu 22.04, Kali 2024.1 |
|
||||
| Bash version | `bash --version` |
|
||||
| Affected tool | e.g. nmap, sqlmap, gobuster |
|
||||
| Tool version | e.g. `nmap --version` |
|
||||
|
||||
## Module
|
||||
|
||||
- [ ] Recon
|
||||
- [ ] Port Scan
|
||||
- [ ] Fingerprint
|
||||
- [ ] SSL/TLS
|
||||
- [ ] HTTP Headers
|
||||
- [ ] Dir/File Enum
|
||||
- [ ] Nikto
|
||||
- [ ] SQLi
|
||||
- [ ] XSS
|
||||
- [ ] CMS
|
||||
- [ ] CORS
|
||||
- [ ] Open Redirect
|
||||
- [ ] SSRF
|
||||
- [ ] Subdomain Takeover
|
||||
- [ ] Nuclei
|
||||
- [ ] Reporting
|
||||
- [ ] Install / Dependencies
|
||||
- [ ] Other
|
||||
|
||||
## Additional Context
|
||||
|
||||
<!-- Any other context, screenshots, or information that might help -->
|
||||
@@ -0,0 +1,42 @@
|
||||
---
|
||||
name: Feature Request
|
||||
about: Suggest a new module, option, or improvement
|
||||
title: "[FEAT] "
|
||||
labels: enhancement
|
||||
assignees: davidalvarezp
|
||||
---
|
||||
|
||||
## Summary
|
||||
|
||||
<!-- A concise one-sentence summary of what you'd like -->
|
||||
|
||||
## Problem / Motivation
|
||||
|
||||
<!-- What problem does this solve? What security gap does it address? -->
|
||||
|
||||
## Proposed Solution
|
||||
|
||||
<!-- Describe how you'd like it to work. Include example CLI usage if applicable -->
|
||||
|
||||
```bash
|
||||
# Example usage
|
||||
./websec-audit.sh -t https://target.com --new-option
|
||||
```
|
||||
|
||||
## Tools / Techniques Involved
|
||||
|
||||
<!-- What tools, techniques, or vulnerability classes would this cover? -->
|
||||
|
||||
## Alternatives Considered
|
||||
|
||||
<!-- Any alternative solutions or workarounds you've already explored -->
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
<!-- How would you verify the feature is working correctly? -->
|
||||
- [ ] ...
|
||||
- [ ] ...
|
||||
|
||||
## Additional Context
|
||||
|
||||
<!-- Links, CVEs, research papers, or other context that may be helpful -->
|
||||
@@ -0,0 +1,68 @@
|
||||
## Summary
|
||||
|
||||
<!-- One paragraph describing what this PR does and why -->
|
||||
|
||||
## Type of Change
|
||||
|
||||
- [ ] 🐛 Bug fix
|
||||
- [ ] ✨ New feature / module
|
||||
- [ ] 📝 Documentation update
|
||||
- [ ] ♻️ Refactor (no functional changes)
|
||||
- [ ] ⚡ Performance improvement
|
||||
- [ ] 🔧 Chore / maintenance
|
||||
|
||||
## Related Issue(s)
|
||||
|
||||
<!-- Closes #XXX | Fixes #XXX | Resolves #XXX -->
|
||||
|
||||
## Changes Made
|
||||
|
||||
<!-- List the key changes in bullet points -->
|
||||
-
|
||||
-
|
||||
-
|
||||
|
||||
## Module(s) Affected
|
||||
|
||||
- [ ] Recon
|
||||
- [ ] Port Scan
|
||||
- [ ] Fingerprint
|
||||
- [ ] SSL/TLS
|
||||
- [ ] HTTP Headers
|
||||
- [ ] Dir/File Enum
|
||||
- [ ] Nikto
|
||||
- [ ] SQLi
|
||||
- [ ] XSS
|
||||
- [ ] CMS
|
||||
- [ ] CORS
|
||||
- [ ] Open Redirect
|
||||
- [ ] SSRF
|
||||
- [ ] Subdomain Takeover
|
||||
- [ ] Nuclei
|
||||
- [ ] Reporting / Output
|
||||
- [ ] Install script
|
||||
- [ ] Documentation
|
||||
|
||||
## Testing
|
||||
|
||||
<!-- Describe how you tested this PR -->
|
||||
|
||||
```bash
|
||||
# Commands used to test
|
||||
./websec-audit.sh -t https://REDACTED --your-new-option
|
||||
```
|
||||
|
||||
- [ ] Tested on Debian / Ubuntu
|
||||
- [ ] Tested with `--aggressive` mode
|
||||
- [ ] Tested with `--stealth` mode
|
||||
- [ ] Tested with `--skip-<module>` to ensure skip works
|
||||
- [ ] `shellcheck -S warning websec-audit.sh` passes with zero warnings
|
||||
|
||||
## Checklist
|
||||
|
||||
- [ ] Code follows the style guidelines in [CONTRIBUTING.md](../CONTRIBUTING.md)
|
||||
- [ ] Self-review completed
|
||||
- [ ] New module added to `README.md` module table
|
||||
- [ ] `CHANGELOG.md` updated under `[Unreleased]`
|
||||
- [ ] No hardcoded credentials, IPs, or sensitive data
|
||||
- [ ] All findings go through `add_finding()` — not written directly to files
|
||||
@@ -0,0 +1,66 @@
|
||||
name: CI — Shell Quality Check
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main, develop]
|
||||
pull_request:
|
||||
branches: [main]
|
||||
|
||||
jobs:
|
||||
shellcheck:
|
||||
name: ShellCheck
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Install ShellCheck
|
||||
run: sudo apt-get install -y shellcheck
|
||||
|
||||
- name: Run ShellCheck on websec-audit.sh
|
||||
run: |
|
||||
shellcheck -S warning \
|
||||
--shell=bash \
|
||||
--exclude=SC2086 \
|
||||
websec-audit.sh
|
||||
# SC2086: Double-quote to prevent globbing — intentionally disabled
|
||||
# for nmap/sqlmap/gobuster flag passing which requires word splitting
|
||||
|
||||
- name: Run ShellCheck on install.sh
|
||||
run: |
|
||||
shellcheck -S warning \
|
||||
--shell=bash \
|
||||
install.sh
|
||||
|
||||
syntax-check:
|
||||
name: Bash Syntax Check
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Check bash syntax — websec-audit.sh
|
||||
run: bash -n websec-audit.sh && echo "Syntax OK"
|
||||
|
||||
- name: Check bash syntax — install.sh
|
||||
run: bash -n install.sh && echo "Syntax OK"
|
||||
|
||||
permissions-check:
|
||||
name: File Permissions
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Check scripts are executable
|
||||
run: |
|
||||
for script in websec-audit.sh install.sh; do
|
||||
if [[ ! -x "$script" ]]; then
|
||||
echo "ERROR: $script is not executable"
|
||||
exit 1
|
||||
fi
|
||||
echo "OK: $script is executable"
|
||||
done
|
||||
+105
@@ -0,0 +1,105 @@
|
||||
# ─── websec-audit .gitignore ──────────────────────────────────────────────────
|
||||
|
||||
# Scan results (never commit target data)
|
||||
results_*/
|
||||
/results/
|
||||
*.results/
|
||||
|
||||
# Log files
|
||||
*.log
|
||||
logs/
|
||||
|
||||
# Reports generated by the tool
|
||||
reports/
|
||||
*.html
|
||||
*.json
|
||||
!package.json
|
||||
!composer.json
|
||||
|
||||
# Raw finding dumps
|
||||
findings.jsonl
|
||||
findings_raw.jsonl
|
||||
|
||||
# Backup files
|
||||
*.bak
|
||||
*.backup
|
||||
*.orig
|
||||
*.old
|
||||
*.tmp
|
||||
*.swp
|
||||
*~
|
||||
|
||||
# OS files
|
||||
.DS_Store
|
||||
.DS_Store?
