mirror of
https://github.com/davidalvarezp/websec-audit.git
synced 2026-06-23 11:48:28 +02:00
v1.0.1
This commit is contained in:
davidalvarezp
@@ -0,0 +1,73 @@
|
|||||||
|
---
|
||||||
|
name: Bug Report
|
||||||
|
about: Report a bug or unexpected behaviour in websec-audit
|
||||||
|
title: "[BUG] "
|
||||||
|
labels: bug
|
||||||
|
assignees: davidalvarezp
|
||||||
|
---
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
<!-- A clear and concise description of the bug -->
|
||||||
|
|
||||||
|
## Steps to Reproduce
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Exact command you ran (redact the target)
|
||||||
|
./websec-audit.sh -t https://REDACTED --option
|
||||||
|
```
|
||||||
|
|
||||||
|
1. Run the above command
|
||||||
|
2. See error / unexpected behaviour in module: **[MODULE NAME]**
|
||||||
|
|
||||||
|
## Expected Behaviour
|
||||||
|
|
||||||
|
<!-- What you expected to happen -->
|
||||||
|
|
||||||
|
## Actual Behaviour
|
||||||
|
|
||||||
|
<!-- What actually happened. Include relevant log output below -->
|
||||||
|
|
||||||
|
<details>
|
||||||
|
<summary>Log output (redact sensitive data)</summary>
|
||||||
|
|
||||||
|
```
|
||||||
|
paste relevant log lines here
|
||||||
|
```
|
||||||
|
|
||||||
|
</details>
|
||||||
|
|
||||||
|
## Environment
|
||||||
|
|
||||||
|
| Item | Details |
|
||||||
|
|------|---------|
|
||||||
|
| websec-audit version | `./websec-audit.sh -V` |
|
||||||
|
| OS / Distro | e.g. Debian 12, Ubuntu 22.04, Kali 2024.1 |
|
||||||
|
| Bash version | `bash --version` |
|
||||||
|
| Affected tool | e.g. nmap, sqlmap, gobuster |
|
||||||
|
| Tool version | e.g. `nmap --version` |
|
||||||
|
|
||||||
|
## Module
|
||||||
|
|
||||||
|
- [ ] Recon
|
||||||
|
- [ ] Port Scan
|
||||||
|
- [ ] Fingerprint
|
||||||
|
- [ ] SSL/TLS
|
||||||
|
- [ ] HTTP Headers
|
||||||
|
- [ ] Dir/File Enum
|
||||||
|
- [ ] Nikto
|
||||||
|
- [ ] SQLi
|
||||||
|
- [ ] XSS
|
||||||
|
- [ ] CMS
|
||||||
|
- [ ] CORS
|
||||||
|
- [ ] Open Redirect
|
||||||
|
- [ ] SSRF
|
||||||
|
- [ ] Subdomain Takeover
|
||||||
|
- [ ] Nuclei
|
||||||
|
- [ ] Reporting
|
||||||
|
- [ ] Install / Dependencies
|
||||||
|
- [ ] Other
|
||||||
|
|
||||||
|
## Additional Context
|
||||||
|
|
||||||
|
<!-- Any other context, screenshots, or information that might help -->
|
||||||
@@ -0,0 +1,42 @@
|
|||||||
|
---
|
||||||
|
name: Feature Request
|
||||||
|
about: Suggest a new module, option, or improvement
|
||||||
|
title: "[FEAT] "
|
||||||
|
labels: enhancement
|
||||||
|
assignees: davidalvarezp
|
||||||
|
---
|
||||||
|
|
||||||
|
## Summary
|
||||||
|
|
||||||
|
<!-- A concise one-sentence summary of what you'd like -->
|
||||||
|
|
||||||
|
## Problem / Motivation
|
||||||
|
|
||||||
|
<!-- What problem does this solve? What security gap does it address? -->
|
||||||
|
|
||||||
|
## Proposed Solution
|
||||||
|
|
||||||
|
<!-- Describe how you'd like it to work. Include example CLI usage if applicable -->
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Example usage
|
||||||
|
./websec-audit.sh -t https://target.com --new-option
|
||||||
|
```
|
||||||
|
|
||||||
|
## Tools / Techniques Involved
|
||||||
|
|
||||||
|
<!-- What tools, techniques, or vulnerability classes would this cover? -->
|
||||||
|
|
||||||
|
## Alternatives Considered
|
||||||
|
|
||||||
|
<!-- Any alternative solutions or workarounds you've already explored -->
|
||||||
|
|
||||||
|
## Acceptance Criteria
|
||||||
|
|
||||||
|
<!-- How would you verify the feature is working correctly? -->
|
||||||
|
- [ ] ...
|
||||||
|
- [ ] ...
|
||||||
|
|
||||||
|
## Additional Context
|
||||||
|
|
||||||
|
<!-- Links, CVEs, research papers, or other context that may be helpful -->
|
||||||
@@ -0,0 +1,68 @@
|
|||||||
|
## Summary
|
||||||
|
|
||||||
|
<!-- One paragraph describing what this PR does and why -->
|
||||||
|
|
||||||
|
## Type of Change
|
||||||
|
|
||||||
|
- [ ] 🐛 Bug fix
|
||||||
|
- [ ] ✨ New feature / module
|
||||||
|
- [ ] 📝 Documentation update
|
||||||
|
- [ ] ♻️ Refactor (no functional changes)
|
||||||
|
- [ ] ⚡ Performance improvement
|
||||||
|
- [ ] 🔧 Chore / maintenance
|
||||||
|
|
||||||
|
## Related Issue(s)
|
||||||
|
|
||||||
|
<!-- Closes #XXX | Fixes #XXX | Resolves #XXX -->
|
||||||
|
|
||||||
|
## Changes Made
|
||||||
|
|
||||||
|
<!-- List the key changes in bullet points -->
|
||||||
|
-
|
||||||
|
-
|
||||||
|
-
|
||||||
|
|
||||||
|
## Module(s) Affected
|
||||||
|
|
||||||
|
- [ ] Recon
|
||||||
|
- [ ] Port Scan
|
||||||
|
- [ ] Fingerprint
|
||||||
|
- [ ] SSL/TLS
|
||||||
|
- [ ] HTTP Headers
|
||||||
|
- [ ] Dir/File Enum
|
||||||
|
- [ ] Nikto
|
||||||
|
- [ ] SQLi
|
||||||
|
- [ ] XSS
|
||||||
|
- [ ] CMS
|
||||||
|
- [ ] CORS
|
||||||
|
- [ ] Open Redirect
|
||||||
|
- [ ] SSRF
|
||||||
|
- [ ] Subdomain Takeover
|
||||||
|
- [ ] Nuclei
|
||||||
|
- [ ] Reporting / Output
|
||||||
|
- [ ] Install script
|
||||||
|
- [ ] Documentation
|
||||||
|
|
||||||
|
## Testing
|
||||||
|
|
||||||
|
<!-- Describe how you tested this PR -->
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Commands used to test
|
||||||
|
./websec-audit.sh -t https://REDACTED --your-new-option
|
||||||
|
```
|
||||||
|
|
||||||
|
- [ ] Tested on Debian / Ubuntu
|
||||||
|
- [ ] Tested with `--aggressive` mode
|
||||||
|
- [ ] Tested with `--stealth` mode
|
||||||
|
- [ ] Tested with `--skip-<module>` to ensure skip works
|
||||||
|
- [ ] `shellcheck -S warning websec-audit.sh` passes with zero warnings
|
||||||
|
|
||||||
|
## Checklist
|
||||||
|
|
||||||
|
- [ ] Code follows the style guidelines in [CONTRIBUTING.md](../CONTRIBUTING.md)
|
||||||
|
- [ ] Self-review completed
|
||||||
|
- [ ] New module added to `README.md` module table
