v1.0.1

2026-06-23 11:48:28 +02:00 · 2026-03-23 13:27:21 +01:00
parent d7a9d64e43
commit 9c72c58a88
32 changed files with 2483 additions and 1 deletions
@@ -0,0 +1,45 @@
+name: Deploy Docs to GitHub Pages
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "docs/**"
+      - "mkdocs.yml"
+      - "requirements.txt"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pages: write
+  id-token: write
+
+concurrency:
+  group: "pages"
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    name: Build & Deploy MkDocs
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0        # full history for git-revision-date
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Install dependencies
+        run: pip install -r requirements.txt
+
+      - name: Build & deploy
+        run: mkdocs gh-deploy --force --clean --verbose
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -103,3 +103,10 @@ rockyou.txt
 sqlmap_output/
 nikto_reports/
 testssl_output/
+
+# MkDocs
+site/
+.cache/
+__pycache__/
+*.pyc
+.env
@@ -63,5 +63,5 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ---

-[1.0.1]: https://github.com/davidalvarezp/websec-audit/compare/v1.0.0...v1.0.1
+[1.0.1]: https://github.com/davidalvarezp/websec-audit/releases/tag/v1.0.1
 [1.0.0]: https://github.com/davidalvarezp/websec-audit/releases/tag/v1.0.0
@@ -0,0 +1,130 @@
+/* ── Brand colours ─────────────────────────────────────────── */
+:root {
+  --ws-blue:        #1e88e5;
+  --ws-blue-light:  #42a5f5;
+  --ws-blue-dark:   #1565c0;
+  --ws-critical:    #f44336;
+  --ws-high:        #ff7043;
+  --ws-medium:      #ffb300;
+  --ws-low:         #42a5f5;
+  --ws-info:        #78909c;
+}
+
+/* ── Hero banner on homepage ───────────────────────────────── */
+.ws-hero {
+  background: linear-gradient(135deg, #0d1b2a 0%, #1a2a3a 60%, #0d2137 100%);
+  border: 1px solid #1e88e540;
+  border-radius: 12px;
+  padding: 2.5rem 2rem;
+  margin-bottom: 2rem;
+  text-align: center;
+}
+.ws-hero h1 {
+  font-size: 2.4rem;
+  font-weight: 700;
+  color: #e3f2fd !important;
+  margin: 0 0 0.5rem;
+}
+.ws-hero .ws-tagline {
+  font-size: 1.1rem;
+  color: #90caf9;
+  margin: 0;
+}
+
+/* ── Severity badges ───────────────────────────────────────── */
+.sev {
+  display: inline-block;
+  padding: 2px 9px;
+  border-radius: 4px;
+  font-size: 0.72rem;
+  font-weight: 700;
+  letter-spacing: 0.04em;
+  vertical-align: middle;
+}
+.sev-critical { background: #f4433620; color: #f44336; border: 1px solid #f44336; }
+.sev-high     { background: #ff704320; color: #ff7043; border: 1px solid #ff7043; }
+.sev-medium   { background: #ffb30020; color: #ffb300; border: 1px solid #ffb300; }
+.sev-low      { background: #42a5f520; color: #42a5f5; border: 1px solid #42a5f5; }
+.sev-info     { background: #78909c20; color: #90a4ae; border: 1px solid #78909c; }
+
+/* ── Module card grid ──────────────────────────────────────── */
+.module-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(220px, 1fr));
+  gap: 14px;
+  margin: 1.5rem 0;
+}
+.module-card {
+  background: var(--md-code-bg-color);
+  border: 1px solid #1e88e530;
+  border-radius: 8px;
+  padding: 1rem 1.1rem;
+  transition: border-color .2s, transform .15s;
+  text-decoration: none !important;
+  display: block;
+}
+.module-card:hover {
+  border-color: var(--ws-blue);
+  transform: translateY(-2px);
+}
+.module-card .mc-num {
+  font-size: 0.7rem;
+  color: var(--ws-blue-light);
+  font-weight: 600;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+}
+.module-card .mc-name {
+  font-size: 0.95rem;
+  font-weight: 600;
+  color: var(--md-typeset-color);
+  margin: 4px 0 3px;
+}
+.module-card .mc-desc {
+  font-size: 0.78rem;
+  color: var(--md-default-fg-color--light);
+  margin: 0;
+}
+
+/* ── Code block enhancements ───────────────────────────────── */
+.md-typeset pre > code {
+  font-size: 0.82rem;
+}
+
+/* ── Command pill ──────────────────────────────────────────── */
+.cmd {
+  display: inline-block;
+  background: var(--md-code-bg-color);
+  border: 1px solid #1e88e540;
+  border-radius: 5px;
+  padding: 1px 7px;
+  font-family: var(--md-code-font);
+  font-size: 0.83rem;
+  color: #90caf9;
+}
+
+/* ── Flag table ────────────────────────────────────────────── */
+.flag-table td:first-child {
+  font-family: var(--md-code-font);
+  font-size: 0.82rem;
+  white-space: nowrap;
+  color: #90caf9;
+}
+
+/* ── Admonition tweaks ─────────────────────────────────────── */
+.md-typeset .admonition.legal {
+  border-color: #f44336;
+}
+.md-typeset .admonition.legal > .admonition-title {
+  background-color: #f4433615;
+}
+.md-typeset .admonition.legal > .admonition-title::before {
+  background-color: #f44336;
+  -webkit-mask-image: var(--md-admonition-icon--warning);
+          mask-image: var(--md-admonition-icon--warning);
+}
+
+/* ── Footer ────────────────────────────────────────────────── */
+.md-footer-meta {
+  background-color: #0a1520;
+}
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 48 48" fill="none">
+  <rect width="48" height="48" rx="10" fill="#1e88e5"/>
+  <path d="M12 14h4l4 12 4-12h4l-6 20h-4L12 14z" fill="white" opacity=".9"/>
+  <path d="M30 22c0-2.2 1.8-4 4-4s4 1.8 4 4v2h-8v-2z" fill="white" opacity=".9"/>
+  <rect x="30" y="26" width="8" height="8" rx="1" fill="white" opacity=".9"/>
+</svg>
@@ -0,0 +1,69 @@
+---
+title: Changelog
+description: Version history for websec-audit.
+---
+
+# Changelog
+
+All notable changes are documented here.
+Format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
+Versioning follows [Semantic Versioning](https://semver.org/).
+
+---
+
+## [1.0.1] — 2026-03-23
+
+### Added
+
+- **Module 15 — Nuclei** template scan integration
+- **Module 14 — Subdomain Takeover**: subjack + Nuclei + CNAME analysis for 20+ services
+- **Module 13 — SSRF**: cloud IMDS probing (AWS/GCP/Azure), decimal/hex IP encoding
+- **Module 12 — Open Redirect**: 20 params × 10 payloads
+- **Module 11 — CORS**: null origin, credentialed, wildcard detection
+- **Module 10 — CMS**: WordPress REST API user enumeration, debug.log, xmlrpc.php
+- **Module 09 — XSS**: dalfox integration + 8 reflected payloads × 15 parameters
+- **Module 08 — SQLi**: sqlmap with forms crawl and tamper scripts in aggressive mode
+- **Module 07 — Nikto**: severity-based finding classification
+- **Module 06 — Dir Enum**: 40 sensitive path probes (`.git`, `.env`, AWS credentials, Dockerfiles)
+- **Module 05 — HTTP Headers**: CSP deep audit, SameSite=None, Cache-Control
+- **Module 04 — SSL/TLS**: HSTS preload, cert expiry thresholds (14/30/90 days)
+- **Module 03 — Fingerprint**: WAF detection, version-leaking header enumeration
+- **Module 02 — Port Scan**: risk analysis for 20+ dangerous ports
+- **Module 01 — Recon**: SPF `+all` detection, DMARC `p=none`, 700+ Google Dorks
+- Interactive HTML report with severity filter, live search and risk bar
+- JSON report with full metadata envelope
+- `--format json|html|txt|all` flag
+- `--no-banner` and `--version` flags
+- Graceful interrupt — partial reports generated on SIGINT/SIGTERM
+- `findings.jsonl` written as-discovered for resilient partial runs
+- Aggressive mode: nmap `-A -O --script=vuln,auth`, sqlmap level 5 + tamper, deep DOM XSS
+- Stealth mode: nmap `-sS -T2 -f`, sqlmap delay, safe-freq
+
+### Changed
+
+- Fully rewritten in English
+- Modular `module_*()` function architecture
+- `add_finding()` emits structured JSONL with id, severity, module, title, description, evidence, recommendation, timestamp
+- Output directory reorganised into 9 subdirectories
+
+### Fixed
+
+- SPF detection now handles multi-TXT records
+- HSTS check handles missing header without error
+- JSON report correctly escapes multi-line evidence strings
+
+---
+
+## [1.0.0] — 2026-01-13
+
+### Added
+
+- Initial release
+- Core modules: recon, port scan, SSL, headers, dir brute-force, nikto, sqlmap
+- Basic HTML report
+- Spanish-language interface
+
+---
+
+[1.0.1]: https://github.com/davidalvarezp/websec-audit/releases/tag/v1.0.1
+[1.0.0]: https://github.com/davidalvarezp/websec-audit/releases/tag/v1.0.0
@@ -0,0 +1,83 @@
+---
+title: Contributing
+description: How to contribute to websec-audit — bug reports, new modules, code style and commit conventions.
+---
+
+# Contributing
+
+Contributions are welcome. This page covers everything you need to know before opening a PR.
+
+---
+
+## Getting started
+
+1. **Fork** the repository on GitHub
+2. **Clone** your fork: `git clone https://github.com/YOUR_USER/websec-audit.git`
+3. Create a **feature branch**: `git checkout -b feature/your-feature`
+4. Make your changes
+5. Run `shellcheck -S warning websec-audit.sh` — zero warnings required
+6. **Commit** using conventional commits (see below)
+7. **Push** and open a Pull Request against `main`
+
+---
+
+## Code style
+
+- Target **bash 5.0+**
+- Use `set -euo pipefail` at the top of every script
+- Quote all variable expansions: `"$var"` not `$var`
+- Use `[[ ]]` for conditions
+- Declare local variables with `local var` then assign separately (avoids SC2155)
+- Run `shellcheck` before every commit
+
+---
+
+## Adding a new module
+
+1. Add a toggle: `MOD_MYMODULE=1`
+2. Add `--skip-mymodule` to `parse_args()`
+3. Write the function:
+
+```bash
+module_mymodule() {
+  [[ $MOD_MYMODULE -eq 0 ]] && return
+  log_section "MODULE XX — NAME"
+
+  # your logic
+
+  add_finding "HIGH" "MYMODULE" "Title" "Description" "evidence" "Remediation."