|
||||
._*
|
||||
.Spotlight-V100
|
||||
.Trashes
|
||||
ehthumbs.db
|
||||
Thumbs.db
|
||||
desktop.ini
|
||||
|
||||
# Editor files
|
||||
.idea/
|
||||
.vscode/
|
||||
*.sublime-project
|
||||
*.sublime-workspace
|
||||
.project
|
||||
.classpath
|
||||
|
||||
# Python
|
||||
__pycache__/
|
||||
*.py[cod]
|
||||
*$py.class
|
||||
*.egg-info/
|
||||
dist/
|
||||
build/
|
||||
.eggs/
|
||||
*.egg
|
||||
.venv/
|
||||
venv/
|
||||
env/
|
||||
|
||||
# Ruby gems
|
||||
*.gem
|
||||
.bundle/
|
||||
vendor/bundle/
|
||||
|
||||
# Go
|
||||
bin/
|
||||
pkg/
|
||||
|
||||
# Archives
|
||||
*.zip
|
||||
*.tar.gz
|
||||
*.tar.bz2
|
||||
*.tgz
|
||||
|
||||
# Temp directories
|
||||
tmp/
|
||||
temp/
|
||||
.tmp/
|
||||
cache/
|
||||
|
||||
# CI/CD secrets
|
||||
.env
|
||||
.env.*
|
||||
!.env.example
|
||||
secrets.txt
|
||||
credentials
|
||||
|
||||
# Wordlists (too large for git; users install via apt/seclists)
|
||||
wordlists/
|
||||
*.wordlist
|
||||
*.dict
|
||||
rockyou.txt
|
||||
|
||||
# nmap output
|
||||
*.nmap
|
||||
*.gnmap
|
||||
*.xml.bak
|
||||
|
||||
# Output from specific tools
|
||||
sqlmap_output/
|
||||
nikto_reports/
|
||||
testssl_output/
|
||||
@@ -0,0 +1,67 @@
|
||||
# Changelog
|
||||
|
||||
All notable changes to **websec-audit** are documented in this file.
|
||||
|
||||
The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
||||
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
||||
|
||||
---
|
||||
|
||||
## [1.0.1] — 2026-03-23
|
||||
|
||||
### Added
|
||||
- **Module 15 — Nuclei** template scan integration (severity-filtered)
|
||||
- **Module 14 — Subdomain Takeover**: `subjack` + Nuclei + manual CNAME analysis for 20+ services
|
||||
- **Module 13 — SSRF**: cloud IMDS probing (AWS, GCP, Azure), decimal/hex IP encoding
|
||||
- **Module 12 — Open Redirect**: 20 parameters × 10 redirect payloads
|
||||
- **Module 11 — CORS**: null origin, credentialed cross-origin, wildcard detection
|
||||
- **Module 10 — CMS**: WordPress REST API user enumeration, debug.log, xmlrpc.php checks
|
||||
- **Module 09 — XSS**: dalfox integration + 8 reflected XSS payloads × 15 parameters
|
||||
- **Module 08 — SQLi**: sqlmap with forms crawl in aggressive mode, tamper scripts
|
||||
- **Module 07 — Nikto**: severity-based finding classification
|
||||
- **Module 06 — Dir Enum**: 40 sensitive path probes (`.git`, `.env`, AWS credentials, Dockerfiles, etc.)
|
||||
- **Module 05 — HTTP Headers**: CSP audit (unsafe-inline, wildcards), SameSite=None+Secure, Cache-Control
|
||||
- **Module 04 — SSL/TLS**: CAA records, HSTS preload, cert expiry thresholds (14/30/90 days)
|
||||
- **Module 03 — Fingerprint**: WAF detection via wafw00f, version-leaking header enumeration
|
||||
- **Module 02 — Port Scan**: risk-based analysis for 20+ dangerous ports
|
||||
- **Module 01 — Recon**: SPF `+all` detection, DMARC `p=none` warning, 700+ Google Dorks
|
||||
- Interactive HTML report with severity filter, live search, and risk bar
|
||||
- JSON report with full metadata envelope
|
||||
- `--format json|html|txt|all` flag
|
||||
- `--no-banner` flag for scripting/CI use
|
||||
- `--version` / `-V` flag
|
||||
- Graceful interrupt handling — generates partial reports on SIGINT/SIGTERM
|
||||
- Signal trap generates partial report on Ctrl-C
|
||||
- `findings.jsonl` raw log for programmatic processing
|
||||
- Aggressive mode: nmap `-A -O --script=vuln,auth`, sqlmap level 5 + tamper, deep DOM XSS
|
||||
- Stealth mode: nmap `-sS -T2 -f`, sqlmap delay, randomised ordering
|
||||
- Tool availability graceful degradation — all modules have fallbacks
|
||||
|
||||
### Changed
|
||||
- Fully rewritten in English for international audience
|
||||
- Modular `module_*()` function architecture — each module independently skippable
|
||||
- `add_finding()` now emits structured JSONL with id, severity, module, title, description, evidence, recommendation, and RFC3339 timestamp
|
||||
- `_curl()` wrapper with retry, consistent UA, proxy, and timeout
|
||||
- Output directory structure reorganised into `recon/`, `portscan/`, `ssl/`, `headers/`, `dirs/`, `vulns/`, `cms/`, `misc/`, `reports/`, `logs/`
|
||||
- HTML report: dark theme, sticky table headers, responsive grid
|
||||
|
||||
### Fixed
|
||||
- SPF record detection now handles multi-TXT records correctly
|
||||
- HSTS max-age check handles missing header without error
|
||||
- nmap output parsing compatible with both GNU and BSD grep
|
||||
- JSON report correctly handles multi-line evidence strings
|
||||
|
||||
---
|
||||
|
||||
## [1.0.0] — 2026-01-13
|
||||
|
||||
### Added
|
||||
- Initial release
|
||||
- Core modules: recon, port scan, SSL, headers, dir brute-force, nikto, sqlmap
|
||||
- Basic HTML report
|
||||
- Spanish-language interface
|
||||
|
||||
---
|
||||
|
||||
[1.0.1]: https://github.com/davidalvarezp/websec-audit/compare/v1.0.0...v1.0.1
|
||||
[1.0.0]: https://github.com/davidalvarezp/websec-audit/releases/tag/v1.0.0
|
||||
+193
@@ -0,0 +1,193 @@
|
||||
# Contributing to websec-audit
|
||||
|
||||
Thank you for your interest in contributing to **websec-audit**!