|
||||||
|
- [ ] `CHANGELOG.md` updated under `[Unreleased]`
|
||||||
|
- [ ] No hardcoded credentials, IPs, or sensitive data
|
||||||
|
- [ ] All findings go through `add_finding()` — not written directly to files
|
||||||
@@ -0,0 +1,66 @@
|
|||||||
|
name: CI — Shell Quality Check
|
||||||
|
|
||||||
|
on:
|
||||||
|
push:
|
||||||
|
branches: [main, develop]
|
||||||
|
pull_request:
|
||||||
|
branches: [main]
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
shellcheck:
|
||||||
|
name: ShellCheck
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: Checkout repository
|
||||||
|
uses: actions/checkout@v4
|
||||||
|
|
||||||
|
- name: Install ShellCheck
|
||||||
|
run: sudo apt-get install -y shellcheck
|
||||||
|
|
||||||
|
- name: Run ShellCheck on websec-audit.sh
|
||||||
|
run: |
|
||||||
|
shellcheck -S warning \
|
||||||
|
--shell=bash \
|
||||||
|
--exclude=SC2086 \
|
||||||
|
websec-audit.sh
|
||||||
|
# SC2086: Double-quote to prevent globbing — intentionally disabled
|
||||||
|
# for nmap/sqlmap/gobuster flag passing which requires word splitting
|
||||||
|
|
||||||
|
- name: Run ShellCheck on install.sh
|
||||||
|
run: |
|
||||||
|
shellcheck -S warning \
|
||||||
|
--shell=bash \
|
||||||
|
install.sh
|
||||||
|
|
||||||
|
syntax-check:
|
||||||
|
name: Bash Syntax Check
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: Checkout repository
|
||||||
|
uses: actions/checkout@v4
|
||||||
|
|
||||||
|
- name: Check bash syntax — websec-audit.sh
|
||||||
|
run: bash -n websec-audit.sh && echo "Syntax OK"
|
||||||
|
|
||||||
|
- name: Check bash syntax — install.sh
|
||||||
|
run: bash -n install.sh && echo "Syntax OK"
|
||||||
|
|
||||||
|
permissions-check:
|
||||||
|
name: File Permissions
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: Checkout repository
|
||||||
|
uses: actions/checkout@v4
|
||||||
|
|
||||||
|
- name: Check scripts are executable
|
||||||
|
run: |
|
||||||
|
for script in websec-audit.sh install.sh; do
|
||||||
|
if [[ ! -x "$script" ]]; then
|
||||||
|
echo "ERROR: $script is not executable"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
echo "OK: $script is executable"
|
||||||
|
done
|
||||||
+105
@@ -0,0 +1,105 @@
|
|||||||
|
# ─── websec-audit .gitignore ──────────────────────────────────────────────────
|
||||||
|
|
||||||
|
# Scan results (never commit target data)
|
||||||
|
results_*/
|
||||||
|
/results/
|
||||||
|
*.results/
|
||||||
|
|
||||||
|
# Log files
|
||||||
|
*.log
|
||||||
|
logs/
|
||||||
|
|
||||||
|
# Reports generated by the tool
|
||||||
|
reports/
|
||||||
|
*.html
|
||||||
|
*.json
|
||||||
|
!package.json
|
||||||
|
!composer.json
|
||||||
|
|
||||||
|
# Raw finding dumps
|
||||||
|
findings.jsonl
|
||||||
|
findings_raw.jsonl
|
||||||
|
|
||||||
|
# Backup files
|
||||||
|
*.bak
|
||||||
|
*.backup
|
||||||
|
*.orig
|
||||||
|
*.old
|
||||||
|
*.tmp
|
||||||
|
*.swp
|
||||||
|
*~
|
||||||
|
|
||||||
|
# OS files
|
||||||
|
.DS_Store
|
||||||
|
.DS_Store?
|
||||||
|
._*
|
||||||
|
.Spotlight-V100
|
||||||
|
.Trashes
|
||||||
|
ehthumbs.db
|
||||||
|
Thumbs.db
|
||||||
|
desktop.ini
|
||||||
|
|
||||||
|
# Editor files
|
||||||
|
.idea/
|
||||||
|
.vscode/
|
||||||
|
*.sublime-project
|
||||||
|
*.sublime-workspace
|
||||||
|
.project
|
||||||
|
.classpath
|
||||||
|
|
||||||
|
# Python
|
||||||
|
__pycache__/
|
||||||
|
*.py[cod]
|
||||||
|
*$py.class
|
||||||
|
*.egg-info/
|
||||||
|
dist/
|
||||||
|
build/
|
||||||
|
.eggs/
|
||||||
|
*.egg
|
||||||
|
.venv/
|
||||||
|
venv/
|
||||||
|
env/
|
||||||
|
|
||||||
|
# Ruby gems
|
||||||
|
*.gem
|
||||||
|
.bundle/
|
||||||
|
vendor/bundle/
|
||||||
|
|
||||||
|
# Go
|
||||||
|
bin/
|
||||||
|
pkg/
|
||||||
|
|
||||||
|
# Archives
|
||||||
|
*.zip
|
||||||
|
*.tar.gz
|
||||||
|
*.tar.bz2
|
||||||
|
*.tgz
|
||||||
|
|
||||||
|
# Temp directories
|
||||||
|
tmp/
|
||||||
|
temp/
|
||||||
|
.tmp/
|
||||||
|
cache/
|
||||||
|
|
||||||
|
# CI/CD secrets
|
||||||
|
.env
|
||||||
|
.env.*
|
||||||
|
!.env.example
|
||||||
|
secrets.txt
|
||||||
|
credentials
|
||||||
|
|
||||||
|
# Wordlists (too large for git; users install via apt/seclists)
|
||||||
|
wordlists/
|
||||||
|
*.wordlist
|
||||||
|
*.dict
|
||||||
|
rockyou.txt
|
||||||
|
|
||||||
|
# nmap output
|
||||||
|
*.nmap
|
||||||
|
*.gnmap
|
||||||
|
*.xml.bak
|
||||||
|
|
||||||
|
# Output from specific tools
|
||||||
|
sqlmap_output/
|
||||||
|
nikto_reports/
|
||||||
|
testssl_output/
|
||||||
@@ -0,0 +1,67 @@
|
|||||||
|
# Changelog
|
||||||
|
|
||||||
|
All notable changes to **websec-audit** are documented in this file.
|
||||||
|
|
||||||
|
The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
||||||
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## [1.0.1] — 2026-03-23
|
||||||
|
|
||||||
|
### Added
|
||||||
|
- **Module 15 — Nuclei** template scan integration (severity-filtered)
|
||||||
|
- **Module 14 — Subdomain Takeover**: `subjack` + Nuclei + manual CNAME analysis for 20+ services
|
||||||
|
- **Module 13 — SSRF**: cloud IMDS probing (AWS, GCP, Azure), decimal/hex IP encoding
|
||||||
|
- **Module 12 — Open Redirect**: 20 parameters × 10 redirect payloads
|
||||||
|
- **Module 11 — CORS**: null origin, credentialed cross-origin, wildcard detection
|
||||||
|
- **Module 10 — CMS**: WordPress REST API user enumeration, debug.log, xmlrpc.php checks
|
||||||
|
- **Module 09 — XSS**: dalfox integration + 8 reflected XSS payloads × 15 parameters
|
||||||
|
- **Module 08 — SQLi**: sqlmap with forms crawl in aggressive mode, tamper scripts
|
||||||
|
- **Module 07 — Nikto**: severity-based finding classification
|
||||||
|
- **Module 06 — Dir Enum**: 40 sensitive path probes (`.git`, `.env`, AWS credentials, Dockerfiles, etc.)