+}
+```
+
+4. Call it in `main()` before `generate_reports`
+5. Add to the module table in `README.md` and these docs
+6. Add a `CHANGELOG.md` entry
+
+---
+
+## Commit conventions
+
+```
+feat(module): add GraphQL introspection detection
+fix(ssl): handle certificates with no expiry date
+docs(readme): add Kali installation instructions
+refactor(headers): extract cookie analysis into helper
+```
+
+**Types:** `feat` · `fix` · `docs` · `refactor` · `perf` · `test` · `chore`
+
+---
+
+## Issue templates
+
+Use the GitHub issue templates:
+
+- **Bug report** — for unexpected behaviour or errors
+- **Feature request** — for new modules or improvements
+
+---
+
+## Full guide
+
+The complete contributing guide is in the repository:
+[CONTRIBUTING.md :material-github:](https://github.com/davidalvarezp/websec-audit/blob/main/CONTRIBUTING.md)
@@ -0,0 +1,175 @@
+---
+title: WebSec-Audit
+description: Professional Web Security Audit Framework — modular, extensible, Bash-native.
+hide:
+  - navigation
+  - toc
+---
+
+<div class="ws-hero">
+  <h1>🔐 WebSec-Audit</h1>
+  <p class="ws-tagline">Professional Web Security Audit Framework — modular, extensible, Bash-native</p>
+</div>
+
+<div style="text-align:center;margin-bottom:2.5rem">
+
+[![Version](https://img.shields.io/badge/version-1.0.1-blue?style=flat-square)](https://github.com/davidalvarezp/websec-audit/releases)
+[![License](https://img.shields.io/badge/license-MIT-green?style=flat-square)](https://github.com/davidalvarezp/websec-audit/blob/main/LICENSE)
+[![Bash](https://img.shields.io/badge/bash-5.0%2B-orange?style=flat-square)](https://www.gnu.org/software/bash/)
+[![Platform](https://img.shields.io/badge/platform-Debian%20%7C%20Ubuntu%20%7C%20Kali-lightgrey?style=flat-square)](https://github.com/davidalvarezp/websec-audit)
+[![CI](https://img.shields.io/github/actions/workflow/status/davidalvarezp/websec-audit/ci.yml?label=CI&style=flat-square)](https://github.com/davidalvarezp/websec-audit/actions)
+
+</div>
+
+!!! danger "Legal Notice"
+    This tool is intended **exclusively for authorised security assessments**.
+    Only run it against systems you own or have **explicit written permission** to test.
+    Unauthorised use is illegal. The author assumes no liability for misuse.
+
+---
+
+## What is websec-audit?
+
+**websec-audit** is a Bash framework that automates comprehensive web application security audits.
+It integrates **15+ independent modules** — from passive reconnaissance to active exploitation —
+and produces professional findings reports in three formats.
+
+Designed to run on **Debian, Ubuntu and Kali Linux** with zero mandatory dependencies beyond
+`curl` and `nmap`.
+
+---
+
+## Feature highlights
+
+<div class="grid cards" markdown>
+
+- :material-puzzle: **Modular architecture**
+
+    Enable or disable any of the 15+ modules with a single `--skip-<module>` flag.
+
+- :material-speedometer: **Three scan modes**
+
+    Normal, Aggressive and Stealth — adapt the scan depth to each engagement.
+
+- :material-file-chart: **Rich reports**
+
+    Interactive HTML dashboard, structured JSON and plain-text log — generated automatically.
+
+- :material-shield-search: **Broad coverage**
+
+    Recon · Port scan · SSL/TLS · Headers · SQLi · XSS · SSRF · CORS · CMS · Takeover · Nuclei
+
+- :material-bug-play: **Proxy support**
+
+    Route all traffic through Burp Suite or any HTTP proxy with `--proxy`.
+
+- :material-tools: **Tool-agnostic**
+
+    Graceful fallback when optional tools are absent. Core scan works with only `curl` + `nmap`.
+
+</div>
+
+---
+
+## Modules at a glance
+
+<div class="module-grid">
+  <a class="module-card" href="modules/recon/">
+    <div class="mc-num">Module 01</div>
+    <div class="mc-name">Reconnaissance</div>
+    <div class="mc-desc">WHOIS · DNS · AXFR · Subdomains · SPF/DMARC · Dorks</div>
+  </a>
+  <a class="module-card" href="modules/portscan/">
+    <div class="mc-num">Module 02</div>
+    <div class="mc-name">Port Scanning</div>
+    <div class="mc-desc">nmap · service detection · risk analysis</div>
+  </a>
+  <a class="module-card" href="modules/fingerprint/">
+    <div class="mc-num">Module 03</div>
+    <div class="mc-name">Fingerprinting</div>
+    <div class="mc-desc">WhatWeb · WAF detection · version leakage</div>
+  </a>
+  <a class="module-card" href="modules/ssl/">
+    <div class="mc-num">Module 04</div>
+    <div class="mc-name">SSL/TLS</div>
+    <div class="mc-desc">testssl.sh · ciphers · cert expiry · HSTS</div>
+  </a>
+  <a class="module-card" href="modules/headers/">
+    <div class="mc-num">Module 05</div>
+    <div class="mc-name">HTTP Headers</div>
+    <div class="mc-desc">CSP · cookies · clickjacking · redirects</div>
+  </a>
+  <a class="module-card" href="modules/dirbrute/">
+    <div class="mc-num">Module 06</div>
+    <div class="mc-name">Dir & File Enum</div>
+    <div class="mc-desc">gobuster · ffuf · 40+ sensitive paths</div>
+  </a>
+  <a class="module-card" href="modules/nikto/">
+    <div class="mc-num">Module 07</div>
+    <div class="mc-name">Nikto</div>
+    <div class="mc-desc">Web server CVEs · misconfigurations</div>
+  </a>
+  <a class="module-card" href="modules/sqli/">
+    <div class="mc-num">Module 08</div>
+    <div class="mc-name">SQL Injection</div>
+    <div class="mc-desc">sqlmap · auto + aggressive mode</div>
+  </a>
+  <a class="module-card" href="modules/xss/">
+    <div class="mc-num">Module 09</div>
+    <div class="mc-name">XSS</div>
+    <div class="mc-desc">dalfox · reflected · DOM-based</div>
+  </a>
+  <a class="module-card" href="modules/cms/">
+    <div class="mc-num">Module 10</div>
+    <div class="mc-name">CMS Scanning</div>
+    <div class="mc-desc">WordPress · Drupal · Joomla · Magento</div>
+  </a>
+  <a class="module-card" href="modules/cors/">
+    <div class="mc-num">Module 11</div>
+    <div class="mc-name">CORS</div>
+    <div class="mc-desc">wildcard · reflected origin · null origin</div>
+  </a>
+  <a class="module-card" href="modules/redirect/">
+    <div class="mc-num">Module 12</div>
+    <div class="mc-name">Open Redirect</div>
+    <div class="mc-desc">20 params × 10 payloads</div>
+  </a>
+  <a class="module-card" href="modules/ssrf/">
+    <div class="mc-num">Module 13</div>
+    <div class="mc-name">SSRF</div>
+    <div class="mc-desc">AWS · GCP · Azure IMDS · internal IPs</div>
+  </a>
+  <a class="module-card" href="modules/subtakeover/">
+    <div class="mc-num">Module 14</div>
+    <div class="mc-name">Subdomain Takeover</div>
+    <div class="mc-desc">subjack · nuclei · 20+ services</div>
+  </a>
+  <a class="module-card" href="modules/nuclei/">
+    <div class="mc-num">Module 15</div>
+    <div class="mc-name">Nuclei</div>
+    <div class="mc-desc">CVE templates · misconfiguration scan</div>
+  </a>
+</div>
+
+---
+
+## Quick start
+
+```bash
+git clone https://github.com/davidalvarezp/websec-audit.git
+cd websec-audit
+chmod +x install.sh websec-audit.sh
+sudo ./install.sh
+./websec-audit.sh -t https://target.com
+```
+
+:material-arrow-right: See [Installation](installation.md) and [Quick Start](quickstart.md) for details.
+
+---
+
+## Author
+
+Built by **[davidalvarezp](https://davidalvarezp.com)**.
+
+:material-github: [github.com/davidalvarezp](https://github.com/davidalvarezp) ·
+:material-linkedin: [linkedin.com/in/davidalvarezp](https://www.linkedin.com/in/davidalvarezp)
@@ -0,0 +1,144 @@
+---
+title: Installation
+description: How to install websec-audit and its dependencies on Debian, Ubuntu and Kali Linux.
+---
+
+# Installation
+
+WebSec-Audit runs on **Debian 11/12/13**, **Ubuntu 20.04/22.04/24.04** and **Kali Linux 2023+**.
+
+---
+
+## Automatic install (recommended)
+
+The bundled `install.sh` script handles everything: APT packages, Go binaries, Ruby gems, Python packages and wordlists.
+
+```bash
+git clone https://github.com/davidalvarezp/websec-audit.git
+cd websec-audit
+chmod +x install.sh websec-audit.sh
+sudo ./install.sh
+```
+
+The installer detects your architecture (`amd64` / `arm64`) and downloads the correct pre-compiled binaries for tools not available via APT.
+
+!!! tip "Install log"
+    The installer writes a full log to `/tmp/websec_install_<timestamp>.log`.
+    Check it if anything fails.