|
||||
All contributions are welcome — bug reports, feature requests, documentation improvements, new modules, and code fixes.
|
||||
|
||||
---
|
||||
|
||||
## Table of Contents
|
||||
|
||||
- [Code of Conduct](#code-of-conduct)
|
||||
- [How to Contribute](#how-to-contribute)
|
||||
- [Development Guidelines](#development-guidelines)
|
||||
- [Adding a New Module](#adding-a-new-module)
|
||||
- [Commit Conventions](#commit-conventions)
|
||||
- [Pull Request Process](#pull-request-process)
|
||||
|
||||
---
|
||||
|
||||
## Code of Conduct
|
||||
|
||||
By participating in this project, you agree to:
|
||||
|
||||
- Be respectful and constructive in all communications
|
||||
- Only contribute code intended for **authorised security testing**
|
||||
- Not submit payloads, exploits, or code designed to harm systems without consent
|
||||
|
||||
---
|
||||
|
||||
## How to Contribute
|
||||
|
||||
### Reporting Bugs
|
||||
|
||||
1. Search [existing issues](https://github.com/davidalvarezp/websec-audit/issues) first
|
||||
2. Open a new issue using the **Bug Report** template
|
||||
3. Include: OS version, tool versions, reproduction steps, expected vs actual behaviour
|
||||
|
||||
### Requesting Features
|
||||
|
||||
1. Open an issue using the **Feature Request** template
|
||||
2. Describe the use case and expected output clearly
|
||||
|
||||
### Code Contributions
|
||||
|
||||
1. **Fork** the repository
|
||||
2. **Clone** your fork: `git clone https://github.com/YOUR_USER/websec-audit.git`
|
||||
3. Create a **feature branch**: `git checkout -b feature/your-feature-name`
|
||||
4. Make your changes following the guidelines below
|
||||
5. **Test** your changes
|
||||
6. **Commit** using conventional commits (see below)
|
||||
7. **Push**: `git push origin feature/your-feature-name`
|
||||
8. Open a **Pull Request** against `main`
|
||||
|
||||
---
|
||||
|
||||
## Development Guidelines
|
||||
|
||||
### Shell Style
|
||||
|
||||
- Target **bash 5.0+** — no POSIX-only constraints, but avoid bash 5.1+ exclusive syntax
|
||||
- Use `set -euo pipefail` and `IFS=$'\n\t'` at the top of every script
|
||||
- Quote all variable expansions: `"$var"` not `$var`
|
||||
- Use `[[ ]]` for conditions, not `[ ]`
|
||||
- Prefer `local` variables inside functions
|
||||
- Run `shellcheck` on your changes before submitting:
|
||||
```bash
|
||||
shellcheck -S warning websec-audit.sh
|
||||
```
|
||||
|
||||
### Naming Conventions
|
||||
|
||||
| Item | Convention | Example |
|
||||
|------|-----------|---------|
|
||||
| Functions | `snake_case` | `module_sqli()` |
|
||||
| Constants | `UPPER_SNAKE` | `readonly TOOL_VERSION` |
|
||||
| Global vars | `UPPER_SNAKE` | `OPT_AGGRESSIVE` |
|
||||
| Local vars | `lower_snake` | `local scan_target` |
|
||||
| Module flags | `MOD_NAME` | `MOD_SQLI` |
|
||||
| Option flags | `OPT_NAME` | `OPT_THREADS` |
|
||||
|
||||
### Error Handling
|
||||
|
||||
- Never silently ignore errors — use `|| true` only when failure is genuinely acceptable
|
||||
- Use `log_warn` when a tool is missing; the script must continue
|
||||
- Use `log_error` + `exit 1` only for unrecoverable conditions (missing required tool, invalid target)
|
||||
- All findings must go through `add_finding()` — never write directly to reports
|
||||
|
||||
### Performance
|
||||
|
||||
- Respect `OPT_THREADS` and `OPT_TIMEOUT` in all external tool calls
|
||||
- Use `timeout` around all network operations
|
||||
- Avoid unnecessary subshells in tight loops
|
||||
|
||||
---
|
||||
|
||||
## Adding a New Module
|
||||
|
||||
1. Add a toggle variable in the global section:
|
||||
```bash
|
||||
MOD_MYMODULE=1
|
||||
```
|
||||
|
||||
2. Add a `--skip-mymodule` argument in `parse_args()`:
|
||||
```bash
|
||||
--skip-mymodule) MOD_MYMODULE=0; shift ;;
|
||||
```
|
||||
|
||||
3. Add the `--skip-mymodule` entry to the help text in `print_usage()`.
|
||||
|
||||
4. Write the module function following this template:
|
||||
```bash
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
# MODULE XX — YOUR MODULE NAME
|
||||
# ─────────────────────────────────────────────────────────────────────────────
|
||||
module_mymodule() {
|
||||
[[ $MOD_MYMODULE -eq 0 ]] && return
|
||||
log_section "MODULE XX — YOUR MODULE NAME"
|
||||
|
||||
local out_dir="${OUTPUT_DIR}/misc"
|
||||
|
||||
# Check for optional tools
|
||||
if ! has_tool mytool; then
|
||||
log_warn "mytool not available — skipping related checks"
|
||||
fi
|
||||
|
||||
# ... your logic ...
|
||||
|
||||
# Register findings
|
||||
add_finding "HIGH" "MYMODULE" "Short finding title" \
|
||||
"Detailed description of what was found." \
|
||||
"evidence string" \
|
||||
"Remediation recommendation."
|
||||
|
||||
log_info "Module results → $out_dir"
|
||||
}
|
||||
```
|
||||
|
||||
5. Call the module in `main()` after `module_cms` and before `generate_reports`.
|
||||
|
||||
6. Add the module to the table in `README.md`.
|
||||
|
||||
7. Add an entry to `CHANGELOG.md` under `[Unreleased]`.
|
||||
|
||||
---
|
||||
|
||||
## Commit Conventions
|
||||
|
||||
We use [Conventional Commits](https://www.conventionalcommits.org/):
|
||||
|
||||
```
|
||||
<type>(<scope>): <short description>
|
||||
|
||||
[optional body]
|
||||
|
||||
[optional footer]
|
||||
```
|
||||
|
||||
### Types
|
||||
|
||||
| Type | When to use |
|
||||
|------|------------|
|
||||
| `feat` | New feature or module |
|
||||
| `fix` | Bug fix |
|
||||
| `docs` | Documentation only |
|
||||
| `refactor` | Code change that neither fixes a bug nor adds a feature |
|
||||
| `perf` | Performance improvement |
|
||||
| `test` | Adding or updating tests |
|
||||
| `chore` | Build process, dependency updates |
|
||||
|
||||
### Examples
|
||||
|
||||
```bash
|
||||
feat(module): add GraphQL introspection detection
|
||||
fix(ssl): handle certificates with no expiry date gracefully
|
||||
docs(readme): add Kali Linux installation instructions
|
||||
refactor(headers): extract cookie analysis into helper function
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Pull Request Process
|
||||
|
||||
1. **One PR per feature/fix** — keep changes focused and reviewable
|
||||
2. **Update documentation** — README, CHANGELOG, and inline comments
|
||||
3. **Describe your PR** — fill in the PR template completely
|
||||
4. **Pass shellcheck** — zero warnings on `websec-audit.sh` and `install.sh`
|
||||
5. **Test manually** — run the affected module(s) against a test target (DVWA, HackTheBox, your own lab)
|
||||
|
||||
PRs will be reviewed within 5 business days. Feedback will be given constructively.