|
||||||
|
- **Module 05 — HTTP Headers**: CSP audit (unsafe-inline, wildcards), SameSite=None+Secure, Cache-Control
|
||||||
|
- **Module 04 — SSL/TLS**: CAA records, HSTS preload, cert expiry thresholds (14/30/90 days)
|
||||||
|
- **Module 03 — Fingerprint**: WAF detection via wafw00f, version-leaking header enumeration
|
||||||
|
- **Module 02 — Port Scan**: risk-based analysis for 20+ dangerous ports
|
||||||
|
- **Module 01 — Recon**: SPF `+all` detection, DMARC `p=none` warning, 700+ Google Dorks
|
||||||
|
- Interactive HTML report with severity filter, live search, and risk bar
|
||||||
|
- JSON report with full metadata envelope
|
||||||
|
- `--format json|html|txt|all` flag
|
||||||
|
- `--no-banner` flag for scripting/CI use
|
||||||
|
- `--version` / `-V` flag
|
||||||
|
- Graceful interrupt handling — generates partial reports on SIGINT/SIGTERM
|
||||||
|
- Signal trap generates partial report on Ctrl-C
|
||||||
|
- `findings.jsonl` raw log for programmatic processing
|
||||||
|
- Aggressive mode: nmap `-A -O --script=vuln,auth`, sqlmap level 5 + tamper, deep DOM XSS
|
||||||
|
- Stealth mode: nmap `-sS -T2 -f`, sqlmap delay, randomised ordering
|
||||||
|
- Tool availability graceful degradation — all modules have fallbacks
|
||||||
|
|
||||||
|
### Changed
|
||||||
|
- Fully rewritten in English for international audience
|
||||||
|
- Modular `module_*()` function architecture — each module independently skippable
|
||||||
|
- `add_finding()` now emits structured JSONL with id, severity, module, title, description, evidence, recommendation, and RFC3339 timestamp
|
||||||
|
- `_curl()` wrapper with retry, consistent UA, proxy, and timeout
|
||||||
|
- Output directory structure reorganised into `recon/`, `portscan/`, `ssl/`, `headers/`, `dirs/`, `vulns/`, `cms/`, `misc/`, `reports/`, `logs/`
|
||||||
|
- HTML report: dark theme, sticky table headers, responsive grid
|
||||||
|
|
||||||
|
### Fixed
|
||||||
|
- SPF record detection now handles multi-TXT records correctly
|
||||||
|
- HSTS max-age check handles missing header without error
|
||||||
|
- nmap output parsing compatible with both GNU and BSD grep
|
||||||
|
- JSON report correctly handles multi-line evidence strings
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## [1.0.0] — 2026-01-13
|
||||||
|
|
||||||
|
### Added
|
||||||
|
- Initial release
|
||||||
|
- Core modules: recon, port scan, SSL, headers, dir brute-force, nikto, sqlmap
|
||||||
|
- Basic HTML report
|
||||||
|
- Spanish-language interface
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
[1.0.1]: https://github.com/davidalvarezp/websec-audit/compare/v1.0.0...v1.0.1
|
||||||
|
[1.0.0]: https://github.com/davidalvarezp/websec-audit/releases/tag/v1.0.0
|
||||||
+193
@@ -0,0 +1,193 @@
|
|||||||
|
# Contributing to websec-audit
|
||||||
|
|
||||||
|
Thank you for your interest in contributing to **websec-audit**!
|
||||||
|
All contributions are welcome — bug reports, feature requests, documentation improvements, new modules, and code fixes.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Table of Contents
|
||||||
|
|
||||||
|
- [Code of Conduct](#code-of-conduct)
|
||||||
|
- [How to Contribute](#how-to-contribute)
|
||||||
|
- [Development Guidelines](#development-guidelines)
|
||||||
|
- [Adding a New Module](#adding-a-new-module)
|
||||||
|
- [Commit Conventions](#commit-conventions)
|
||||||
|
- [Pull Request Process](#pull-request-process)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Code of Conduct
|
||||||
|
|
||||||
|
By participating in this project, you agree to:
|
||||||
|
|
||||||
|
- Be respectful and constructive in all communications
|
||||||
|
- Only contribute code intended for **authorised security testing**
|
||||||
|
- Not submit payloads, exploits, or code designed to harm systems without consent
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## How to Contribute
|
||||||
|
|
||||||
|
### Reporting Bugs
|
||||||
|
|
||||||
|
1. Search [existing issues](https://github.com/davidalvarezp/websec-audit/issues) first
|
||||||
|
2. Open a new issue using the **Bug Report** template
|
||||||
|
3. Include: OS version, tool versions, reproduction steps, expected vs actual behaviour
|
||||||
|
|
||||||
|
### Requesting Features
|
||||||
|
|
||||||
|
1. Open an issue using the **Feature Request** template
|
||||||
|
2. Describe the use case and expected output clearly
|
||||||
|
|
||||||
|
### Code Contributions
|
||||||
|
|
||||||
|
1. **Fork** the repository
|
||||||
|
2. **Clone** your fork: `git clone https://github.com/YOUR_USER/websec-audit.git`
|
||||||
|
3. Create a **feature branch**: `git checkout -b feature/your-feature-name`
|
||||||
|
4. Make your changes following the guidelines below
|
||||||
|
5. **Test** your changes
|
||||||
|
6. **Commit** using conventional commits (see below)
|
||||||
|
7. **Push**: `git push origin feature/your-feature-name`
|
||||||
|
8. Open a **Pull Request** against `main`
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Development Guidelines
|
||||||
|
|
||||||
|
### Shell Style
|
||||||
|
|
||||||
|
- Target **bash 5.0+** — no POSIX-only constraints, but avoid bash 5.1+ exclusive syntax
|
||||||
|
- Use `set -euo pipefail` and `IFS=$'\n\t'` at the top of every script
|
||||||
|
- Quote all variable expansions: `"$var"` not `$var`
|
||||||
|
- Use `[[ ]]` for conditions, not `[ ]`
|
||||||
|
- Prefer `local` variables inside functions
|
||||||
|
- Run `shellcheck` on your changes before submitting:
|
||||||
|
```bash
|
||||||
|
shellcheck -S warning websec-audit.sh
|
||||||
|
```
|
||||||
|
|
||||||
|
### Naming Conventions
|
||||||
|
|
||||||
|
| Item | Convention | Example |
|
||||||
|
|------|-----------|---------|
|
||||||
|
| Functions | `snake_case` | `module_sqli()` |
|
||||||
|
| Constants | `UPPER_SNAKE` | `readonly TOOL_VERSION` |
|
||||||
|
| Global vars | `UPPER_SNAKE` | `OPT_AGGRESSIVE` |
|
||||||
|
| Local vars | `lower_snake` | `local scan_target` |
|
||||||
|
| Module flags | `MOD_NAME` | `MOD_SQLI` |
|
||||||
|
| Option flags | `OPT_NAME` | `OPT_THREADS` |
|
||||||
|
|
||||||
|
### Error Handling
|
||||||
|
|
||||||
|
- Never silently ignore errors — use `|| true` only when failure is genuinely acceptable
|
||||||
|
- Use `log_warn` when a tool is missing; the script must continue
|
||||||
|
- Use `log_error` + `exit 1` only for unrecoverable conditions (missing required tool, invalid target)
|
||||||
|
- All findings must go through `add_finding()` — never write directly to reports
|
||||||
|
|
||||||
|
### Performance
|
||||||
|
|
||||||
|
- Respect `OPT_THREADS` and `OPT_TIMEOUT` in all external tool calls
|
||||||
|
- Use `timeout` around all network operations
|
||||||
|
- Avoid unnecessary subshells in tight loops
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Adding a New Module
|
||||||
|
|
||||||
|
1. Add a toggle variable in the global section:
|
||||||
|
```bash
|
||||||
|
MOD_MYMODULE=1
|
||||||
|
```
|
||||||
|
|
||||||
|
2. Add a `--skip-mymodule` argument in `parse_args()`:
|
||||||
|
```bash
|
||||||
|
--skip-mymodule) MOD_MYMODULE=0; shift ;;
|
||||||
|
```
|
||||||
|
|
||||||
|
3. Add the `--skip-mymodule` entry to the help text in `print_usage()`.
|
||||||
|
|
||||||
|
4. Write the module function following this template:
|
||||||
|
```bash
|
||||||
|
# ─────────────────────────────────────────────────────────────────────────────
|
||||||
|
# MODULE XX — YOUR MODULE NAME
|
||||||
|
# ─────────────────────────────────────────────────────────────────────────────
|
||||||
|
module_mymodule() {
|
||||||
|
[[ $MOD_MYMODULE -eq 0 ]] && return
|
||||||
|
log_section "MODULE XX — YOUR MODULE NAME"
|
||||||
|
|
||||||
|
local out_dir="${OUTPUT_DIR}/misc"
|
||||||
|
|
||||||
|
# Check for optional tools
|
||||||
|
if ! has_tool mytool; then
|
||||||
|
log_warn "mytool not available — skipping related checks"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ... your logic ...