+
+---
+
+## Manual install
+
+### Required (core functionality)
+
+```bash
+sudo apt-get install -y curl nmap
+```
+
+### Recommended (significantly improves coverage)
+
+```bash
+sudo apt-get install -y \
+  nikto sqlmap gobuster dirb \
+  whatweb wafw00f sslscan \
+  python3 python3-pip jq ruby \
+  dnsutils whois wordlists
+```
+
+### Optional tools (install individually)
+
+=== "testssl.sh"
+    ```bash
+    git clone --depth 1 https://github.com/drwetter/testssl.sh.git /opt/testssl.sh
+    sudo ln -s /opt/testssl.sh/testssl.sh /usr/local/bin/testssl.sh
+    ```
+
+=== "wpscan"
+    ```bash
+    sudo gem install wpscan --no-document
+    ```
+
+=== "dalfox"
+    ```bash
+    # Download latest release for your arch
+    wget https://github.com/hahwul/dalfox/releases/latest/download/dalfox_linux_amd64.tar.gz
+    tar -xzf dalfox_linux_amd64.tar.gz
+    sudo mv dalfox /usr/local/bin/
+    ```
+
+=== "subfinder"
+    ```bash
+    wget https://github.com/projectdiscovery/subfinder/releases/latest/download/subfinder_linux_amd64.zip
+    unzip subfinder_linux_amd64.zip
+    sudo mv subfinder /usr/local/bin/
+    ```
+
+=== "nuclei"
+    ```bash
+    wget https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei_linux_amd64.zip
+    unzip nuclei_linux_amd64.zip
+    sudo mv nuclei /usr/local/bin/
+    nuclei -update-templates
+    ```
+
+=== "droopescan"
+    ```bash
+    pip3 install droopescan
+    ```
+
+---
+
+## Kali Linux
+
+Most tools are pre-installed. Run the installer to fill any remaining gaps:
+
+```bash
+sudo ./install.sh
+```
+
+---
+
+## Verifying the installation
+
+```bash
+./websec-audit.sh --version
+```
+
+Expected output:
+
+```
+websec-audit v1.0.1 — davidalvarezp
+```
+
+The tool also performs a dependency check at the start of every scan, listing which tools are available and which are missing.
+
+---
+
+## Dependency matrix
+
+| Tool | Required | Module(s) |
+|---|:---:|---|
+| `curl` | ✅ | All HTTP modules |
+| `nmap` | ✅ | Port Scanning |
+| `nikto` | optional | Nikto |
+| `sqlmap` | optional | SQL Injection |
+| `gobuster` | optional | Dir & File Enum |
+| `ffuf` | optional | Dir & File Enum (fallback) |
+| `dirb` | optional | Dir & File Enum (fallback) |
+| `whatweb` | optional | Fingerprinting |
+| `wafw00f` | optional | Fingerprinting |
+| `sslscan` | optional | SSL/TLS |
+| `testssl.sh` | optional | SSL/TLS (preferred) |
+| `wpscan` | optional | CMS — WordPress |
+| `droopescan` | optional | CMS — Drupal/Joomla |
+| `dalfox` | optional | XSS |
+| `subfinder` | optional | Reconnaissance |
+| `amass` | optional | Reconnaissance |
+| `dnsrecon` | optional | Reconnaissance |
+| `subjack` | optional | Subdomain Takeover |
+| `nuclei` | optional | Nuclei + Takeover |
+| `jq` | optional | JSON report parsing |
+| `python3` | optional | URL encoding, HTML reports |
+| `whois` | optional | Reconnaissance |
+| `dig` | optional | DNS analysis |
@@ -0,0 +1,107 @@
+---
+title: Scan Modes
+description: Normal, Aggressive and Stealth scan modes explained.
+---
+
+# Scan Modes
+
+WebSec-Audit supports three scan modes that control depth, noise and speed across all modules.
+
+---
+
+## Normal (default)
+
+Balanced scan suitable for most engagements. Moderate threads, mid-level tool aggression.
+
+```bash
+./websec-audit.sh -t https://target.com
+```
+
+| Aspect | Behaviour |
+|---|---|
+| nmap | `-sV -sC --open -T4 --top-ports 1000` |
+| sqlmap | `--level=3 --risk=2` |
+| gobuster | Small wordlist, 10 threads |
+| dalfox | Standard mode |
+| WhatWeb | Aggression level 1 |
+| Nikto | Default plugins |
+
+---
+
+## Aggressive
+
+Deepest scan. More findings, significantly more network noise. Use only when the scope explicitly permits it.
+
+```bash
+./websec-audit.sh -t https://target.com --aggressive
+./websec-audit.sh -t https://target.com --aggressive -T 20 --ports full
+```
+
+| Aspect | Behaviour |
+|---|---|
+| nmap | Adds `-A -O --script=vuln,auth,default,discovery` |
+| sqlmap | `--level=5 --risk=3 --forms --crawl=<depth> --dbs --tamper=space2comment` |
+| gobuster | Large wordlist (`dirbuster medium`) |
+| dalfox | `--deep-domxss --follow-redirects` |
+| WhatWeb | Aggression level 3 |
+| Nikto | `--Plugins @@ALL` |
+| Nuclei | Includes `low` severity templates |
+| Port profile | Can be combined with `--ports full` for `-p-` scan |
+
+!!! warning "Noise warning"
+    Aggressive mode will almost certainly trigger IDS/IPS alerts and WAF blocks.
+    Always confirm with the client that this level of noise is within scope.
+
+---
+
+## Stealth
+
+Slower scan designed to minimise the detection footprint. Useful for red team engagements or
+environments with sensitive monitoring.
+
+```bash
+./websec-audit.sh -t https://target.com --stealth
+```
+
+| Aspect | Behaviour |
+|---|---|
+| nmap | `-sS -T2 -f --data-length 32 --randomize-hosts` |
+| sqlmap | `--delay=2 --safe-freq=3 --smart` |
+| gobuster | Small wordlist, reduced threads |
+| HTTP requests | Longer intervals between requests |
+
+!!! info "Stealth limitations"
+    Stealth mode reduces noise but does not guarantee evasion. A determined blue team will
+    still detect the scan. For full covert operations, consider manual testing with specific
+    targeted checks only.
+
+---
+
+## Mode comparison
+
+| Feature | Normal | Aggressive | Stealth |
+|---|:---:|:---:|:---:|
+| nmap scripts | default | vuln + auth + discovery | SYN + fragmented |
+| sqlmap level | 3 | 5 | 3 |
+| sqlmap risk | 2 | 3 | 2 |
+| Crawling | No | Yes (--depth) | No |
+| Full port scan | Optional | Recommended | Not recommended |
+| WAF evasion | None | None | Partial |
+| Speed | Medium | Fast | Slow |
+| Noise | Medium | High | Low |
+| Detection risk | Medium | High | Low-Medium |
+
+---
+
+## Combining flags
+
+Modes can be combined with any module or output flag:
+
+```bash
+# Aggressive + custom threads + JSON only + proxy
+./websec-audit.sh -t https://target.com \
+  --aggressive -T 20 \
+  --proxy http://127.0.0.1:8080 \
+  --format json \
+  -o /tmp/red-team-audit
+```
@@ -0,0 +1,72 @@
+---
+title: "Module 10 · CMS Scanning"
+description: WordPress, Drupal, Joomla and Magento detection and security scanning.
+---
+
+# Module 10 · CMS Scanning
+
+**Flag:** `--skip-cms`
+
+Detects the CMS powering the target and runs the appropriate scanner.
+
+---
+
+## Detection
+
+The module detects CMS by analysing the response body and headers for known fingerprints:
+
+| CMS | Detection signals |
+|---|---|
+| WordPress | `wp-content`, `wp-includes`, `wordpress` in body/headers |
+| Drupal | `sites/all/modules`, `Drupal.settings`, `X-Generator: Drupal` |
+| Joomla | `/media/jui`, `generator: Joomla`, cookie names |
+| Magento | `Mage.Cookies`, `/skin/frontend`, `magento` |
+
+---
+
+## WordPress (wpscan)
+
+wpscan is run with:
+
+| Mode | Flags |
+|---|---|
+| Normal | `--url <target> --no-banner --format json` |
+| Aggressive | `--enumerate ap,at,cb,dbe,u --plugins-detection aggressive` |
+
+**Parsed results:**
+
+| Condition | Severity |
+|---|:---:|
+| Plugin vulnerabilities found | <span class="sev sev-high">HIGH</span> |
+| Theme vulnerabilities found | <span class="sev sev-medium">MEDIUM</span> |
+| Users enumerable via REST API | <span class="sev sev-medium">MEDIUM</span> |
+
+**WordPress-specific path probes:**
+
+| Path | Condition | Severity |
+|---|---|:---:|
+| `/xmlrpc.php` | Accessible | <span class="sev sev-medium">MEDIUM</span> |
+| `/wp-json/wp/v2/users` | Returns user list | <span class="sev sev-medium">MEDIUM</span> |
+| `/wp-content/debug.log` | Accessible | <span class="sev sev-high">HIGH</span> |
+| `/?author=1` | Author enumeration works | <span class="sev sev-low">LOW</span> |
+| `/wp-login.php` | Accessible | <span class="sev sev-info">INFO</span> |
+
+## Drupal / Joomla (droopescan)
+
+droopescan is used for Drupal and Joomla targets, detecting:
+
+- Core version and known vulnerabilities
+- Installed plugins/modules with known CVEs
+- Themes
+
+---
+
+## Output files
+
+```
+cms/
+├── wpscan_results.json
+├── wpscan_console.txt
+├── droopescan_drupal.json
+└── droopescan_joomla.json
+```
@@ -0,0 +1,71 @@
+---
+title: "Module 11 · CORS Misconfiguration"
+description: CORS policy testing — wildcard, reflected origin, null origin and credentialed cross-origin requests.
+---
+
+# Module 11 · CORS Misconfiguration
+
+**Flag:** `--skip-cors`
+
+Tests the target's CORS policy against 7 adversarial origins.
+
+---
+
+## Test origins
+
+```
+https://evil.com
+https://<domain>.evil.com
+https://evil.<domain>
+null
+https://attacker.io
+http://localhost
+https://not<domain>
+```
+
+Each origin is sent in an `Origin` header with `Access-Control-Request-Method: GET` and
+`Access-Control-Request-Headers: Authorization`.
+
+---
+
+## Checks and findings
+
+| Condition | Severity |
+|---|:---:|
+| Attacker origin reflected in `ACAO` + `ACAC: true` | <span class="sev sev-critical">CRITICAL</span> |
+| Attacker origin reflected in `ACAO` (no credentials) | <span class="sev sev-medium">MEDIUM</span> |
+| Wildcard `*` in `Access-Control-Allow-Origin` | <span class="sev sev-medium">MEDIUM</span> |
+| `null` origin accepted | <span class="sev sev-high">HIGH</span> |
+
+---
+
+## Why CORS matters
+
+A misconfigured CORS policy allows an attacker's website to make authenticated cross-origin requests on behalf of a victim user — reading sensitive API responses, exfiltrating data, or performing actions under their session.
+
+The most critical case is:
+
+```
+Access-Control-Allow-Origin: https://evil.com
+Access-Control-Allow-Credentials: true
+```
+
+This combination allows a malicious site to make credentialed requests and read the responses.