|
||||
Once approved, a maintainer will merge it into `main`.
|
||||
|
||||
---
|
||||
|
||||
Thank you for helping make **websec-audit** better! 🔐
|
||||
@@ -0,0 +1,44 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2026 davidalvarezp
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
|
||||
---
|
||||
|
||||
ADDITIONAL NOTICE
|
||||
|
||||
This software is designed for legitimate security research and authorized
|
||||
penetration testing only. The author, davidalvarezp, is not responsible
|
||||
for any misuse or damage caused by this program.
|
||||
|
||||
Users are solely responsible for ensuring they have proper written
|
||||
authorization before running this tool against any system. Unauthorized use
|
||||
against computer systems is illegal and may result in civil and/or criminal
|
||||
prosecution under applicable law, including but not limited to:
|
||||
|
||||
- Directive 2013/40/EU on attacks against information systems — European Union
|
||||
- Ley Orgánica 10/1995 (Código Penal, arts. 197-200) — Spain
|
||||
- Computer Fraud and Abuse Act (CFAA) — United States
|
||||
- Computer Misuse Act (CMA) — United Kingdom
|
||||
|
||||
|
||||
By using this software, you agree to comply with all applicable laws and
|
||||
regulations, and you confirm that you have obtained all necessary permissions
|
||||
from the system owner(s) before conducting any security assessment.
|
||||
@@ -0,0 +1,355 @@
|
||||
<div align="center">
|
||||
|
||||
# 🔐 websec-audit
|
||||
|
||||
**Professional Web Security Audit Framework**
|
||||
|
||||
[](https://github.com/davidalvarezp/websec-audit/releases)
|
||||
[](LICENSE)
|
||||
[](https://www.gnu.org/software/bash/)
|
||||
[](https://github.com/davidalvarezp/websec-audit)
|
||||
[](https://github.com/davidalvarezp/websec-audit/commits/main)
|
||||
|
||||
A modular, extensible Bash framework for **comprehensive web application security assessments**.
|
||||
Automates 15+ attack surface modules, generates structured logs, and produces professional reports in HTML, JSON and TXT.
|
||||
|
||||
[Features](#-features) · [Installation](#-installation) · [Usage](#-usage) · [Modules](#-modules) · [Output](#-output) · [Contributing](#-contributing)
|
||||
|
||||
---
|
||||
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
---
|
||||
|
||||
## ⚠️ Legal Disclaimer
|
||||
|
||||
> **This tool is intended exclusively for authorised security assessments.**
|
||||
> Only run it against systems you own or have **explicit written permission** to test.
|
||||
> Unauthorised use against third-party systems is illegal and may result in criminal prosecution.
|
||||
> The author assumes **no liability** whatsoever for misuse of this software.
|
||||
|
||||
---
|
||||
|
||||
## ✨ Features
|
||||
|
||||
- **15+ security modules** — recon, port scanning, SSL/TLS, headers, SQLi, XSS, CMS, CORS, SSRF, subdomain takeover, and more
|
||||
- **Modular architecture** — enable or disable any module independently via `--skip-<module>`
|
||||
- **Three scan modes** — Normal, Aggressive (`--aggressive`), Stealth (`--stealth`)
|
||||
- **Professional reporting** — interactive HTML dashboard, structured JSON, and plain-text log
|
||||
- **Tool-agnostic** — gracefully degrades to fallbacks when optional tools are absent
|
||||
- **Smart finding engine** — findings stored as JSONL with severity, module, evidence, and remediation
|
||||
- **Proxy support** — route all traffic through Burp Suite or any HTTP proxy
|
||||
- **CVSS-aligned severities** — CRITICAL / HIGH / MEDIUM / LOW / INFO
|
||||
- **Zero external dependencies** — core scan works with only `curl` and `nmap`
|
||||
|
||||
---
|
||||
|
||||
## 📦 Installation
|
||||
|
||||
### Quick Install (recommended)
|
||||
|
||||
```bash
|
||||
git clone https://github.com/davidalvarezp/websec-audit.git
|
||||
cd websec-audit
|
||||
chmod +x install.sh websec-audit.sh
|
||||
sudo ./install.sh
|
||||
```
|
||||
|
||||
### Manual (Debian/Ubuntu)
|
||||
|
||||
```bash
|
||||
# Required
|
||||
sudo apt-get install -y curl nmap
|
||||
|
||||
# Recommended
|
||||
sudo apt-get install -y nikto sqlmap gobuster whatweb wafw00f sslscan \
|
||||
python3 python3-pip jq ruby dirb dnsutils whois wordlists
|
||||
|
||||
# Optional (improves coverage significantly)
|
||||
pip3 install droopescan
|
||||
gem install wpscan --no-document
|
||||
git clone --depth 1 https://github.com/drwetter/testssl.sh.git /opt/testssl.sh
|
||||
sudo ln -s /opt/testssl.sh/testssl.sh /usr/local/bin/testssl.sh
|
||||
```
|
||||
|
||||
### Kali Linux
|
||||
|
||||
Most tools are pre-installed. Run:
|
||||
```bash
|
||||
sudo apt-get install -y gobuster dalfox subjack nuclei subfinder
|
||||
./install.sh # handles remaining gaps
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🚀 Usage
|
||||
|
||||
### Basic
|
||||
|
||||
```bash
|
||||
./websec-audit.sh -t https://target.com
|
||||
```
|
||||
|
||||
### Aggressive (deeper, noisier)
|
||||
|
||||
```bash
|
||||
./websec-audit.sh -t https://target.com --aggressive -T 20
|
||||
```
|
||||
|
||||
### Stealth (slower, lower detection footprint)
|
||||
|
||||
```bash
|
||||
./websec-audit.sh -t https://target.com --stealth
|
||||
```
|
||||
|
||||
### Through a proxy (Burp Suite)
|
||||
|
||||
```bash
|
||||
./websec-audit.sh -t https://target.com --proxy http://127.0.0.1:8080
|
||||
```
|
||||
|
||||
### Custom output directory and JSON-only report
|
||||
|
||||