|
||||||
|
|
||||||
|
# Register findings
|
||||||
|
add_finding "HIGH" "MYMODULE" "Short finding title" \
|
||||||
|
"Detailed description of what was found." \
|
||||||
|
"evidence string" \
|
||||||
|
"Remediation recommendation."
|
||||||
|
|
||||||
|
log_info "Module results → $out_dir"
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
5. Call the module in `main()` after `module_cms` and before `generate_reports`.
|
||||||
|
|
||||||
|
6. Add the module to the table in `README.md`.
|
||||||
|
|
||||||
|
7. Add an entry to `CHANGELOG.md` under `[Unreleased]`.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Commit Conventions
|
||||||
|
|
||||||
|
We use [Conventional Commits](https://www.conventionalcommits.org/):
|
||||||
|
|
||||||
|
```
|
||||||
|
<type>(<scope>): <short description>
|
||||||
|
|
||||||
|
[optional body]
|
||||||
|
|
||||||
|
[optional footer]
|
||||||
|
```
|
||||||
|
|
||||||
|
### Types
|
||||||
|
|
||||||
|
| Type | When to use |
|
||||||
|
|------|------------|
|
||||||
|
| `feat` | New feature or module |
|
||||||
|
| `fix` | Bug fix |
|
||||||
|
| `docs` | Documentation only |
|
||||||
|
| `refactor` | Code change that neither fixes a bug nor adds a feature |
|
||||||
|
| `perf` | Performance improvement |
|
||||||
|
| `test` | Adding or updating tests |
|
||||||
|
| `chore` | Build process, dependency updates |
|
||||||
|
|
||||||
|
### Examples
|
||||||
|
|
||||||
|
```bash
|
||||||
|
feat(module): add GraphQL introspection detection
|
||||||
|
fix(ssl): handle certificates with no expiry date gracefully
|
||||||
|
docs(readme): add Kali Linux installation instructions
|
||||||
|
refactor(headers): extract cookie analysis into helper function
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Pull Request Process
|
||||||
|
|
||||||
|
1. **One PR per feature/fix** — keep changes focused and reviewable
|
||||||
|
2. **Update documentation** — README, CHANGELOG, and inline comments
|
||||||
|
3. **Describe your PR** — fill in the PR template completely
|
||||||
|
4. **Pass shellcheck** — zero warnings on `websec-audit.sh` and `install.sh`
|
||||||
|
5. **Test manually** — run the affected module(s) against a test target (DVWA, HackTheBox, your own lab)
|
||||||
|
|
||||||
|
PRs will be reviewed within 5 business days. Feedback will be given constructively.
|
||||||
|
Once approved, a maintainer will merge it into `main`.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
Thank you for helping make **websec-audit** better! 🔐
|
||||||
@@ -0,0 +1,44 @@
|
|||||||
|
MIT License
|
||||||
|
|
||||||
|
Copyright (c) 2026 davidalvarezp
|
||||||
|
|
||||||
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||||
|
of this software and associated documentation files (the "Software"), to deal
|
||||||
|
in the Software without restriction, including without limitation the rights
|
||||||
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||||
|
copies of the Software, and to permit persons to whom the Software is
|
||||||
|
furnished to do so, subject to the following conditions:
|
||||||
|
|
||||||
|
The above copyright notice and this permission notice shall be included in all
|
||||||
|
copies or substantial portions of the Software.
|
||||||
|
|
||||||
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||||
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||||
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||||
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||||
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||||
|
SOFTWARE.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
ADDITIONAL NOTICE
|
||||||
|
|
||||||
|
This software is designed for legitimate security research and authorized
|
||||||
|
penetration testing only. The author, davidalvarezp, is not responsible
|
||||||
|
for any misuse or damage caused by this program.
|
||||||
|
|
||||||
|
Users are solely responsible for ensuring they have proper written
|
||||||
|
authorization before running this tool against any system. Unauthorized use
|
||||||
|
against computer systems is illegal and may result in civil and/or criminal
|
||||||
|
prosecution under applicable law, including but not limited to:
|
||||||
|
|
||||||
|
- Directive 2013/40/EU on attacks against information systems — European Union
|
||||||
|
- Ley Orgánica 10/1995 (Código Penal, arts. 197-200) — Spain
|
||||||
|
- Computer Fraud and Abuse Act (CFAA) — United States
|
||||||
|
- Computer Misuse Act (CMA) — United Kingdom
|
||||||
|
|
||||||
|
|
||||||
|
By using this software, you agree to comply with all applicable laws and
|
||||||
|
regulations, and you confirm that you have obtained all necessary permissions
|
||||||
|
from the system owner(s) before conducting any security assessment.
|
||||||
@@ -0,0 +1,355 @@
|
|||||||
|
<div align="center">
|
||||||
|
|
||||||
|
# 🔐 websec-audit
|
||||||
|
|
||||||
|
**Professional Web Security Audit Framework**
|
||||||
|
|
||||||
|
[](https://github.com/davidalvarezp/websec-audit/releases)
|
||||||
|
[](LICENSE)
|
||||||
|
[](https://www.gnu.org/software/bash/)
|
||||||
|
[](https://github.com/davidalvarezp/websec-audit)
|
||||||
|
[](https://github.com/davidalvarezp/websec-audit/commits/main)
|
||||||
|
|
||||||
|
A modular, extensible Bash framework for **comprehensive web application security assessments**.
|
||||||
|
Automates 15+ attack surface modules, generates structured logs, and produces professional reports in HTML, JSON and TXT.
|
||||||
|
|
||||||
|
[Features](#-features) · [Installation](#-installation) · [Usage](#-usage) · [Modules](#-modules) · [Output](#-output) · [Contributing](#-contributing)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
</div>
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## ⚠️ Legal Disclaimer
|
||||||
|
|
||||||
|
> **This tool is intended exclusively for authorised security assessments.**
|
||||||
|
> Only run it against systems you own or have **explicit written permission** to test.
|
||||||
|
> Unauthorised use against third-party systems is illegal and may result in criminal prosecution.