+
+---
+
+## Remediation
+
+- Validate `Origin` against an **explicit allowlist** — never reflect it back directly
+- Never use `Access-Control-Allow-Origin: *` on endpoints that handle authenticated data
+- Never combine `ACAO: *` with `ACAC: true` (browsers block this, but other clients do not)
+- Never trust the `null` origin
+
+---
+
+## Output files
+
+```
+misc/
+└── cors_tests.txt
+```
@@ -0,0 +1,91 @@
+---
+title: "Module 06 · Dir & File Enumeration"
+description: Directory brute-forcing and sensitive file path probing.
+---
+
+# Module 06 · Dir & File Enumeration
+
+**Flag:** `--skip-dirbrute`
+
+Combines wordlist-based directory brute-forcing with targeted probing of 40+ known sensitive paths.
+
+---
+
+## Directory brute-force
+
+| Mode | Wordlist used |
+|---|---|
+| Normal | `--wl-dirs-small` (default: dirb/common.txt) |
+| Aggressive | `--wl-dirs-big` (default: dirbuster/directory-list-2.3-medium.txt) |
+
+**Tool priority:** gobuster → ffuf → dirb
+
+```bash
+# Use a custom wordlist
+./websec-audit.sh -t https://target.com --wl-dirs-small /path/to/custom.txt
+```
+
+---
+
+## Sensitive path probing
+
+40+ paths are probed directly with `curl` regardless of the brute-force wordlist.
+Findings are severity-classified automatically:
+
+=== "Critical"
+    | Path | Why |
+    |---|---|
+    | `/.git/HEAD` | Git repository exposed |
+    | `/.git/config` | Git config exposed |
+    | `/.env` | Environment file with credentials |
+    | `/.env.local` | Local environment file |
+    | `/.env.production` | Production secrets |
+    | `/wp-config.php` | WordPress database credentials |
+    | `/wp-config.php.bak` | Backup of WP config |
+    | `/configuration.php` | Joomla config |
+    | `/config/database.yml` | Rails DB config |
+    | `/.aws/credentials` | AWS credentials file |
+    | `/db.sql`, `/dump.sql`, `/backup.sql` | Database dumps |
+
+=== "High"
+    | Path | Why |
+    |---|---|
+    | `/phpinfo.php`, `/info.php` | PHP environment disclosure |
+    | `/phpmyadmin/`, `/adminer.php` | Database admin interfaces |
+    | `/web.config` | IIS config / credentials |
+    | `/backup.zip`, `/backup.tar.gz` | Backup archives |
+    | `/console` | Interactive console (RCE risk) |
+    | `/Dockerfile`, `/docker-compose.yml` | Infrastructure secrets |
+
+=== "Medium"
+    | Path | Why |
+    |---|---|
+    | `/admin/`, `/administrator/` | Admin panels |
+    | `/.htaccess` | Apache config |
+    | `/server-status`, `/server-info` | Apache status pages |
+    | `/_profiler/`, `/_debugbar` | Framework debug panels |
+    | `/graphiql` | GraphQL IDE |
+    | `/.DS_Store` | Directory structure leak |
+    | `/package.json`, `/composer.json` | Dependency exposure |
+
+=== "Low / Info"
+    | Path | Why |
+    |---|---|
+    | `/robots.txt` | May disclose hidden paths |
+    | `/sitemap.xml` | Site structure |
+    | `/api/swagger.json`, `/swagger-ui.html` | API docs |
+    | `/graphql` | GraphQL endpoint |
+    | `/.well-known/security.txt` | Security contact policy |
+
+---
+
+## Output files
+
+```
+dirs/
+├── gobuster_dirs.txt
+├── gobuster_dns.txt
+├── ffuf_results.json
+├── dirb_results.txt
+└── sensitive_paths_found.txt   # only paths that returned 200/301/302
+```
@@ -0,0 +1,68 @@
+---
+title: "Module 03 · Fingerprinting"
+description: Technology stack detection, WAF identification and version-leaking header analysis.
+---
+
+# Module 03 · Fingerprinting
+
+**Flag:** `--skip-fingerprint`
+
+Identifies the technology stack, detects WAFs, and flags response headers that leak version information.
+
+---
+
+## Technology detection
+
+Uses **WhatWeb** (aggression level 1 in normal mode, 3 in aggressive) to identify:
+
+- Web server (nginx, Apache, IIS, LiteSpeed, Caddy)
+- Programming language and framework (PHP, Django, Rails, Laravel, ASP.NET, Express)
+- CMS (WordPress, Drupal, Joomla, Magento)
+- JavaScript libraries and versions
+- Analytics and tracking tools
+- CDN and cloud provider
+
+Output saved to `recon/whatweb.json` and `recon/whatweb_brief.txt`.
+
+---
+
+## WAF detection
+
+Uses **wafw00f** to identify the presence and type of Web Application Firewall.
+
+| Condition | Severity |
+|---|:---:|
+| No WAF detected | <span class="sev sev-low">LOW</span> |
+| WAF identified | <span class="sev sev-info">INFO</span> |
+
+A missing WAF is flagged as Low because it means there is no automatic filtering layer between the internet and the application.
+
+---
+
+## Version-leaking headers
+
+The following response headers are checked. Any that disclose technology names or version numbers are flagged:
+
+`Server` · `X-Powered-By` · `X-AspNet-Version` · `X-AspNetMvc-Version` · `X-Generator` · `X-CF-Powered-By` · `Via`
+
+| Condition | Severity |
+|---|:---:|
+| Version-leaking header present | <span class="sev sev-low">LOW</span> |
+
+---
+
+## Fallback
+
+If `whatweb` is not installed, the module falls back to header-based detection using `curl`, scanning for technology names in the response headers and body.
+
+---
+
+## Output files
+
+```
+recon/
+├── whatweb.json
+├── whatweb_brief.txt
+├── waf_detection.txt
+└── basic_headers_raw.txt     # fallback only
+```
@@ -0,0 +1,83 @@
+---
+title: "Module 05 · HTTP Headers"
+description: HTTP security header analysis, cookie flags and HTTP-to-HTTPS redirect verification.
+---
+
+# Module 05 · HTTP Headers
+
+**Flag:** `--skip-headers`
+
+Audits HTTP response headers for security misconfigurations.
+
+---
+
+## Required security headers
+
+| Header | Severity if absent | Notes |
+|---|:---:|---|
+| `Content-Security-Policy` | <span class="sev sev-medium">MEDIUM</span> | Also audits CSP value for `unsafe-inline`, `unsafe-eval`, wildcards |
+| `X-Frame-Options` | <span class="sev sev-medium">MEDIUM</span> | Clickjacking protection |
+| `X-Content-Type-Options` | <span class="sev sev-low">LOW</span> | MIME sniffing prevention |
+| `Referrer-Policy` | <span class="sev sev-low">LOW</span> | URL leakage control |
+| `Permissions-Policy` | <span class="sev sev-low">LOW</span> | Browser API restrictions |
+| `Cross-Origin-Opener-Policy` | <span class="sev sev-low">LOW</span> | Cross-origin isolation |
+| `Cross-Origin-Resource-Policy` | <span class="sev sev-low">LOW</span> | Resource access control |
+
+### CSP deep audit
+When CSP is present, the module further checks:
+
+| CSP Condition | Severity |
+|---|:---:|
+| `unsafe-inline` or `unsafe-eval` present | <span class="sev sev-medium">MEDIUM</span> |
+| Wildcard (`*`) in `script-src` or `default-src` | <span class="sev sev-high">HIGH</span> |
+
+---
+
+## Version-leaking headers
+
+Headers that should **not** be present in production:
+
+`Server` · `X-Powered-By` · `X-AspNet-Version` · `X-AspNetMvc-Version` · `X-Generator` · `X-CF-Powered-By`
+
+Each flagged as <span class="sev sev-low">LOW</span>.
+
+---
+
+## Cookie security flags
+
+Every `Set-Cookie` response header is analysed for:
+
+| Missing flag | Severity |
+|---|:---:|
+| `HttpOnly` | <span class="sev sev-medium">MEDIUM</span> |
+| `Secure` | <span class="sev sev-medium">MEDIUM</span> |
+| `SameSite` | <span class="sev sev-low">LOW</span> |
+| `SameSite=None` without `Secure` | <span class="sev sev-medium">MEDIUM</span> |
+
+---
+
+## HTTP → HTTPS redirect
+
+Checks whether HTTP requests are automatically upgraded to HTTPS.
+
+| Condition | Severity |
+|---|:---:|
+| HTTP does not redirect to HTTPS | <span class="sev sev-medium">MEDIUM</span> |
+
+---
+
+## Cache-Control
+
+| Condition | Severity |
+|---|:---:|
+| `Cache-Control` header absent | <span class="sev sev-low">LOW</span> |
+
+---
+
+## Output files
+
+```
+headers/
+├── response_headers.txt
+└── initial_response.txt
+```
@@ -0,0 +1,76 @@
+---
+title: Modules Overview
+description: All 15 websec-audit modules — what they check, what tools they use, and how to skip them.
+---
+
+# Modules Overview
+
+WebSec-Audit is built around **15 independent modules**. Each module can be enabled or disabled individually with `--skip-<module>`.
+
+---
+
+## Module table
+
+| # | Module | `--skip` flag | Primary tools | Key checks |
+|---|--------|--------------|--------------|-----------|
+| 01 | [Reconnaissance](recon.md) | `--skip-recon` | whois · dig · subfinder · amass | WHOIS · DNS · AXFR · subdomain enum · SPF/DMARC · Google Dorks |
+| 02 | [Port Scanning](portscan.md) | `--skip-portscan` | nmap | Open ports · service versions · risk analysis for 20+ dangerous ports |
+| 03 | [Fingerprinting](fingerprint.md) | `--skip-fingerprint` | whatweb · wafw00f | Tech stack · WAF detection · version-leaking headers |
+| 04 | [SSL/TLS](ssl.md) | `--skip-ssl` | testssl.sh · sslscan · openssl | Deprecated protocols · weak ciphers · cert expiry · HSTS |
+| 05 | [HTTP Headers](headers.md) | `--skip-headers` | curl | CSP · X-Frame-Options · cookies · HTTP→HTTPS redirect |
+| 06 | [Dir & File Enum](dirbrute.md) | `--skip-dirbrute` | gobuster · ffuf · dirb | Directory brute-force · 40+ sensitive path probes |
+| 07 | [Nikto](nikto.md) | `--skip-nikto` | nikto | Web server CVEs · misconfigurations · outdated software |
+| 08 | [SQL Injection](sqli.md) | `--skip-sqli` | sqlmap | SQLi detection · exploitation · database enumeration |
+| 09 | [XSS](xss.md) | `--skip-xss` | dalfox · curl | Reflected XSS · DOM-based XSS · common parameters |
+| 10 | [CMS Scanning](cms.md) | `--skip-cms` | wpscan · droopescan | WordPress · Drupal · Joomla · Magento plugins/themes/users |
+| 11 | [CORS](cors.md) | `--skip-cors` | curl | Wildcard · reflected origin · null origin · credentialed |
+| 12 | [Open Redirect](redirect.md) | `--skip-redirect` | curl | 20 params × 10 redirect payloads |
+| 13 | [SSRF](ssrf.md) | `--skip-ssrf` | curl | AWS/GCP/Azure IMDS · localhost · RFC1918 ranges |
+| 14 | [Subdomain Takeover](subtakeover.md) | `--skip-subtakeover` | subjack · nuclei · dig | Dangling CNAMEs across 20+ services |
+| 15 | [Nuclei](nuclei.md) | `--skip-nuclei` | nuclei | CVE templates · misconfiguration templates |
+
+---
+
+## Execution order
+
+Modules run sequentially in the order listed above. The output of earlier modules (subdomain list from Module 01, open ports from Module 02) is used as input for later modules.