```bash
|
||||
./websec-audit.sh -t https://target.com -o /tmp/audit --format json
|
||||
```
|
||||
|
||||
### Skip specific modules
|
||||
|
||||
```bash
|
||||
./websec-audit.sh -t https://target.com --skip-nikto --skip-sqli --skip-cms -v
|
||||
```
|
||||
|
||||
### Full port scan with aggressive mode
|
||||
|
||||
```bash
|
||||
./websec-audit.sh -t https://target.com --ports full --aggressive --depth 5
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 📋 Full Options Reference
|
||||
|
||||
```
|
||||
REQUIRED
|
||||
-t, --target <url|ip> Target URL or IP address
|
||||
|
||||
OUTPUT
|
||||
-o, --output <dir> Output directory
|
||||
--format <fmt> json | html | txt | all (default: all)
|
||||
|
||||
SCAN OPTIONS
|
||||
-T, --threads <n> Concurrent threads (default: 10)
|
||||
-p, --ports <profile> top-100 | top-1000 | full (default: top-1000)
|
||||
--timeout <s> Connection timeout (default: 10)
|
||||
--depth <n> Crawl depth (default: 3)
|
||||
--proxy <url> HTTP/HTTPS proxy
|
||||
--aggressive Aggressive mode
|
||||
--stealth Stealth mode
|
||||
|
||||
MODULE CONTROL (--skip-<module>)
|
||||
--skip-recon WHOIS, DNS, subdomain enumeration
|
||||
--skip-portscan nmap port scanning
|
||||
--skip-fingerprint WhatWeb, WAF detection
|
||||
--skip-ssl SSL/TLS analysis
|
||||
--skip-headers HTTP security headers
|
||||
--skip-dirbrute Directory/file brute-forcing
|
||||
--skip-nikto Nikto web scanner
|
||||
--skip-sqli SQL injection (sqlmap)
|
||||
--skip-xss XSS (dalfox + manual)
|
||||
--skip-cms CMS detection & scanning
|
||||
--skip-cors CORS misconfiguration
|
||||
--skip-redirect Open redirect
|
||||
--skip-ssrf SSRF
|
||||
--skip-subtakeover Subdomain takeover
|
||||
--skip-nuclei Nuclei template scan
|
||||
|
||||
WORDLISTS
|
||||
--wl-dirs-small <file> Small wordlist for directory brute-force
|
||||
--wl-dirs-big <file> Large wordlist for directory brute-force
|
||||
--wl-dns <file> DNS subdomain wordlist
|
||||
|
||||
MISC
|
||||
-v, --verbose Verbose output
|
||||
--no-color Disable ANSI colors
|
||||
--no-banner Suppress banner
|
||||
-V, --version Version info
|
||||
-h, --help Help
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🔍 Modules
|
||||
|
||||
| # | Module | Description | Key Tools |
|
||||
|---|--------|-------------|-----------|
|
||||
| 00 | **Target Info** | Resolve IP, initialise directories | `dig`, `host` |
|
||||
| 01 | **Reconnaissance** | WHOIS, DNS records, AXFR, subdomain enum, SPF/DMARC, dorks | `whois`, `dig`, `subfinder`, `amass`, `dnsrecon` |
|
||||
| 02 | **Port Scanning** | Full service/version detection, risk-based port analysis | `nmap` |
|
||||
| 03 | **Fingerprinting** | Technology stack, WAF detection, version leakage | `whatweb`, `wafw00f` |
|
||||
| 04 | **SSL/TLS** | Protocol support, ciphers, cert expiry, HSTS, CAA | `testssl.sh`, `sslscan`, `openssl` |
|
||||
| 05 | **HTTP Headers** | 7+ security headers, cookie flags, CSP audit, HTTPS redirect | `curl` |
|
||||
| 06 | **Dir & File Enum** | Directory brute-force + 40 sensitive path probes | `gobuster`, `ffuf`, `dirb` |
|
||||
| 07 | **Nikto** | Web server misconfigurations, known CVEs | `nikto` |
|
||||
| 08 | **SQL Injection** | Automated SQLi detection and exploitation | `sqlmap` |
|
||||
| 09 | **XSS** | Reflected XSS probe across common parameters + DOM XSS | `dalfox`, `curl` |
|
||||
| 10 | **CMS Scanning** | WordPress, Drupal, Joomla, Magento detection and scanning | `wpscan`, `droopescan` |
|
||||
| 11 | **CORS** | Misconfigured CORS, wildcard origins, credentialed CORS | `curl` |
|
||||
| 12 | **Open Redirect** | 20+ params × 10 redirect payloads | `curl` |
|
||||
| 13 | **SSRF** | Cloud IMDS (AWS/GCP/Azure), internal IP probing | `curl` |
|
||||
| 14 | **Subdomain Takeover** | Dangling CNAME detection for 20+ services | `subjack`, `nuclei`, `dig` |
|
||||
| 15 | **Nuclei** | Community CVE/misconfiguration templates | `nuclei` |
|
||||
|
||||
---
|
||||
|
||||
## 📁 Output Structure
|
||||
|
||||
```
|
||||
results_target_YYYYMMDD_HHMMSS/
|
||||
├── logs/
|
||||
│ ├── audit_YYYYMMDD_HHMMSS.log # Full timestamped audit log
|
||||
│ └── findings.jsonl # One JSON object per finding
|
||||
├── recon/
|
||||
│ ├── whois.txt
|
||||
│ ├── dns_records.txt
|
||||
│ ├── subdomains.txt
|
||||
│ ├── axfr.txt
|
||||
│ ├── whatweb.json
|
||||
│ ├── waf_detection.txt
|
||||
│ └── google_dorks.txt
|
||||
├── portscan/
|
||||
│ ├── nmap.txt
|
||||
│ ├── nmap.xml
|
||||
│ └── nmap.gnmap
|
||||
├── ssl/
|
||||
│ ├── testssl.json
|
||||
│ └── testssl.log
|
||||
├── headers/
|
||||
│ └── response_headers.txt
|
||||
├── dirs/
|
||||
│ ├── gobuster_dirs.txt
|
||||
│ └── sensitive_paths_found.txt
|
||||
├── vulns/
|
||||
│ ├── sqlmap/
|
||||
│ ├── xss/
|
||||
│ └── nuclei/
|
||||
├── cms/
|
||||
│ ├── wpscan_results.json
|
||||
│ └── droopescan_*.json
|
||||
├── misc/
|
||||
│ ├── cors_tests.txt
|
||||
│ ├── open_redirect.txt
|
||||
│ ├── ssrf_tests.txt
|
||||
│ └── subtakeover.txt
|
||||
└── reports/
|
||||
├── report_YYYYMMDD_HHMMSS.html # Interactive dashboard
|
||||
├── report_YYYYMMDD_HHMMSS.json # Structured JSON
|
||||
└── report_YYYYMMDD_HHMMSS.txt # Plain text
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 📊 Report Examples
|
||||
|
||||
### HTML Report
|
||||
- Interactive severity filter (Critical / High / Medium / Low / Info)
|
||||
- Live search across all findings
|
||||
- Risk bar and scan metadata panel
|
||||