|
||||||
|
> The author assumes **no liability** whatsoever for misuse of this software.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## ✨ Features
|
||||||
|
|
||||||
|
- **15+ security modules** — recon, port scanning, SSL/TLS, headers, SQLi, XSS, CMS, CORS, SSRF, subdomain takeover, and more
|
||||||
|
- **Modular architecture** — enable or disable any module independently via `--skip-<module>`
|
||||||
|
- **Three scan modes** — Normal, Aggressive (`--aggressive`), Stealth (`--stealth`)
|
||||||
|
- **Professional reporting** — interactive HTML dashboard, structured JSON, and plain-text log
|
||||||
|
- **Tool-agnostic** — gracefully degrades to fallbacks when optional tools are absent
|
||||||
|
- **Smart finding engine** — findings stored as JSONL with severity, module, evidence, and remediation
|
||||||
|
- **Proxy support** — route all traffic through Burp Suite or any HTTP proxy
|
||||||
|
- **CVSS-aligned severities** — CRITICAL / HIGH / MEDIUM / LOW / INFO
|
||||||
|
- **Zero external dependencies** — core scan works with only `curl` and `nmap`
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📦 Installation
|
||||||
|
|
||||||
|
### Quick Install (recommended)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
git clone https://github.com/davidalvarezp/websec-audit.git
|
||||||
|
cd websec-audit
|
||||||
|
chmod +x install.sh websec-audit.sh
|
||||||
|
sudo ./install.sh
|
||||||
|
```
|
||||||
|
|
||||||
|
### Manual (Debian/Ubuntu)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Required
|
||||||
|
sudo apt-get install -y curl nmap
|
||||||
|
|
||||||
|
# Recommended
|
||||||
|
sudo apt-get install -y nikto sqlmap gobuster whatweb wafw00f sslscan \
|
||||||
|
python3 python3-pip jq ruby dirb dnsutils whois wordlists
|
||||||
|
|
||||||
|
# Optional (improves coverage significantly)
|
||||||
|
pip3 install droopescan
|
||||||
|
gem install wpscan --no-document
|
||||||
|
git clone --depth 1 https://github.com/drwetter/testssl.sh.git /opt/testssl.sh
|
||||||
|
sudo ln -s /opt/testssl.sh/testssl.sh /usr/local/bin/testssl.sh
|
||||||
|
```
|
||||||
|
|
||||||
|
### Kali Linux
|
||||||
|
|
||||||
|
Most tools are pre-installed. Run:
|
||||||
|
```bash
|
||||||
|
sudo apt-get install -y gobuster dalfox subjack nuclei subfinder
|
||||||
|
./install.sh # handles remaining gaps
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🚀 Usage
|
||||||
|
|
||||||
|
### Basic
|
||||||
|
|
||||||
|
```bash
|
||||||
|
./websec-audit.sh -t https://target.com
|
||||||
|
```
|
||||||
|
|
||||||
|
### Aggressive (deeper, noisier)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
./websec-audit.sh -t https://target.com --aggressive -T 20
|
||||||
|
```
|
||||||
|
|
||||||
|
### Stealth (slower, lower detection footprint)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
./websec-audit.sh -t https://target.com --stealth
|
||||||
|
```
|
||||||
|
|
||||||
|
### Through a proxy (Burp Suite)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
./websec-audit.sh -t https://target.com --proxy http://127.0.0.1:8080
|
||||||
|
```
|
||||||
|
|
||||||
|
### Custom output directory and JSON-only report
|
||||||
|
|
||||||
|
```bash
|
||||||
|
./websec-audit.sh -t https://target.com -o /tmp/audit --format json
|
||||||
|
```
|
||||||
|
|
||||||
|
### Skip specific modules
|
||||||
|
|
||||||
|
```bash
|
||||||
|
./websec-audit.sh -t https://target.com --skip-nikto --skip-sqli --skip-cms -v
|
||||||
|
```
|
||||||
|
|
||||||
|
### Full port scan with aggressive mode
|
||||||
|
|
||||||
|
```bash
|
||||||
|
./websec-audit.sh -t https://target.com --ports full --aggressive --depth 5
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📋 Full Options Reference
|
||||||
|
|
||||||
|
```
|
||||||
|
REQUIRED
|
||||||
|
-t, --target <url|ip> Target URL or IP address
|
||||||
|
|
||||||
|
OUTPUT
|
||||||
|
-o, --output <dir> Output directory
|
||||||
|
--format <fmt> json | html | txt | all (default: all)
|
||||||
|
|
||||||
|
SCAN OPTIONS
|
||||||
|
-T, --threads <n> Concurrent threads (default: 10)
|
||||||
|
-p, --ports <profile> top-100 | top-1000 | full (default: top-1000)
|
||||||
|
--timeout <s> Connection timeout (default: 10)
|
||||||
|
--depth <n> Crawl depth (default: 3)
|
||||||
|
--proxy <url> HTTP/HTTPS proxy
|
||||||
|
--aggressive Aggressive mode
|
||||||
|
--stealth Stealth mode
|
||||||
|
|
||||||
|
MODULE CONTROL (--skip-<module>)
|
||||||
|
--skip-recon WHOIS, DNS, subdomain enumeration
|
||||||
|
--skip-portscan nmap port scanning
|
||||||
|
--skip-fingerprint WhatWeb, WAF detection
|
||||||
|
--skip-ssl SSL/TLS analysis
|
||||||
|
--skip-headers HTTP security headers
|
||||||
|
--skip-dirbrute Directory/file brute-forcing
|
||||||
|
--skip-nikto Nikto web scanner
|
||||||
|
--skip-sqli SQL injection (sqlmap)
|
||||||
|
--skip-xss XSS (dalfox + manual)
|
||||||
|
--skip-cms CMS detection & scanning
|
||||||
|
--skip-cors CORS misconfiguration
|
||||||
|
--skip-redirect Open redirect
|
||||||
|
--skip-ssrf SSRF
|
||||||
|
--skip-subtakeover Subdomain takeover
|
||||||
|
--skip-nuclei Nuclei template scan
|
||||||
|
|
||||||
|
WORDLISTS
|
||||||
|
--wl-dirs-small <file> Small wordlist for directory brute-force
|
||||||
|
--wl-dirs-big <file> Large wordlist for directory brute-force
|
||||||
|
--wl-dns <file> DNS subdomain wordlist
|
||||||
|
|
||||||
|
MISC
|
||||||
|
-v, --verbose Verbose output
|
||||||
|
--no-color Disable ANSI colors
|
||||||
|
--no-banner Suppress banner
|
||||||
|
-V, --version Version info
|
||||||
|
-h, --help Help
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🔍 Modules
|
||||||
|
|
||||||
|
| # | Module | Description | Key Tools |
|
||||||
|
|---|--------|-------------|-----------|
|
||||||
|
| 00 | **Target Info** | Resolve IP, initialise directories | `dig`, `host` |
|
||||||
|
| 01 | **Reconnaissance** | WHOIS, DNS records, AXFR, subdomain enum, SPF/DMARC, dorks | `whois`, `dig`, `subfinder`, `amass`, `dnsrecon` |
|
||||||
|
| 02 | **Port Scanning** | Full service/version detection, risk-based port analysis | `nmap` |
|
||||||
|
| 03 | **Fingerprinting** | Technology stack, WAF detection, version leakage | `whatweb`, `wafw00f` |
|
||||||
|
| 04 | **SSL/TLS** | Protocol support, ciphers, cert expiry, HSTS, CAA | `testssl.sh`, `sslscan`, `openssl` |
|
||||||