+
+```mermaid
+graph LR
+  A[Target Info] --> B[Recon]
+  B --> C[Port Scan]
+  C --> D[Fingerprint]
+  D --> E[SSL/TLS]
+  E --> F[Headers]
+  F --> G[Dir Enum]
+  G --> H[Nikto]
+  H --> I[SQLi]
+  I --> J[XSS]
+  J --> K[CMS]
+  K --> L[CORS]
+  L --> M[Redirect]
+  M --> N[SSRF]
+  N --> O[Takeover]
+  O --> P[Nuclei]
+  P --> Q[Reports]
+```
+
+---
+
+## Skipping multiple modules
+
+```bash
+# Quick headers + SSL check only
+./websec-audit.sh -t https://target.com \
+  --skip-recon --skip-portscan --skip-fingerprint \
+  --skip-dirbrute --skip-nikto --skip-sqli --skip-xss \
+  --skip-cms --skip-cors --skip-redirect --skip-ssrf \
+  --skip-subtakeover --skip-nuclei
+
+# Reconnaissance only (no active scanning)
+./websec-audit.sh -t https://target.com \
+  --skip-portscan --skip-fingerprint --skip-ssl \
+  --skip-headers --skip-dirbrute --skip-nikto \
+  --skip-sqli --skip-xss --skip-cms --skip-cors \
+  --skip-redirect --skip-ssrf --skip-subtakeover --skip-nuclei
+```
@@ -0,0 +1,56 @@
+---
+title: "Module 07 · Nikto"
+description: Nikto web server vulnerability scanner integration.
+---
+
+# Module 07 · Nikto
+
+**Flag:** `--skip-nikto`
+
+Runs Nikto against the target and classifies findings by severity.
+
+---
+
+## What Nikto checks
+
+- Outdated server software with known CVEs
+- Default files and scripts (admin panels, test pages, install scripts)
+- Dangerous HTTP methods (PUT, DELETE, TRACE)
+- Server misconfigurations
+- Cookie and header issues not covered by Module 05
+- Common web application vulnerabilities
+
+---
+
+## Mode behaviour
+
+| Mode | Nikto flags |
+|---|---|
+| Normal | Default plugins, 10-minute max |
+| Aggressive | `--Plugins @@ALL` — runs every available plugin |
+
+---
+
+## Severity classification
+
+Nikto findings are auto-classified:
+
+| Pattern in output | Assigned severity |
+|---|:---:|
+| `vuln`, `exploit`, `inject`, `XSS`, `CVE`, `OSVDB-XXXX` | <span class="sev sev-high">HIGH</span> |
+| `outdated`, `version`, `disclose`, `found`, `enabled` | <span class="sev sev-medium">MEDIUM</span> |
+| Everything else | <span class="sev sev-low">LOW</span> |
+
+---
+
+## Output files
+
+```
+vulns/
+├── nikto.txt
+└── nikto.json
+```
+
+!!! tip "Nikto can be noisy"
+    Nikto generates many false positives. Review each finding manually before including it in a formal report.
+    Use `--skip-nikto` in quick assessments where time is limited.
@@ -0,0 +1,60 @@
+---
+title: "Module 15 · Nuclei"
+description: CVE and misconfiguration template scanning with Nuclei.
+---
+
+# Module 15 · Nuclei
+
+**Flag:** `--skip-nuclei`
+
+Runs the [Nuclei](https://github.com/projectdiscovery/nuclei) engine against the target using the community template library.
+
+---
+
+## Severity filter
+
+| Mode | Templates included |
+|---|---|
+| Normal | `medium`, `high`, `critical` |
+| Aggressive | `low`, `medium`, `high`, `critical` |
+
+---
+
+## Template categories covered
+
+- CVE templates (known software vulnerabilities)
+- Default credentials
+- Exposed panels and dashboards
+- Misconfiguration (cloud, server, application)
+- Technology detection
+- Network exposure
+- Fuzzing templates (aggressive mode)
+
+---
+
+## Template updates
+
+Templates are updated automatically during `install.sh`. To manually update:
+
+```bash
+nuclei -update-templates
+```
+
+---
+
+## Findings
+
+Each Nuclei match is imported as a finding with its native severity (`critical`, `high`, `medium`, `low`, `info`).
+
+---
+
+## Output files
+
+```
+vulns/nuclei/
+├── nuclei_results.txt
+└── nuclei_results.json
+```
+
+!!! tip
+    Nuclei is also used internally by Module 14 (Subdomain Takeover) with the `takeovers/` template tag.
@@ -0,0 +1,62 @@
+---
+title: "Module 02 · Port Scanning"
+description: nmap service/version detection with automated risk-based analysis of open ports.
+---
+
+# Module 02 · Port Scanning
+
+**Flag:** `--skip-portscan`
+
+Runs nmap against the target and performs automated risk analysis on every open port.
+
+---
+
+## Port profiles
+
+| `--ports` value | nmap flag | Use case |
+|---|---|---|
+| `top-100` | `--top-ports 100` | Quick check |
+| `top-1000` _(default)_ | `--top-ports 1000` | Standard |
+| `full` | `-p-` | Full coverage (slow) |
+
+---
+
+## Mode behaviour
+
+| Mode | Extra flags |
+|---|---|
+| Normal | `-sV -sC --open -T4` |
+| Aggressive | Adds `-A -O --script=vuln,auth,default,discovery` |
+| Stealth | `-sS -T2 -f --data-length 32 --randomize-hosts` |
+
+---
+
+## Automated risk analysis
+
+Every open port is evaluated against a built-in risk table:
+
+| Port | Service | Severity | Reason |
+|---|---|:---:|---|
+| 21 | FTP | <span class="sev sev-critical">CRITICAL</span> | Plaintext credentials |
+| 23 | Telnet | <span class="sev sev-critical">CRITICAL</span> | Unencrypted remote shell |
+| 2375 | Docker API | <span class="sev sev-critical">CRITICAL</span> | Unauthenticated container access |
+| 445 | SMB | <span class="sev sev-high">HIGH</span> | EternalBlue / ransomware risk |
+| 3306 | MySQL | <span class="sev sev-high">HIGH</span> | DB exposed to internet |
+| 3389 | RDP | <span class="sev sev-high">HIGH</span> | Brute-force target |
+| 5432 | PostgreSQL | <span class="sev sev-high">HIGH</span> | DB exposed to internet |
+| 6379 | Redis | <span class="sev sev-high">HIGH</span> | Often unauthenticated |
+| 9200 | Elasticsearch | <span class="sev sev-high">HIGH</span> | Often unauthenticated |
+| 27017 | MongoDB | <span class="sev sev-high">HIGH</span> | Often unauthenticated |
+| 25 | SMTP | <span class="sev sev-medium">MEDIUM</span> | Open relay risk |
+| 8080/8443 | HTTP alt | <span class="sev sev-low">LOW</span> | Admin panel exposure |
+
+---
+
+## Output files
+
+```
+portscan/
+├── nmap.txt      # human-readable
+├── nmap.xml      # machine-readable, compatible with Metasploit
+└── nmap.gnmap    # grepable format
+```
@@ -0,0 +1,88 @@
+---
+title: "Module 01 · Reconnaissance"
+description: WHOIS, DNS records, zone transfer, subdomain enumeration, SPF/DMARC and Google Dorks.
+---
+
+# Module 01 · Reconnaissance
+
+**Flag:** `--skip-recon`
+
+The reconnaissance module performs passive and semi-passive information gathering before any active scanning begins.
+
+---
+
+## Sub-checks
+
+### WHOIS lookup
+Queries the WHOIS database for registrar, registrant, expiry date and nameservers.
+Output saved to `recon/whois.txt`.
+
+### DNS record enumeration
+Queries all major record types: `A`, `AAAA`, `MX`, `TXT`, `NS`, `SOA`, `CNAME`, `CAA`, `DMARC`.
+Output saved to `recon/dns_records.txt`.
+
+**SPF analysis** — flags missing SPF records and dangerous `+all` policies:
+
+| Condition | Severity |
+|---|:---:|
+| No SPF record | <span class="sev sev-medium">MEDIUM</span> |
+| SPF uses `+all` | <span class="sev sev-high">HIGH</span> |
+| No DMARC record | <span class="sev sev-medium">MEDIUM</span> |
+| DMARC `p=none` | <span class="sev sev-low">LOW</span> |
+
+### DNS Zone Transfer (AXFR)
+Attempts AXFR against all discovered nameservers. A successful transfer exposes the entire DNS zone.
+
+| Condition | Severity |
+|---|:---:|
+| AXFR permitted | <span class="sev sev-critical">CRITICAL</span> |
+
+### Subdomain enumeration
+Uses multiple tools in parallel and deduplicates results into `recon/subdomains.txt`:
+
+- **subfinder** — passive DNS sources (certificate transparency, DNS databases)
+- **amass** — passive enumeration
+- **dnsrecon** — standard DNS queries
+- **Fallback** — wordlist-based DNS brute-force (first 500 entries) if no enumeration tool is available
+
+### Google Dorks
+Generates a curated list of Google Dorks for manual research — not executed automatically.
+Saved to `recon/google_dorks.txt`. Categories include: information disclosure, admin panels, credentials, config files, exposed APIs.