- Evidence and remediation per finding
|
||||
- Dark theme, responsive layout
|
||||
|
||||
### JSON Report
|
||||
```json
|
||||
{
|
||||
"metadata": {
|
||||
"tool": "websec-audit",
|
||||
"version": "1.0.1",
|
||||
"target": "https://davidalvarezp.com",
|
||||
"start_time": "2026-01-01 12:00:00",
|
||||
"duration_secs": 342
|
||||
},
|
||||
"summary": {
|
||||
"total": 18,
|
||||
"critical": 2,
|
||||
"high": 5,
|
||||
"medium": 6,
|
||||
"low": 3,
|
||||
"info": 2
|
||||
},
|
||||
"findings": [
|
||||
{
|
||||
"id": 1,
|
||||
"severity": "CRITICAL",
|
||||
"module": "RECON",
|
||||
"title": "DNS Zone Transfer (AXFR) is permitted",
|
||||
"description": "Name server ns1.davidalvarezp.com allows AXFR — full DNS zone disclosed.",
|
||||
"evidence": "...",
|
||||
"recommendation": "Restrict AXFR to authorised secondary name servers only.",
|
||||
"timestamp": "2026-01-01T12:00:12Z"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🔧 Requirements
|
||||
|
||||
### Required
|
||||
| Tool | Purpose | Install |
|
||||
|------|---------|---------|
|
||||
| `bash` 5.0+ | Shell interpreter | `apt-get install bash` |
|
||||
| `curl` | HTTP requests | `apt-get install curl` |
|
||||
| `nmap` | Port scanning | `apt-get install nmap` |
|
||||
|
||||
### Recommended (significantly improves coverage)
|
||||
| Tool | Module | Install |
|
||||
|------|--------|---------|
|
||||
| `nikto` | Web vuln scan | `apt-get install nikto` |
|
||||
| `sqlmap` | SQL injection | `apt-get install sqlmap` |
|
||||
| `gobuster` / `ffuf` | Dir brute-force | `apt-get install gobuster` |
|
||||
| `whatweb` | Fingerprinting | `apt-get install whatweb` |
|
||||
| `wafw00f` | WAF detection | `apt-get install wafw00f` |
|
||||
| `sslscan` / `testssl.sh` | SSL/TLS | `apt-get install sslscan` |
|
||||
| `wpscan` | WordPress | `gem install wpscan` |
|
||||
| `dalfox` | XSS | [GitHub releases](https://github.com/hahwul/dalfox) |
|
||||
| `nuclei` | CVE templates | [GitHub releases](https://github.com/projectdiscovery/nuclei) |
|
||||
| `subfinder` | Subdomain enum | [GitHub releases](https://github.com/projectdiscovery/subfinder) |
|
||||
| `jq` | JSON parsing | `apt-get install jq` |
|
||||
| `python3` | Utilities | `apt-get install python3` |
|
||||
|
||||
---
|
||||
|
||||
## 🤝 Contributing
|
||||
|
||||
Contributions are welcome! Please read [CONTRIBUTING.md](CONTRIBUTING.md) before submitting a pull request.
|
||||
|
||||
1. Fork the repository
|
||||
2. Create a feature branch: `git checkout -b feature/new-module`
|
||||
3. Commit your changes: `git commit -m 'feat: add new-module'`
|
||||
4. Push to your branch: `git push origin feature/new-module`
|
||||
5. Open a Pull Request
|
||||
|
||||
---
|
||||
|
||||
## 📝 Changelog
|
||||
|
||||
See [CHANGELOG.md](CHANGELOG.md) for the full version history.
|
||||
|
||||
---
|
||||
|
||||
## 📜 License
|
||||
|
||||
This project is licensed under the **MIT License** — see [LICENSE](LICENSE) for details.
|
||||
|
||||
---
|
||||
|
||||
<div align="center">
|
||||
|
||||
Made with ❤️ by [davidalvarezp](https://davidalvarezp.com)
|
||||
|
||||
⭐ **Star this repo** if you find it useful!
|
||||
|
||||
</div>
|
||||
+303
@@ -0,0 +1,303 @@
|
||||
#!/usr/bin/env bash
|
||||
# =============================================================================
|
||||
#
|
||||
# install.sh — Dependency installer for websec-audit
|
||||
# Supported: Debian 11/12/13, Ubuntu 20.04/22.04/24.04
|
||||
#
|
||||
# Author : davidalvarezp
|
||||
# Version : 1.0.1
|
||||
# License : MIT
|
||||
# GitHub : https://github.com/davidalvarezp/websec-audit
|
||||
#
|
||||
# =============================================================================
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
readonly SCRIPT_VERSION="1.0.1"
|
||||
readonly INSTALL_LOG="/tmp/websec_install_$(date +%Y%m%d_%H%M%S).log"
|
||||
|
||||
# ── Colors ────────────────────────────────────────────────────────────────────
|
||||
C_RED='\033[0;31m'; C_GREEN='\033[0;32m'; C_YELLOW='\033[1;33m'
|
||||
C_CYAN='\033[0;36m'; C_BLUE='\033[0;34m'; C_BOLD='\033[1m'; C_RESET='\033[0m'
|
||||
|
||||
ok() { echo -e "${C_GREEN} [✔]${C_RESET} $1" | tee -a "$INSTALL_LOG"; }
|
||||
info() { echo -e "${C_BLUE} [i]${C_RESET} $1" | tee -a "$INSTALL_LOG"; }
|
||||
warn() { echo -e "${C_YELLOW} [!]${C_RESET} $1" | tee -a "$INSTALL_LOG"; }
|
||||
err() { echo -e "${C_RED} [✘]${C_RESET} $1" | tee -a "$INSTALL_LOG" >&2; }
|
||||
step() { echo -e "\n${C_BOLD}${C_CYAN} ── $1 ──${C_RESET}" | tee -a "$INSTALL_LOG"; }
|
||||
|
||||
has_tool() { command -v "$1" &>/dev/null; }
|
||||
|
||||
# ── Privilege check ───────────────────────────────────────────────────────────
|
||||
[[ $EUID -ne 0 ]] && { err "Run as root: sudo $0"; exit 1; }
|
||||
|
||||
echo -e "${C_BOLD}${C_CYAN}"
|
||||
cat << 'BANNER'
|
||||
╔═════════════════════════════════════════════════╗
|
||||
║ websec-audit — Dependency Installer ║
|
||||
║ Debian / Ubuntu ║
|
||||
╚═════════════════════════════════════════════════╝
|
||||
BANNER
|
||||
echo -e "${C_RESET}"
|
||||
echo " Install log: $INSTALL_LOG"
|
||||
echo ""
|
||||
|
||||
# ── System check ──────────────────────────────────────────────────────────────
|
||||
step "System Verification"
|
||||
OS_ID=$(grep "^ID=" /etc/os-release 2>/dev/null | cut -d= -f2 | tr -d '"' || echo "unknown")
|
||||
OS_VER=$(grep "^VERSION_ID=" /etc/os-release 2>/dev/null | cut -d= -f2 | tr -d '"' || echo "?")