|
| 05 | **HTTP Headers** | 7+ security headers, cookie flags, CSP audit, HTTPS redirect | `curl` |
|
||||||
|
| 06 | **Dir & File Enum** | Directory brute-force + 40 sensitive path probes | `gobuster`, `ffuf`, `dirb` |
|
||||||
|
| 07 | **Nikto** | Web server misconfigurations, known CVEs | `nikto` |
|
||||||
|
| 08 | **SQL Injection** | Automated SQLi detection and exploitation | `sqlmap` |
|
||||||
|
| 09 | **XSS** | Reflected XSS probe across common parameters + DOM XSS | `dalfox`, `curl` |
|
||||||
|
| 10 | **CMS Scanning** | WordPress, Drupal, Joomla, Magento detection and scanning | `wpscan`, `droopescan` |
|
||||||
|
| 11 | **CORS** | Misconfigured CORS, wildcard origins, credentialed CORS | `curl` |
|
||||||
|
| 12 | **Open Redirect** | 20+ params × 10 redirect payloads | `curl` |
|
||||||
|
| 13 | **SSRF** | Cloud IMDS (AWS/GCP/Azure), internal IP probing | `curl` |
|
||||||
|
| 14 | **Subdomain Takeover** | Dangling CNAME detection for 20+ services | `subjack`, `nuclei`, `dig` |
|
||||||
|
| 15 | **Nuclei** | Community CVE/misconfiguration templates | `nuclei` |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📁 Output Structure
|
||||||
|
|
||||||
|
```
|
||||||
|
results_target_YYYYMMDD_HHMMSS/
|
||||||
|
├── logs/
|
||||||
|
│ ├── audit_YYYYMMDD_HHMMSS.log # Full timestamped audit log
|
||||||
|
│ └── findings.jsonl # One JSON object per finding
|
||||||
|
├── recon/
|
||||||
|
│ ├── whois.txt
|
||||||
|
│ ├── dns_records.txt
|
||||||
|
│ ├── subdomains.txt
|
||||||
|
│ ├── axfr.txt
|
||||||
|
│ ├── whatweb.json
|
||||||
|
│ ├── waf_detection.txt
|
||||||
|
│ └── google_dorks.txt
|
||||||
|
├── portscan/
|
||||||
|
│ ├── nmap.txt
|
||||||
|
│ ├── nmap.xml
|
||||||
|
│ └── nmap.gnmap
|
||||||
|
├── ssl/
|
||||||
|
│ ├── testssl.json
|
||||||
|
│ └── testssl.log
|
||||||
|
├── headers/
|
||||||
|
│ └── response_headers.txt
|
||||||
|
├── dirs/
|
||||||
|
│ ├── gobuster_dirs.txt
|
||||||
|
│ └── sensitive_paths_found.txt
|
||||||
|
├── vulns/
|
||||||
|
│ ├── sqlmap/
|
||||||
|
│ ├── xss/
|
||||||
|
│ └── nuclei/
|
||||||
|
├── cms/
|
||||||
|
│ ├── wpscan_results.json
|
||||||
|
│ └── droopescan_*.json
|
||||||
|
├── misc/
|
||||||
|
│ ├── cors_tests.txt
|
||||||
|
│ ├── open_redirect.txt
|
||||||
|
│ ├── ssrf_tests.txt
|
||||||
|
│ └── subtakeover.txt
|
||||||
|
└── reports/
|
||||||
|
├── report_YYYYMMDD_HHMMSS.html # Interactive dashboard
|
||||||
|
├── report_YYYYMMDD_HHMMSS.json # Structured JSON
|
||||||
|
└── report_YYYYMMDD_HHMMSS.txt # Plain text
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📊 Report Examples
|
||||||
|
|
||||||
|
### HTML Report
|
||||||
|
- Interactive severity filter (Critical / High / Medium / Low / Info)
|
||||||
|
- Live search across all findings
|
||||||
|
- Risk bar and scan metadata panel
|
||||||
|
- Evidence and remediation per finding
|
||||||
|
- Dark theme, responsive layout
|
||||||
|
|
||||||
|
### JSON Report
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"metadata": {
|
||||||
|
"tool": "websec-audit",
|
||||||
|
"version": "1.0.1",
|
||||||
|
"target": "https://davidalvarezp.com",
|
||||||
|
"start_time": "2026-01-01 12:00:00",
|
||||||
|
"duration_secs": 342
|
||||||
|
},
|
||||||
|
"summary": {
|
||||||
|
"total": 18,
|
||||||
|
"critical": 2,
|
||||||
|
"high": 5,
|
||||||
|
"medium": 6,
|
||||||
|
"low": 3,
|
||||||
|
"info": 2
|
||||||
|
},
|
||||||
|
"findings": [
|
||||||
|
{
|
||||||
|
"id": 1,
|
||||||
|
"severity": "CRITICAL",
|
||||||
|
"module": "RECON",
|
||||||
|
"title": "DNS Zone Transfer (AXFR) is permitted",
|
||||||
|
"description": "Name server ns1.davidalvarezp.com allows AXFR — full DNS zone disclosed.",
|
||||||
|
"evidence": "...",
|
||||||
|
"recommendation": "Restrict AXFR to authorised secondary name servers only.",
|
||||||
|
"timestamp": "2026-01-01T12:00:12Z"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🔧 Requirements
|
||||||
|
|
||||||
|
### Required
|
||||||
|
| Tool | Purpose | Install |
|
||||||
|
|------|---------|---------|
|
||||||
|
| `bash` 5.0+ | Shell interpreter | `apt-get install bash` |
|
||||||
|
| `curl` | HTTP requests | `apt-get install curl` |
|
||||||
|
| `nmap` | Port scanning | `apt-get install nmap` |
|
||||||
|
|
||||||
|
### Recommended (significantly improves coverage)
|
||||||
|
| Tool | Module | Install |
|
||||||
|
|------|--------|---------|
|
||||||
|
| `nikto` | Web vuln scan | `apt-get install nikto` |
|
||||||
|
| `sqlmap` | SQL injection | `apt-get install sqlmap` |
|
||||||
|
| `gobuster` / `ffuf` | Dir brute-force | `apt-get install gobuster` |
|
||||||
|
| `whatweb` | Fingerprinting | `apt-get install whatweb` |
|
||||||
|
| `wafw00f` | WAF detection | `apt-get install wafw00f` |
|
||||||
|
| `sslscan` / `testssl.sh` | SSL/TLS | `apt-get install sslscan` |
|
||||||
|
| `wpscan` | WordPress | `gem install wpscan` |
|
||||||
|
| `dalfox` | XSS | [GitHub releases](https://github.com/hahwul/dalfox) |
|
||||||
|
| `nuclei` | CVE templates | [GitHub releases](https://github.com/projectdiscovery/nuclei) |
|
||||||
|
| `subfinder` | Subdomain enum | [GitHub releases](https://github.com/projectdiscovery/subfinder) |
|
||||||
|
| `jq` | JSON parsing | `apt-get install jq` |
|
||||||
|
| `python3` | Utilities | `apt-get install python3` |
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 🤝 Contributing
|
||||||
|
|
||||||
|
Contributions are welcome! Please read [CONTRIBUTING.md](CONTRIBUTING.md) before submitting a pull request.
|
||||||
|
|
||||||
|
1. Fork the repository
|
||||||
|
2. Create a feature branch: `git checkout -b feature/new-module`
|
||||||
|
3. Commit your changes: `git commit -m 'feat: add new-module'`
|
||||||
|
4. Push to your branch: `git push origin feature/new-module`
|
||||||
|
5. Open a Pull Request
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📝 Changelog
|
||||||
|
|
||||||
|
See [CHANGELOG.md](CHANGELOG.md) for the full version history.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## 📜 License
|
||||||
|
|
||||||
|
This project is licensed under the **MIT License** — see [LICENSE](LICENSE) for details.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
<div align="center">
|
||||||
|
|
||||||
|
Made with ❤️ by [davidalvarezp](https://davidalvarezp.com)
|
||||||
|
|
||||||
|
⭐ **Star this repo** if you find it useful!