+
+---
+
+## Tools used
+
+| Tool | Role | Fallback |
+|---|---|---|
+| `whois` | WHOIS lookup | None |
+| `dig` | DNS queries | `host` |
+| `subfinder` | Passive subdomain enum | Wordlist brute-force |
+| `amass` | Extended passive enum | Optional |
+| `dnsrecon` | DNS standard checks | Optional |
+
+---
+
+## Skip this module
+
+```bash
+./websec-audit.sh -t https://target.com --skip-recon
+```
+
+---
+
+## Output files
+
+```
+recon/
+├── whois.txt
+├── dns_records.txt
+├── axfr.txt
+├── subfinder.txt
+├── amass.txt
+├── dnsrecon.json
+├── subdomains.txt          # deduplicated, used by Module 14
+├── whatweb.json
+├── waf_detection.txt
+└── google_dorks.txt
+```
@@ -0,0 +1,56 @@
+---
+title: "Module 12 · Open Redirect"
+description: Open redirect detection across 20 parameters and 10 payload variants.
+---
+
+# Module 12 · Open Redirect
+
+**Flag:** `--skip-redirect`
+
+Tests 20 common redirect parameters with 10 payload variants.
+
+---
+
+## Parameters tested
+
+`next`, `url`, `redirect`, `redirect_uri`, `redirect_url`, `return`, `return_url`, `returnUrl`, `returnTo`, `go`, `goto`, `dest`, `destination`, `target`, `forward`, `redir`, `link`, `to`, `r`, `out`, `ref`, `continue`, `callback`, `successUrl`, `failureUrl`
+
+---
+
+## Payloads
+
+```
+https://evil.com
+//evil.com
+///evil.com
+https:evil.com
+/\evil.com
+https://evil.com%2F%2E%2E
+%2F%2Fevil.com
+https:///evil.com
+/%5Cevil.com
+https://evil.com@<target-domain>
+```
+
+---
+
+## Findings
+
+| Condition | Severity |
+|---|:---:|
+| Redirect to external domain confirmed | <span class="sev sev-medium">MEDIUM</span> |
+
+---
+
+## Remediation
+
+Validate redirect targets against an allowlist of known-safe internal paths or domains. If the application must redirect to external URLs, use an intermediate confirmation page.
+
+---
+
+## Output files
+
+```
+misc/
+└── open_redirect.txt
+```
@@ -0,0 +1,77 @@
+---
+title: "Module 08 · SQL Injection"
+description: Automated SQL injection detection and exploitation using sqlmap.
+---
+
+# Module 08 · SQL Injection
+
+**Flag:** `--skip-sqli`
+
+Uses sqlmap to detect and confirm SQL injection vulnerabilities in the target URL.
+
+---
+
+## sqlmap configuration
+
+| Mode | sqlmap flags |
+|---|---|
+| Normal | `--batch --random-agent --level=3 --risk=2 --timeout=<n> --threads=<n>` |
+| Aggressive | `--level=5 --risk=3 --forms --crawl=<depth> --dbs --tamper=space2comment` |
+| Stealth | Adds `--delay=2 --safe-freq=3 --smart` |
+
+---
+
+## What is checked
+
+- **GET parameters** in the target URL
+- **POST forms** (aggressive mode via `--forms`)
+- **Crawled pages** (aggressive mode via `--crawl`)
+
+sqlmap tests for:
+
+- Boolean-based blind SQLi
+- Error-based SQLi
+- Time-based blind SQLi
+- UNION-based SQLi
+- Stacked queries
+
+---
+
+## Findings
+
+| Condition | Severity |
+|---|:---:|
+| SQL injection confirmed | <span class="sev sev-critical">CRITICAL</span> |
+| No SQLi on primary URL | <span class="sev sev-info">INFO</span> |
+
+---
+
+## Remediation
+
+> Use **parameterised queries** (prepared statements) in every database interaction. Never concatenate user-supplied input directly into SQL strings.
+
+=== "PHP (PDO)"
+    ```php
+    $stmt = $pdo->prepare('SELECT * FROM users WHERE id = ?');
+    $stmt->execute([$_GET['id']]);
+    ```
+
+=== "Python (psycopg2)"
+    ```python
+    cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))
+    ```
+
+=== "Node.js (pg)"
+    ```js
+    const res = await client.query('SELECT * FROM users WHERE id = $1', [userId]);
+    ```
+
+---
+
+## Output files
+
+```
+vulns/sqlmap/
+├── sqlmap_console.txt
+└── <target>/           # sqlmap output directory per target
+```
@@ -0,0 +1,70 @@
+---
+title: "Module 04 · SSL/TLS"
+description: Full SSL/TLS analysis — deprecated protocols, weak ciphers, certificate expiry and HSTS.
+---
+
+# Module 04 · SSL/TLS
+
+**Flag:** `--skip-ssl`
+
+!!! info
+    This module is automatically skipped if the target is served over plain HTTP.
+    In that case, a **HIGH** finding is raised: *"Target is served over HTTP (no TLS)"*.
+
+---
+
+## Checks performed
+
+### Protocol support
+Flags deprecated and vulnerable protocols:
+
+| Protocol | Severity |
+|---|:---:|
+| SSLv2 | <span class="sev sev-high">HIGH</span> |
+| SSLv3 | <span class="sev sev-high">HIGH</span> |
+| TLS 1.0 | <span class="sev sev-high">HIGH</span> |
+| TLS 1.1 | <span class="sev sev-high">HIGH</span> |
+| TLS 1.2 | ✅ Acceptable |
+| TLS 1.3 | ✅ Preferred |
+
+### Cipher suites
+Flags weak or broken ciphers:
+
+- RC4, NULL, EXPORT, anonymous (anon), DES, 3DES → <span class="sev sev-high">HIGH</span>
+
+### Certificate validity
+
+| Condition | Severity |
+|---|:---:|
+| Certificate expired | <span class="sev sev-critical">CRITICAL</span> |
+| Expires in < 14 days | <span class="sev sev-critical">CRITICAL</span> |
+| Expires in < 30 days | <span class="sev sev-high">HIGH</span> |
+| Expires in < 90 days | <span class="sev sev-medium">MEDIUM</span> |
+| Self-signed / untrusted | <span class="sev sev-high">HIGH</span> |
+
+### HSTS
+
+| Condition | Severity |
+|---|:---:|
+| HSTS header absent | <span class="sev sev-medium">MEDIUM</span> |
+| `max-age` < 15552000 (6 months) | <span class="sev sev-low">LOW</span> |
+
+---
+
+## Tool priority
+
+1. **testssl.sh** — comprehensive analysis, JSON output parsed automatically
+2. **sslscan** — protocol and cipher enumeration
+3. **openssl** — fallback, manual protocol checks
+
+---
+
+## Output files
+
+```
+ssl/
+├── testssl.json      # if testssl.sh available
+├── testssl.log
+├── sslscan.txt       # if sslscan available
+└── openssl_info.txt  # fallback
+```
@@ -0,0 +1,73 @@
+---
+title: "Module 13 · SSRF"
+description: Server-Side Request Forgery testing against cloud IMDS endpoints and internal IP ranges.
+---
+
+# Module 13 · SSRF
+
+**Flag:** `--skip-ssrf`
+
+Tests 25 common URL parameters with 16 SSRF payloads targeting cloud metadata services and internal network ranges.
+
+---
+
+## Payloads
+
+```
+http://127.0.0.1/
+http://127.0.0.1:22/
+http://127.0.0.1:8080/
+http://localhost/
+http://[::1]/
+http://0.0.0.0/
+http://2130706433/          # 127.0.0.1 decimal
+http://0x7f000001/          # 127.0.0.1 hex
+http://169.254.169.254/     # shared IMDS
+http://169.254.169.254/latest/meta-data/
+http://169.254.169.254/latest/meta-data/iam/security-credentials/
+http://metadata.google.internal/
+http://metadata.google.internal/computeMetadata/v1/
+http://169.254.169.254/metadata/v1/
+http://192.168.0.1/
+http://10.0.0.1/
+```
+
+---
+
+## Detection indicators
+
+The response body is scanned for these strings to detect successful SSRF:
+
+`ami-id` · `instance-id` · `availability-zone` · `iam` · `security-credentials` · `computeMetadata` · `root:` · `daemon:` · `mysql:` · `127.0.0.1` · `localhost` · `internal`
+
+---
+
+## Findings
+
+| Condition | Severity |
+|---|:---:|
+| Internal/cloud-metadata content in response | <span class="sev sev-critical">CRITICAL</span> |
+| No in-band SSRF detected | <span class="sev sev-info">INFO</span> |
+
+!!! tip "Blind SSRF"
+    In-band SSRF (where the response is returned directly) is what this module detects.
+    **Blind SSRF** — where the server makes an out-of-band request — requires an external
+    listener. Use Burp Collaborator or [Interactsh](https://github.com/projectdiscovery/interactsh)
+    for blind SSRF testing.
+
+---
+
+## Remediation
+
+- Validate and allowlist all outbound URL destinations
+- Block access to IMDS from application containers (IMDSv2 on AWS, metadata server firewall on GCP/Azure)
+- Use egress firewalling to prevent unexpected outbound connections
+
+---
+
+## Output files
+
+```
+misc/
+└── ssrf_tests.txt
+```
@@ -0,0 +1,57 @@
+---
+title: "Module 14 · Subdomain Takeover"
+description: Dangling CNAME detection across 20+ known external services.
+---
+
+# Module 14 · Subdomain Takeover
+
+**Flag:** `--skip-subtakeover`
+
+Analyses the subdomain list produced by Module 01 for dangling CNAMEs pointing to deprovisioned external services.
+
+!!! note "Dependency"
+    This module requires the subdomain list from Module 01 (`recon/subdomains.txt`).
+    Run with `--skip-recon` only if you provide a pre-existing subdomain list.
+
+---
+
+## Method 1 — subjack
+
+subjack scans the subdomain list and checks each entry against its fingerprint database of known takeover-vulnerable services.
+
+## Method 2 — Nuclei takeover templates
+
+Nuclei runs against the subdomain list using the built-in `takeovers/` template category.
+
+## Method 3 — Manual CNAME analysis
+
+For each subdomain with a CNAME record, the module checks whether the CNAME points to a known external service and whether the resource returns a 404/410/403/503 (indicating the resource no longer exists).