|
||||
ARCH=$(uname -m)
|
||||
|
||||
info "OS: $OS_ID $OS_VER | Arch: $ARCH"
|
||||
[[ "$OS_ID" =~ ^(debian|ubuntu|kali|parrot)$ ]] || warn "Untested OS: $OS_ID — proceeding anyway"
|
||||
|
||||
# ── APT packages ──────────────────────────────────────────────────────────────
|
||||
step "APT Package Installation"
|
||||
info "Updating package lists..."
|
||||
apt-get update -qq 2>>"$INSTALL_LOG"
|
||||
|
||||
APT_PACKAGES=(
|
||||
# Core tools
|
||||
curl wget git nmap
|
||||
# Web scanners
|
||||
nikto sqlmap dirb
|
||||
# DNS & network
|
||||
dnsutils bind9-dnsutils whois dnsmap
|
||||
# Fingerprinting & WAF
|
||||
whatweb wafw00f
|
||||
# SSL
|
||||
sslscan openssl
|
||||
# Wordlists
|
||||
wordlists
|
||||
# Languages & build deps
|
||||
python3 python3-pip jq
|
||||
ruby ruby-dev build-essential libssl-dev libffi-dev
|
||||
# gobuster (if packaged)
|
||||
gobuster
|
||||
)
|
||||
|
||||
for pkg in "${APT_PACKAGES[@]}"; do
|
||||
if apt-get install -y -qq "$pkg" >>"$INSTALL_LOG" 2>&1; then
|
||||
ok "$pkg"
|
||||
else
|
||||
warn "$pkg — install failed or not available (will try alternative)"
|
||||
fi
|
||||
done
|
||||
|
||||
# ── WPScan (gem) ──────────────────────────────────────────────────────────────
|
||||
step "WPScan"
|
||||
if has_tool wpscan; then
|
||||
ok "wpscan already installed ($(wpscan --version 2>/dev/null | head -1))"
|
||||
else
|
||||
info "Installing wpscan via gem..."
|
||||
if gem install wpscan --no-document >>"$INSTALL_LOG" 2>&1; then
|
||||
ok "wpscan installed"
|
||||
else
|
||||
warn "wpscan installation failed"
|
||||
fi
|
||||
fi
|
||||
|
||||
# ── testssl.sh ────────────────────────────────────────────────────────────────
|
||||
step "testssl.sh"
|
||||
if has_tool testssl.sh; then
|
||||
ok "testssl.sh already installed"
|
||||
else
|
||||
info "Installing testssl.sh from GitHub..."
|
||||
if [[ -d /opt/testssl.sh ]]; then
|
||||
git -C /opt/testssl.sh pull -q >>"$INSTALL_LOG" 2>&1 || true
|
||||
else
|
||||
git clone --depth 1 https://github.com/drwetter/testssl.sh.git /opt/testssl.sh \
|
||||
>>"$INSTALL_LOG" 2>&1
|
||||
fi
|
||||
ln -sf /opt/testssl.sh/testssl.sh /usr/local/bin/testssl.sh
|
||||
chmod +x /opt/testssl.sh/testssl.sh
|
||||
ok "testssl.sh installed → /usr/local/bin/testssl.sh"
|
||||
fi
|
||||
|
||||
# ── Go binary installer helper ────────────────────────────────────────────────
|
||||
install_go_binary() {
|
||||
local name="$1" url="$2" binary="${3:-$1}"
|
||||
if has_tool "$name"; then
|
||||
ok "$name already installed"
|
||||
return 0
|
||||
fi
|
||||
info "Downloading $name..."
|
||||
local tmp; tmp=$(mktemp)
|
||||
local ext="${url##*.}"
|
||||
|
||||
if wget -q "$url" -O "$tmp" >>"$INSTALL_LOG" 2>&1; then
|
||||
case "$ext" in
|
||||
gz)
|
||||
tar -xzf "$tmp" -C /usr/local/bin/ "$binary" >>"$INSTALL_LOG" 2>&1 && \
|
||||
chmod +x "/usr/local/bin/$binary" && ok "$name installed" || warn "$name: extraction failed" ;;
|
||||
zip)
|
||||
unzip -q -o "$tmp" "$binary" -d /usr/local/bin/ >>"$INSTALL_LOG" 2>&1 && \
|
||||
chmod +x "/usr/local/bin/$binary" && ok "$name installed" || warn "$name: extraction failed" ;;
|
||||
*)
|
||||
mv "$tmp" "/usr/local/bin/$binary"
|
||||
chmod +x "/usr/local/bin/$binary" && ok "$name installed" || warn "$name: install failed" ;;
|
||||
esac
|
||||
else
|
||||
warn "$name: download failed"
|
||||
fi
|
||||
rm -f "$tmp"
|
||||
}
|
||||
|
||||
# Detect arch for Go binaries
|
||||
case "$ARCH" in
|
||||
x86_64|amd64) BIN_ARCH="amd64" ;;
|
||||
aarch64|arm64) BIN_ARCH="arm64" ;;
|
||||
armv7*) BIN_ARCH="arm" ;;
|
||||
*) BIN_ARCH="amd64"; warn "Unknown arch $ARCH — assuming amd64" ;;
|
||||
esac
|
||||
|
||||
# ── gobuster ──────────────────────────────────────────────────────────────────
|
||||
step "gobuster"
|
||||
if ! has_tool gobuster; then
|
||||
install_go_binary "gobuster" \
|
||||
"https://github.com/OJ/gobuster/releases/latest/download/gobuster_Linux_${BIN_ARCH}.tar.gz" \
|
||||
"gobuster"
|
||||
fi
|
||||
|
||||
# ── ffuf ─────────────────────────────────────────────────────────────────────
|
||||
step "ffuf"
|
||||
if ! has_tool ffuf; then
|
||||
install_go_binary "ffuf" \
|
||||
"https://github.com/ffuf/ffuf/releases/latest/download/ffuf_$(curl -s https://api.github.com/repos/ffuf/ffuf/releases/latest 2>/dev/null | grep -oP '"tag_name": "v\K[^"]+' | head -1 || echo '2.1.0')_linux_${BIN_ARCH}.tar.gz" \
|
||||
"ffuf"
|
||||
fi
|
||||
|
||||
# ── subfinder ─────────────────────────────────────────────────────────────────
|
||||
step "subfinder"
|
||||
if ! has_tool subfinder; then
|
||||
install_go_binary "subfinder" \
|
||||
"https://github.com/projectdiscovery/subfinder/releases/latest/download/subfinder_linux_${BIN_ARCH}.zip" \
|
||||
"subfinder"
|
||||
fi
|
||||
|
||||
# ── dalfox ────────────────────────────────────────────────────────────────────
|
||||
step "dalfox (XSS scanner)"
|
||||
if ! has_tool dalfox; then
|
||||
local DALFOX_VER
|
||||
DALFOX_VER=$(curl -s https://api.github.com/repos/hahwul/dalfox/releases/latest 2>/dev/null | grep -oP '"tag_name": "v\K[^"]+' | head -1 || echo "2.9.1")
|
||||
install_go_binary "dalfox" \
|
||||
"https://github.com/hahwul/dalfox/releases/download/v${DALFOX_VER}/dalfox_linux_${BIN_ARCH}.tar.gz" \
|
||||
"dalfox"
|
||||
fi
|
||||
|
||||
# ── subjack ───────────────────────────────────────────────────────────────────
|
||||
step "subjack (subdomain takeover)"
|
||||
if ! has_tool subjack; then
|
||||
if wget -q "https://github.com/haccer/subjack/releases/latest/download/subjack-linux-${BIN_ARCH}" \
|
||||
-O /usr/local/bin/subjack >>"$INSTALL_LOG" 2>&1; then
|
||||
chmod +x /usr/local/bin/subjack
|
||||
ok "subjack installed"
|
||||
else
|
||||
warn "subjack download failed"
|
||||
fi
|
||||
fi
|
||||
|
||||
# ── nuclei ────────────────────────────────────────────────────────────────────
|
||||
step "nuclei"
|
||||
if ! has_tool nuclei; then
|
||||
install_go_binary "nuclei" \
|
||||
"https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei_linux_${BIN_ARCH}.zip" \
|
||||
"nuclei"
|
||||
fi
|
||||
|
||||
if has_tool nuclei; then
|
||||
info "Updating Nuclei templates..."