|
||||||
|
|
||||||
|
</div>
|
||||||
+303
@@ -0,0 +1,303 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# =============================================================================
|
||||||
|
#
|
||||||
|
# install.sh — Dependency installer for websec-audit
|
||||||
|
# Supported: Debian 11/12/13, Ubuntu 20.04/22.04/24.04
|
||||||
|
#
|
||||||
|
# Author : davidalvarezp
|
||||||
|
# Version : 1.0.1
|
||||||
|
# License : MIT
|
||||||
|
# GitHub : https://github.com/davidalvarezp/websec-audit
|
||||||
|
#
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
readonly SCRIPT_VERSION="1.0.1"
|
||||||
|
readonly INSTALL_LOG="/tmp/websec_install_$(date +%Y%m%d_%H%M%S).log"
|
||||||
|
|
||||||
|
# ── Colors ────────────────────────────────────────────────────────────────────
|
||||||
|
C_RED='\033[0;31m'; C_GREEN='\033[0;32m'; C_YELLOW='\033[1;33m'
|
||||||
|
C_CYAN='\033[0;36m'; C_BLUE='\033[0;34m'; C_BOLD='\033[1m'; C_RESET='\033[0m'
|
||||||
|
|
||||||
|
ok() { echo -e "${C_GREEN} [✔]${C_RESET} $1" | tee -a "$INSTALL_LOG"; }
|
||||||
|
info() { echo -e "${C_BLUE} [i]${C_RESET} $1" | tee -a "$INSTALL_LOG"; }
|
||||||
|
warn() { echo -e "${C_YELLOW} [!]${C_RESET} $1" | tee -a "$INSTALL_LOG"; }
|
||||||
|
err() { echo -e "${C_RED} [✘]${C_RESET} $1" | tee -a "$INSTALL_LOG" >&2; }
|
||||||
|
step() { echo -e "\n${C_BOLD}${C_CYAN} ── $1 ──${C_RESET}" | tee -a "$INSTALL_LOG"; }
|
||||||
|
|
||||||
|
has_tool() { command -v "$1" &>/dev/null; }
|
||||||
|
|
||||||
|
# ── Privilege check ───────────────────────────────────────────────────────────
|
||||||
|
[[ $EUID -ne 0 ]] && { err "Run as root: sudo $0"; exit 1; }
|
||||||
|
|
||||||
|
echo -e "${C_BOLD}${C_CYAN}"
|
||||||
|
cat << 'BANNER'
|
||||||
|
╔═════════════════════════════════════════════════╗
|
||||||
|
║ websec-audit — Dependency Installer ║
|
||||||
|
║ Debian / Ubuntu ║
|
||||||
|
╚═════════════════════════════════════════════════╝
|
||||||
|
BANNER
|
||||||
|
echo -e "${C_RESET}"
|
||||||
|
echo " Install log: $INSTALL_LOG"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
# ── System check ──────────────────────────────────────────────────────────────
|
||||||
|
step "System Verification"
|
||||||
|
OS_ID=$(grep "^ID=" /etc/os-release 2>/dev/null | cut -d= -f2 | tr -d '"' || echo "unknown")
|
||||||
|
OS_VER=$(grep "^VERSION_ID=" /etc/os-release 2>/dev/null | cut -d= -f2 | tr -d '"' || echo "?")
|
||||||
|
ARCH=$(uname -m)
|
||||||
|
|
||||||
|
info "OS: $OS_ID $OS_VER | Arch: $ARCH"
|
||||||
|
[[ "$OS_ID" =~ ^(debian|ubuntu|kali|parrot)$ ]] || warn "Untested OS: $OS_ID — proceeding anyway"
|
||||||
|
|
||||||
|
# ── APT packages ──────────────────────────────────────────────────────────────
|
||||||
|
step "APT Package Installation"
|
||||||
|
info "Updating package lists..."
|
||||||
|
apt-get update -qq 2>>"$INSTALL_LOG"
|
||||||
|
|
||||||
|
APT_PACKAGES=(
|
||||||
|
# Core tools
|
||||||
|
curl wget git nmap
|
||||||
|
# Web scanners
|
||||||
|
nikto sqlmap dirb
|
||||||
|
# DNS & network
|
||||||
|
dnsutils bind9-dnsutils whois dnsmap
|
||||||
|
# Fingerprinting & WAF
|
||||||
|
whatweb wafw00f
|
||||||
|
# SSL
|
||||||
|
sslscan openssl
|
||||||
|
# Wordlists
|
||||||
|
wordlists
|
||||||
|
# Languages & build deps
|
||||||
|
python3 python3-pip jq
|
||||||
|
ruby ruby-dev build-essential libssl-dev libffi-dev
|
||||||
|
# gobuster (if packaged)
|
||||||
|
gobuster
|
||||||
|
)
|
||||||
|
|
||||||
|
for pkg in "${APT_PACKAGES[@]}"; do
|
||||||
|
if apt-get install -y -qq "$pkg" >>"$INSTALL_LOG" 2>&1; then
|
||||||
|
ok "$pkg"
|
||||||
|
else
|
||||||
|
warn "$pkg — install failed or not available (will try alternative)"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
# ── WPScan (gem) ──────────────────────────────────────────────────────────────
|
||||||
|
step "WPScan"
|
||||||
|
if has_tool wpscan; then
|
||||||
|
ok "wpscan already installed ($(wpscan --version 2>/dev/null | head -1))"
|
||||||
|
else
|
||||||
|
info "Installing wpscan via gem..."
|
||||||
|
if gem install wpscan --no-document >>"$INSTALL_LOG" 2>&1; then
|
||||||
|
ok "wpscan installed"
|
||||||
|
else
|
||||||
|
warn "wpscan installation failed"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── testssl.sh ────────────────────────────────────────────────────────────────
|
||||||
|
step "testssl.sh"
|
||||||
|
if has_tool testssl.sh; then
|
||||||
|
ok "testssl.sh already installed"
|
||||||
|
else
|
||||||
|
info "Installing testssl.sh from GitHub..."
|
||||||
|
if [[ -d /opt/testssl.sh ]]; then
|
||||||
|
git -C /opt/testssl.sh pull -q >>"$INSTALL_LOG" 2>&1 || true
|
||||||
|
else
|
||||||
|
git clone --depth 1 https://github.com/drwetter/testssl.sh.git /opt/testssl.sh \
|
||||||
|
>>"$INSTALL_LOG" 2>&1
|
||||||
|
fi
|
||||||
|
ln -sf /opt/testssl.sh/testssl.sh /usr/local/bin/testssl.sh
|
||||||
|
chmod +x /opt/testssl.sh/testssl.sh
|
||||||
|
ok "testssl.sh installed → /usr/local/bin/testssl.sh"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── Go binary installer helper ────────────────────────────────────────────────
|
||||||
|
install_go_binary() {
|
||||||
|
local name="$1" url="$2" binary="${3:-$1}"
|
||||||
|
if has_tool "$name"; then
|
||||||
|
ok "$name already installed"
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
info "Downloading $name..."