+
+**Monitored services (20+):**
+
+AWS S3 · Elastic Beanstalk · CloudFront · GitHub Pages · Heroku · Zendesk · Freshdesk · HelpScout · Surge.sh · Netlify · Render · Azure Web Apps · Azure API Management · Shopify · Squarespace · Tumblr · Ghost · Webflow · Fly.io · Cloudflare Pages
+
+---
+
+## Findings
+
+| Condition | Severity |
+|---|:---:|
+| Takeover confirmed (subjack / Nuclei) | <span class="sev sev-high">HIGH</span> |
+| Dangling CNAME to known service + 404/410 | <span class="sev sev-high">HIGH</span> |
+
+---
+
+## Remediation
+
+Remove the DNS CNAME record for the affected subdomain, or reclaim the resource at the external service before an attacker does.
+
+---
+
+## Output files
+
+```
+misc/
+├── subtakeover.txt
+└── nuclei_takeover.txt
+```
@@ -0,0 +1,75 @@
+---
+title: "Module 09 · XSS"
+description: Cross-Site Scripting detection using dalfox and manual reflected XSS probing.
+---
+
+# Module 09 · XSS
+
+**Flag:** `--skip-xss`
+
+Tests for reflected and DOM-based XSS using dalfox and a manual parameter probe.
+
+---
+
+## dalfox scan
+
+dalfox is run against the target URL with automatic parameter discovery.
+
+| Mode | Extra flags |
+|---|---|
+| Normal | `--silence --timeout <n>` |
+| Aggressive | `--deep-domxss --follow-redirects` |
+
+dalfox tests for:
+
+- Reflected XSS in URL parameters
+- DOM-based XSS
+- Blind XSS (with callback)
+- Header injection
+
+---
+
+## Manual reflected XSS probe
+
+In addition to dalfox, the module probes common GET parameters with 8 payloads:
+
+```
+<script>alert(1)</script>
+'><img src=x onerror=alert(1)>
+<svg onload=alert(1)>
+"><script>alert(1)</script>
+javascript:alert(1)
+';alert(1);//
+<details open ontoggle=alert(1)>
+<iframe srcdoc='<script>alert(1)</script>'>
+```
+
+Parameters tested: `q`, `s`, `search`, `query`, `keyword`, `id`, `name`, `page`, `url`, `ref`, `return`, `redirect`, `next`, `view`, `lang`
+
+If the payload is reflected verbatim in the response body, the finding is confirmed.
+
+---
+
+## Findings
+
+| Condition | Severity |
+|---|:---:|
+| XSS confirmed (dalfox or manual) | <span class="sev sev-high">HIGH</span> |
+
+---
+
+## Remediation
+
+- **Encode all user-controlled output** before inserting it into HTML (use framework-native escaping)
+- Implement a **strict Content-Security-Policy** that disallows inline scripts
+- Set `X-Content-Type-Options: nosniff`
+
+---
+
+## Output files
+
+```
+vulns/xss/
+├── dalfox_results.txt
+└── reflected_xss.txt
+```
@@ -0,0 +1,135 @@
+---
+title: Quick Start
+description: Run your first websec-audit scan in under 2 minutes.
+---
+
+# Quick Start
+
+Get up and running in under 2 minutes.
+
+!!! warning "Authorised targets only"
+    Only scan systems you own or have explicit written permission to test.
+    For practice, use [DVWA](https://github.com/digininja/DVWA), [WebGoat](https://github.com/WebGoat/WebGoat),
+    or a [HackTheBox](https://hackthebox.com) / [TryHackMe](https://tryhackme.com) machine.
+
+---
+
+## 1. Clone and install
+
+```bash
+git clone https://github.com/davidalvarezp/websec-audit.git
+cd websec-audit
+chmod +x install.sh websec-audit.sh
+sudo ./install.sh
+```
+
+---
+
+## 2. Run your first scan
+
+```bash
+./websec-audit.sh -t https://target.com
+```
+
+The scan runs all 15 modules sequentially. Depending on the target and available tools,
+a standard scan takes **5–20 minutes**.
+
+---
+
+## 3. Review the results
+
+When the scan finishes you will see a summary like this:
+
+```
+  ┌───────────────────────────────────────────────────┐
+  │  TARGET   : https://target.com                    │
+  │  IP       : 93.184.216.34                         │
+  │  RISK     : HIGH                                  │
+  ├───────────────────────────────────────────────────┤
+  │  CRITICAL : 2                                     │
+  │  HIGH     : 5                                     │
+  │  MEDIUM   : 7                                     │
+  │  LOW      : 4                                     │
+  │  INFO     : 3                                     │
+  ├───────────────────────────────────────────────────┤
+  │  TOTAL    : 21 finding(s)                         │
+  │  DURATION : 487s                                  │
+  └───────────────────────────────────────────────────┘
+
+  HTML report : results_target_YYYYMMDD_HHMMSS/reports/report_*.html
+  JSON report : results_target_YYYYMMDD_HHMMSS/reports/report_*.json
+  Audit log   : results_target_YYYYMMDD_HHMMSS/logs/audit_*.log
+```
+
+Open the HTML report in your browser for the interactive dashboard.
+
+---
+
+## Common usage patterns
+
+=== "Standard scan"
+    ```bash
+    ./websec-audit.sh -t https://target.com
+    ```
+
+=== "Aggressive (deeper)"
+    ```bash
+    ./websec-audit.sh -t https://target.com --aggressive -T 20
+    ```
+
+=== "Stealth (low noise)"
+    ```bash
+    ./websec-audit.sh -t https://target.com --stealth
+    ```
+
+=== "Through Burp Suite"
+    ```bash
+    ./websec-audit.sh -t https://target.com --proxy http://127.0.0.1:8080
+    ```
+
+=== "Skip slow modules"
+    ```bash
+    ./websec-audit.sh -t https://target.com --skip-nikto --skip-sqli
+    ```
+
+=== "JSON output only"
+    ```bash
+    ./websec-audit.sh -t https://target.com --format json -o /tmp/audit
+    ```
+
+=== "Full port scan"
+    ```bash
+    ./websec-audit.sh -t https://target.com --ports full --aggressive
+    ```
+
+---
+
+## Output directory structure
+
+```
+results_target_20240101_120000/
+├── logs/
+│   ├── audit_20240101_120000.log     # full timestamped log
+│   └── findings.jsonl                # one JSON object per finding
+├── recon/          WHOIS, DNS records, subdomains, WhatWeb, WAF, dorks
+├── portscan/       nmap (.txt .xml .gnmap)
+├── ssl/            testssl.json / sslscan.txt
+├── headers/        response headers
+├── dirs/           gobuster results, sensitive paths found
+├── vulns/          sqlmap/, xss/, nuclei/
+├── cms/            wpscan_results.json, droopescan_*.json
+├── misc/           cors_tests.txt, open_redirect.txt, ssrf_tests.txt, subtakeover.txt
+└── reports/
+    ├── report_*.html   ← open this in your browser
+    ├── report_*.json
+    └── report_*.txt
+```
+
+---
+
+## Next steps
+
+- Read the full [Usage reference](usage.md) for all flags and options
+- Understand [Scan Modes](modes.md) to choose the right intensity
+- Browse the [Module docs](modules/index.md) to learn what each module checks
+- Review [Reports & Output](reports.md) to understand the report format
@@ -0,0 +1,168 @@
+---
+title: Reports & Output
+description: HTML dashboard, JSON report and TXT log formats explained.
+---
+
+# Reports & Output
+
+After every scan, WebSec-Audit generates three report formats automatically inside the output directory.
+
+---
+
+## Output directory
+
+```
+results_<domain>_<timestamp>/
+├── logs/
+│   ├── audit_<timestamp>.log     # live timestamped console log
+│   └── findings.jsonl            # one JSON line per finding (written as discovered)
+├── recon/
+├── portscan/
+├── ssl/
+├── headers/
+├── dirs/
+├── vulns/
+├── cms/
+├── misc/
+└── reports/
+    ├── report_<timestamp>.html
+    ├── report_<timestamp>.json
+    └── report_<timestamp>.txt
+```
+
+You can override the base directory with `-o /path/to/dir`.
+
+---
+
+## HTML report
+
+The most human-friendly format. Open it in any browser — no server needed.
+
+### Features
+
+- **Risk badge** — top-level risk rating (CRITICAL / HIGH / MEDIUM / LOW / INFO ONLY)
+- **Summary cards** — count per severity level with a visual risk bar
+- **Scan metadata panel** — target, IP, duration, mode, modules executed
+- **Interactive findings table**:
+    - Filter by severity with one click
+    - Live full-text search across all fields
+    - Each row shows: severity badge, module, title, description, evidence and remediation
+- **Dark theme** — easy on the eyes during long review sessions
+
+### Severity colour coding
+
+| Badge | Severity | Meaning |
+|---|---|---|
+| <span class="sev sev-critical">CRITICAL</span> | Critical | Immediate exploitation risk. Fix before going live. |
+| <span class="sev sev-high">HIGH</span> | High | Significant security risk. Fix urgently. |
+| <span class="sev sev-medium">MEDIUM</span> | Medium | Notable risk. Fix in next release cycle. |
+| <span class="sev sev-low">LOW</span> | Low | Minor risk or best-practice violation. |
+| <span class="sev sev-info">INFO</span> | Info | Informational only. No direct security impact. |
+
+---
+
+## JSON report
+
+Fully structured, machine-readable report. Ideal for:
+
+- Integration with ticketing systems (Jira, Linear, etc.)
+- Feeding into a SIEM or vulnerability management platform
+- Programmatic post-processing with `jq`
+
+### Schema
+
+```json
+{
+  "metadata": {
+    "tool": "websec-audit",
+    "version": "1.0.1",
+    "author": "davidalvarezp",
+    "target": "https://target.com",
+    "domain": "target.com",
+    "ip": "93.184.216.34",
+    "start_time": "2026-03-23 12:00:00",
+    "duration_secs": 487
+  },
+  "summary": {
+    "total": 21,
+    "critical": 2,
+    "high": 5,
+    "medium": 7,
+    "low": 4,
+    "info": 3
+  },
+  "findings": [
+    {
+      "id": 1,
+      "severity": "CRITICAL",
+      "module": "RECON",
+      "title": "DNS Zone Transfer (AXFR) is permitted",
+      "description": "Name server ns1.target.com allows AXFR — full DNS zone disclosed.",
+      "evidence": "dig AXFR target.com @ns1.target.com",
+      "recommendation": "Restrict AXFR to authorised secondary name servers only.",
+      "timestamp": "2024-01-01T12:00:12Z"
+    }
+  ]
+}
+```
+
+### Useful `jq` queries
+
+```bash
+# Count by severity
+jq '.summary' report_*.json
+
+# List all critical findings
+jq '.findings[] | select(.severity=="CRITICAL") | .title' report_*.json
+
+# Export findings as CSV
+jq -r '.findings[] | [.id,.severity,.module,.title] | @csv' report_*.json
+
+# Filter by module
+jq '.findings[] | select(.module=="HEADERS")' report_*.json
+```
+
+---
+
+## TXT report
+
+Full timestamped plain-text log. Contains:
+
+- Scan metadata header
+- Risk summary table
+- Complete audit log with all module output
+
+Ideal for formal deliverables that require a plaintext audit trail.