|
||||
nuclei -update-templates -silent >>"$INSTALL_LOG" 2>&1 || warn "Template update failed (try: nuclei -update-templates)"
|
||||
ok "Nuclei templates updated"
|
||||
fi
|
||||
|
||||
# ── amass ─────────────────────────────────────────────────────────────────────
|
||||
step "amass"
|
||||
if ! has_tool amass; then
|
||||
if apt-get install -y -qq amass >>"$INSTALL_LOG" 2>&1; then
|
||||
ok "amass installed via apt"
|
||||
else
|
||||
local AMASS_VER
|
||||
AMASS_VER=$(curl -s https://api.github.com/repos/owasp-amass/amass/releases/latest 2>/dev/null | grep -oP '"tag_name": "v\K[^"]+' | head -1 || echo "4.2.0")
|
||||
install_go_binary "amass" \
|
||||
"https://github.com/owasp-amass/amass/releases/download/v${AMASS_VER}/amass_Linux_${BIN_ARCH}.zip" \
|
||||
"amass"
|
||||
fi
|
||||
fi
|
||||
|
||||
# ── droopescan ────────────────────────────────────────────────────────────────
|
||||
step "droopescan (Drupal/Joomla scanner)"
|
||||
if ! has_tool droopescan; then
|
||||
if pip3 install droopescan --quiet >>"$INSTALL_LOG" 2>&1; then
|
||||
ok "droopescan installed"
|
||||
else
|
||||
warn "droopescan installation failed"
|
||||
fi
|
||||
fi
|
||||
|
||||
# ── SecLists wordlists ────────────────────────────────────────────────────────
|
||||
step "SecLists Wordlists"
|
||||
if [[ -d /usr/share/seclists ]]; then
|
||||
ok "SecLists already present at /usr/share/seclists"
|
||||
else
|
||||
# Try apt first
|
||||
if apt-get install -y -qq seclists >>"$INSTALL_LOG" 2>&1; then
|
||||
ok "SecLists installed via apt"
|
||||
else
|
||||
info "Cloning SecLists from GitHub (this may take a while)..."
|
||||
if git clone --depth 1 https://github.com/danielmiessler/SecLists.git \
|
||||
/usr/share/seclists >>"$INSTALL_LOG" 2>&1; then
|
||||
ok "SecLists installed at /usr/share/seclists"
|
||||
else
|
||||
warn "SecLists clone failed — install manually"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
# Decompress rockyou if needed
|
||||
[[ -f /usr/share/wordlists/rockyou.txt.gz && ! -f /usr/share/wordlists/rockyou.txt ]] && \
|
||||
gunzip /usr/share/wordlists/rockyou.txt.gz && ok "rockyou.txt decompressed"
|
||||
|
||||
# ── dnsrecon ──────────────────────────────────────────────────────────────────
|
||||
step "dnsrecon"
|
||||
if ! has_tool dnsrecon; then
|
||||
apt-get install -y -qq dnsrecon >>"$INSTALL_LOG" 2>&1 || \
|
||||
pip3 install dnsrecon --quiet >>"$INSTALL_LOG" 2>&1 || \
|
||||
warn "dnsrecon not installed"
|
||||
has_tool dnsrecon && ok "dnsrecon installed"
|
||||
fi
|
||||
|
||||
# ── Final summary ─────────────────────────────────────────────────────────────
|
||||
echo ""
|
||||
echo -e "${C_BOLD}${C_CYAN} ═══════════════════════════════════════════════════${C_RESET}"
|
||||
echo -e "${C_BOLD} Installation Summary${C_RESET}"
|
||||
echo ""
|
||||
|
||||
TOOLS=(
|
||||
"curl" "nmap" "nikto" "sqlmap" "gobuster" "ffuf" "dirb"
|
||||
"whatweb" "wafw00f" "sslscan" "testssl.sh" "wpscan"
|
||||
"subfinder" "amass" "dnsrecon" "dalfox" "subjack" "nuclei"
|
||||
"droopescan" "dig" "host" "whois" "jq" "python3" "ruby"
|
||||
)
|
||||
|
||||
installed=0; missing=0
|
||||
for t in "${TOOLS[@]}"; do
|
||||
if has_tool "$t"; then
|
||||
printf " ${C_GREEN}✔${C_RESET} %-20s %s\n" "$t" "($(command -v "$t"))"
|
||||
installed=$((installed + 1))
|
||||
else
|
||||
printf " ${C_YELLOW}○${C_RESET} %-20s %s\n" "$t" "(not found)"
|
||||
missing=$((missing + 1))
|
||||
fi
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo -e " ${C_BOLD}Installed: ${C_GREEN}${installed}${C_RESET} | ${C_BOLD}Missing: ${C_YELLOW}${missing}${C_RESET}"
|
||||
echo ""
|
||||
echo -e " ${C_DIM}Full log: ${INSTALL_LOG}${C_RESET}"
|
||||
echo ""
|
||||
echo -e " ${C_BOLD}Usage:${C_RESET}"
|
||||
echo " chmod +x websec-audit.sh"
|
||||
echo " ./websec-audit.sh -t https://target.com"
|
||||
echo " ./websec-audit.sh -t https://target.com --aggressive -T 20"
|
||||
echo ""
|
||||
+2533
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user