|
||||||
|
local tmp; tmp=$(mktemp)
|
||||||
|
local ext="${url##*.}"
|
||||||
|
|
||||||
|
if wget -q "$url" -O "$tmp" >>"$INSTALL_LOG" 2>&1; then
|
||||||
|
case "$ext" in
|
||||||
|
gz)
|
||||||
|
tar -xzf "$tmp" -C /usr/local/bin/ "$binary" >>"$INSTALL_LOG" 2>&1 && \
|
||||||
|
chmod +x "/usr/local/bin/$binary" && ok "$name installed" || warn "$name: extraction failed" ;;
|
||||||
|
zip)
|
||||||
|
unzip -q -o "$tmp" "$binary" -d /usr/local/bin/ >>"$INSTALL_LOG" 2>&1 && \
|
||||||
|
chmod +x "/usr/local/bin/$binary" && ok "$name installed" || warn "$name: extraction failed" ;;
|
||||||
|
*)
|
||||||
|
mv "$tmp" "/usr/local/bin/$binary"
|
||||||
|
chmod +x "/usr/local/bin/$binary" && ok "$name installed" || warn "$name: install failed" ;;
|
||||||
|
esac
|
||||||
|
else
|
||||||
|
warn "$name: download failed"
|
||||||
|
fi
|
||||||
|
rm -f "$tmp"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Detect arch for Go binaries
|
||||||
|
case "$ARCH" in
|
||||||
|
x86_64|amd64) BIN_ARCH="amd64" ;;
|
||||||
|
aarch64|arm64) BIN_ARCH="arm64" ;;
|
||||||
|
armv7*) BIN_ARCH="arm" ;;
|
||||||
|
*) BIN_ARCH="amd64"; warn "Unknown arch $ARCH — assuming amd64" ;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
# ── gobuster ──────────────────────────────────────────────────────────────────
|
||||||
|
step "gobuster"
|
||||||
|
if ! has_tool gobuster; then
|
||||||
|
install_go_binary "gobuster" \
|
||||||
|
"https://github.com/OJ/gobuster/releases/latest/download/gobuster_Linux_${BIN_ARCH}.tar.gz" \
|
||||||
|
"gobuster"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── ffuf ─────────────────────────────────────────────────────────────────────
|
||||||
|
step "ffuf"
|
||||||
|
if ! has_tool ffuf; then
|
||||||
|
install_go_binary "ffuf" \
|
||||||
|
"https://github.com/ffuf/ffuf/releases/latest/download/ffuf_$(curl -s https://api.github.com/repos/ffuf/ffuf/releases/latest 2>/dev/null | grep -oP '"tag_name": "v\K[^"]+' | head -1 || echo '2.1.0')_linux_${BIN_ARCH}.tar.gz" \
|
||||||
|
"ffuf"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── subfinder ─────────────────────────────────────────────────────────────────
|
||||||
|
step "subfinder"
|
||||||
|
if ! has_tool subfinder; then
|
||||||
|
install_go_binary "subfinder" \
|
||||||
|
"https://github.com/projectdiscovery/subfinder/releases/latest/download/subfinder_linux_${BIN_ARCH}.zip" \
|
||||||
|
"subfinder"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── dalfox ────────────────────────────────────────────────────────────────────
|
||||||
|
step "dalfox (XSS scanner)"
|
||||||
|
if ! has_tool dalfox; then
|
||||||
|
local DALFOX_VER
|
||||||
|
DALFOX_VER=$(curl -s https://api.github.com/repos/hahwul/dalfox/releases/latest 2>/dev/null | grep -oP '"tag_name": "v\K[^"]+' | head -1 || echo "2.9.1")
|
||||||
|
install_go_binary "dalfox" \
|
||||||
|
"https://github.com/hahwul/dalfox/releases/download/v${DALFOX_VER}/dalfox_linux_${BIN_ARCH}.tar.gz" \
|
||||||
|
"dalfox"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── subjack ───────────────────────────────────────────────────────────────────
|
||||||
|
step "subjack (subdomain takeover)"
|
||||||
|
if ! has_tool subjack; then
|
||||||
|
if wget -q "https://github.com/haccer/subjack/releases/latest/download/subjack-linux-${BIN_ARCH}" \
|
||||||
|
-O /usr/local/bin/subjack >>"$INSTALL_LOG" 2>&1; then
|
||||||
|
chmod +x /usr/local/bin/subjack
|
||||||
|
ok "subjack installed"
|
||||||
|
else
|
||||||
|
warn "subjack download failed"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── nuclei ────────────────────────────────────────────────────────────────────
|
||||||
|
step "nuclei"
|
||||||
|
if ! has_tool nuclei; then
|
||||||
|
install_go_binary "nuclei" \
|
||||||
|
"https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei_linux_${BIN_ARCH}.zip" \
|
||||||
|
"nuclei"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if has_tool nuclei; then
|
||||||
|
info "Updating Nuclei templates..."
|
||||||
|
nuclei -update-templates -silent >>"$INSTALL_LOG" 2>&1 || warn "Template update failed (try: nuclei -update-templates)"
|
||||||
|
ok "Nuclei templates updated"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── amass ─────────────────────────────────────────────────────────────────────
|
||||||
|
step "amass"
|
||||||
|
if ! has_tool amass; then
|
||||||
|
if apt-get install -y -qq amass >>"$INSTALL_LOG" 2>&1; then
|
||||||
|
ok "amass installed via apt"
|
||||||
|
else
|
||||||
|
local AMASS_VER
|
||||||
|
AMASS_VER=$(curl -s https://api.github.com/repos/owasp-amass/amass/releases/latest 2>/dev/null | grep -oP '"tag_name": "v\K[^"]+' | head -1 || echo "4.2.0")
|
||||||
|
install_go_binary "amass" \
|
||||||
|
"https://github.com/owasp-amass/amass/releases/download/v${AMASS_VER}/amass_Linux_${BIN_ARCH}.zip" \
|
||||||
|
"amass"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── droopescan ────────────────────────────────────────────────────────────────
|
||||||
|
step "droopescan (Drupal/Joomla scanner)"
|
||||||
|
if ! has_tool droopescan; then
|
||||||
|
if pip3 install droopescan --quiet >>"$INSTALL_LOG" 2>&1; then
|
||||||
|
ok "droopescan installed"
|
||||||
|
else
|
||||||
|
warn "droopescan installation failed"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── SecLists wordlists ────────────────────────────────────────────────────────
|
||||||
|
step "SecLists Wordlists"
|
||||||
|
if [[ -d /usr/share/seclists ]]; then
|
||||||
|
ok "SecLists already present at /usr/share/seclists"
|
||||||
|
else
|
||||||
|
# Try apt first
|
||||||
|
if apt-get install -y -qq seclists >>"$INSTALL_LOG" 2>&1; then
|
||||||
|
ok "SecLists installed via apt"
|
||||||
|
else
|
||||||
|
info "Cloning SecLists from GitHub (this may take a while)..."
|
||||||
|
if git clone --depth 1 https://github.com/danielmiessler/SecLists.git \
|
||||||
|
/usr/share/seclists >>"$INSTALL_LOG" 2>&1; then
|
||||||
|
ok "SecLists installed at /usr/share/seclists"
|
||||||
|
else
|
||||||
|
warn "SecLists clone failed — install manually"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Decompress rockyou if needed
|
||||||
|
[[ -f /usr/share/wordlists/rockyou.txt.gz && ! -f /usr/share/wordlists/rockyou.txt ]] && \
|
||||||
|
gunzip /usr/share/wordlists/rockyou.txt.gz && ok "rockyou.txt decompressed"
|
||||||
|
|
||||||
|
# ── dnsrecon ──────────────────────────────────────────────────────────────────
|
||||||
|
step "dnsrecon"
|
||||||
|
if ! has_tool dnsrecon; then
|
||||||
|
apt-get install -y -qq dnsrecon >>"$INSTALL_LOG" 2>&1 || \
|
||||||
|
pip3 install dnsrecon --quiet >>"$INSTALL_LOG" 2>&1 || \
|
||||||
|
warn "dnsrecon not installed"
|
||||||
|
has_tool dnsrecon && ok "dnsrecon installed"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# ── Final summary ─────────────────────────────────────────────────────────────
|
||||||
|
echo ""
|
||||||
|
echo -e "${C_BOLD}${C_CYAN} ═══════════════════════════════════════════════════${C_RESET}"
|
||||||
|
echo -e "${C_BOLD} Installation Summary${C_RESET}"
|
||||||
|
echo ""
|
||||||
|
|
||||||
|
TOOLS=(
|
||||||
|
"curl" "nmap" "nikto" "sqlmap" "gobuster" "ffuf" "dirb"
|
||||||
|
"whatweb" "wafw00f" "sslscan" "testssl.sh" "wpscan"
|
||||||
|
"subfinder" "amass" "dnsrecon" "dalfox" "subjack" "nuclei"
|
||||||
|
"droopescan" "dig" "host" "whois" "jq" "python3" "ruby"
|
||||||
|
)
|
||||||
|
|
||||||
|
installed=0; missing=0
|
||||||
|
for t in "${TOOLS[@]}"; do
|
||||||
|
if has_tool "$t"; then
|
||||||
|
printf " ${C_GREEN}✔${C_RESET} %-20s %s\n" "$t" "($(command -v "$t"))"
|
||||||
|
installed=$((installed + 1))
|
||||||
|
else
|
||||||
|
printf " ${C_YELLOW}○${C_RESET} %-20s %s\n" "$t" "(not found)"
|
||||||
|
missing=$((missing + 1))
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo -e " ${C_BOLD}Installed: ${C_GREEN}${installed}${C_RESET} | ${C_BOLD}Missing: ${C_YELLOW}${missing}${C_RESET}"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${C_DIM}Full log: ${INSTALL_LOG}${C_RESET}"
|
||||||
|
echo ""
|
||||||
|
echo -e " ${C_BOLD}Usage:${C_RESET}"
|
||||||
|
echo " chmod +x websec-audit.sh"
|
||||||
|
echo " ./websec-audit.sh -t https://target.com"
|
||||||
|
echo " ./websec-audit.sh -t https://target.com --aggressive -T 20"
|
||||||
|
echo ""
|
||||||
+2533
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user