+
+---
+
+## JSONL findings file
+
+`findings.jsonl` is written **as findings are discovered** — one JSON object per line.
+This means if the scan is interrupted (Ctrl-C), you still have a valid, processable findings file.
+
+```bash
+# Count findings in a partial scan
+wc -l findings.jsonl
+
+# Pretty-print the last finding
+tail -1 findings.jsonl | jq .
+```
+
+---
+
+## Controlling report format
+
+```bash
+# Generate all formats (default)
+./websec-audit.sh -t https://target.com
+
+# JSON only
+./websec-audit.sh -t https://target.com --format json
+
+# HTML only
+./websec-audit.sh -t https://target.com --format html
+
+# TXT only
+./websec-audit.sh -t https://target.com --format txt
+```
@@ -0,0 +1,123 @@
+---
+title: All Options
+description: Complete reference for all websec-audit flags, options and module controls.
+---
+
+# All Options
+
+Complete CLI reference for WebSec-Audit.
+
+```
+./websec-audit.sh -t <target> [options]
+```
+
+---
+
+## Required
+
+| Flag | Description |
+|---|---|
+| `-t`, `--target <url\|ip>` | Target URL or IP address. If no scheme is provided, `https://` is assumed. |
+
+---
+
+## Output
+
+| Flag | Default | Description |
+|---|---|---|
+| `-o`, `--output <dir>` | `./results_<domain>_<ts>` | Directory where all results are saved |
+| `--format <fmt>` | `all` | Report format: `json` \| `html` \| `txt` \| `all` |
+
+---
+
+## Scan options
+
+| Flag | Default | Description |
+|---|---|---|
+| `-T`, `--threads <n>` | `10` | Concurrent threads passed to brute-force tools |
+| `-p`, `--ports <profile>` | `top-1000` | Port profile: `top-100` \| `top-1000` \| `full` |
+| `--timeout <s>` | `10` | Connection timeout in seconds for all HTTP/TCP operations |
+| `--depth <n>` | `3` | Crawl depth used in aggressive sqlmap and CMS scans |
+| `--proxy <url>` | _(none)_ | Route all traffic through this proxy (e.g. `http://127.0.0.1:8080`) |
+| `--aggressive` | off | Aggressive mode — deeper scans, higher noise, more findings |
+| `--stealth` | off | Stealth mode — slower, lower detection footprint |
+
+!!! warning
+    `--aggressive` and `--stealth` are mutually exclusive. If both are provided, `--aggressive` takes precedence.
+
+---
+
+## Module control
+
+Every module can be individually disabled. Useful for scoping an audit or skipping slow/noisy tools.
+
+| Flag | Module disabled |
+|---|---|
+| `--skip-recon` | Reconnaissance (WHOIS, DNS, subdomain enum) |
+| `--skip-portscan` | Port scanning (nmap) |
+| `--skip-fingerprint` | Web fingerprinting (WhatWeb, WAF) |
+| `--skip-ssl` | SSL/TLS analysis |
+| `--skip-headers` | HTTP security headers |
+| `--skip-dirbrute` | Directory & file brute-forcing |
+| `--skip-nikto` | Nikto web scanner |
+| `--skip-sqli` | SQL injection (sqlmap) |
+| `--skip-xss` | XSS testing (dalfox + manual) |
+| `--skip-cms` | CMS detection & scanning |
+| `--skip-cors` | CORS misconfiguration tests |
+| `--skip-redirect` | Open redirect tests |
+| `--skip-ssrf` | SSRF tests |
+| `--skip-subtakeover` | Subdomain takeover checks |
+| `--skip-nuclei` | Nuclei template scan |
+
+---
+
+## Wordlists
+
+| Flag | Default | Description |
+|---|---|---|
+| `--wl-dirs-small <file>` | `/usr/share/wordlists/dirb/common.txt` | Small wordlist for directory brute-force (normal mode) |
+| `--wl-dirs-big <file>` | `/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt` | Large wordlist (aggressive mode) |
+| `--wl-dns <file>` | `/usr/share/wordlists/dnsmap.txt` | DNS subdomain brute-force wordlist |
+
+---
+
+## Misc
+
+| Flag | Description |
+|---|---|
+| `-v`, `--verbose` | Print verbose debug output to stdout |
+| `--no-color` | Disable ANSI colour output (useful for piping / CI) |
+| `--no-banner` | Suppress the ASCII banner (useful for scripting) |
+| `-V`, `--version` | Print version and exit |
+| `-h`, `--help` | Print usage and exit |
+
+---
+
+## Examples
+
+```bash
+# Basic scan
+./websec-audit.sh -t https://target.com
+
+# Aggressive with 20 threads, custom output dir
+./websec-audit.sh -t https://target.com --aggressive -T 20 -o /tmp/audit
+
+# Stealth through Burp Suite
+./websec-audit.sh -t https://target.com --stealth --proxy http://127.0.0.1:8080
+
+# Skip slow modules, verbose, JSON only
+./websec-audit.sh -t https://target.com --skip-nikto --skip-sqli -v --format json
+
+# Full port scan, deep crawl
+./websec-audit.sh -t https://target.com --ports full --depth 5 --aggressive
+
+# Headers and SSL audit only (everything else skipped)
+./websec-audit.sh -t https://target.com \
+  --skip-recon --skip-portscan --skip-fingerprint \
+  --skip-dirbrute --skip-nikto --skip-sqli --skip-xss \
+  --skip-cms --skip-cors --skip-redirect --skip-ssrf \
+  --skip-subtakeover --skip-nuclei
+
+# No colour, no banner — clean output for CI/logging
+./websec-audit.sh -t https://target.com --no-color --no-banner
+```
@@ -0,0 +1,149 @@
+site_name: WebSec-Audit
+site_description: Professional Web Security Audit Framework — modular, extensible, production-ready
+site_author: davidalvarezp
+site_url: https://davidalvarezp.github.io/websec-audit
+
+repo_name: davidalvarezp/websec-audit
+repo_url: https://github.com/davidalvarezp/websec-audit
+edit_uri: edit/main/docs/
+
+copyright: >
+  Copyright &copy; 2026 <a href="https://davidalvarezp.com">davidalvarezp</a>.
+
+theme:
+  name: material
+  custom_dir: docs/overrides
+
+  palette:
+    - media: "(prefers-color-scheme: dark)"
+      scheme: slate
+      primary: blue
+      accent: light blue
+      toggle:
+        icon: material/weather-sunny
+        name: Switch to light mode
+    - media: "(prefers-color-scheme: light)"
+      scheme: default
+      primary: blue
+      accent: light blue
+      toggle:
+        icon: material/weather-night
+        name: Switch to dark mode
+
+  font:
+    text: Inter
+    code: JetBrains Mono
+
+  logo: assets/logo.svg
+  favicon: assets/favicon.png
+
+  icon:
+    repo: fontawesome/brands/github
+
+  features:
+    - navigation.instant
+    - navigation.instant.prefetch
+    - navigation.tracking
+    - navigation.tabs
+    - navigation.tabs.sticky
+    - navigation.sections
+    - navigation.expand
+    - navigation.path
+    - navigation.indexes
+    - navigation.top
+    - toc.follow
+    - search.suggest
+    - search.highlight
+    - search.share
+    - content.code.copy
+    - content.code.annotate
+    - content.tabs.link
+    - content.action.edit
+    - content.action.view
+    - header.autohide
+    - announce.dismiss
+
+plugins:
+  - search:
+      lang: en
+  - minify:
+      minify_html: true
+
+markdown_extensions:
+  - abbr
+  - admonition
+  - attr_list
+  - def_list
+  - footnotes
+  - md_in_html
+  - tables
+  - toc:
+      permalink: true
+      title: On this page
+  - pymdownx.details
+  - pymdownx.emoji:
+      emoji_index:     !!python/name:material.extensions.emoji.twemoji
+      emoji_generator: !!python/name:material.extensions.emoji.to_svg
+  - pymdownx.highlight:
+      anchor_linenums: true
+      line_spans: __span
+      pygments_lang_class: true
+  - pymdownx.inlinehilite
+  - pymdownx.keys
+  - pymdownx.mark
+  - pymdownx.smartsymbols
+  - pymdownx.superfences:
+      custom_fences:
+        - name: mermaid
+          class: mermaid
+          format: !!python/name:pymdownx.superfences.fence_code_format
+  - pymdownx.tabbed:
+      alternate_style: true
+  - pymdownx.tasklist:
+      custom_checkbox: true
+  - pymdownx.tilde
+
+extra_css:
+  - assets/extra.css
+
+extra:
+  social:
+    - icon: fontawesome/brands/github
+      link: https://github.com/davidalvarezp
+      name: davidalvarezp on GitHub
+    - icon: fontawesome/brands/linkedin
+      link: https://www.linkedin.com/in/davidalvarezp
+      name: davidalvarezp on LinkedIn
+    - icon: fontawesome/solid/globe
+      link: https://davidalvarezp.com
+      name: davidalvarezp.com
+  generator: false
+
+nav:
+  - Home: index.md
+  - Getting Started:
+    - Installation: installation.md
+    - Quick Start: quickstart.md
+  - Usage:
+    - All Options: usage.md
+    - Scan Modes: modes.md
+    - Reports & Output: reports.md
+  - Modules:
+    - Overview: modules/index.md
+    - "01 · Reconnaissance": modules/recon.md
+    - "02 · Port Scanning": modules/portscan.md
+    - "03 · Fingerprinting": modules/fingerprint.md
+    - "04 · SSL/TLS": modules/ssl.md
+    - "05 · HTTP Headers": modules/headers.md
+    - "06 · Dir & File Enum": modules/dirbrute.md
+    - "07 · Nikto": modules/nikto.md
+    - "08 · SQL Injection": modules/sqli.md
+    - "09 · XSS": modules/xss.md
+    - "10 · CMS Scanning": modules/cms.md
+    - "11 · CORS": modules/cors.md
+    - "12 · Open Redirect": modules/redirect.md
+    - "13 · SSRF": modules/ssrf.md
+    - "14 · Subdomain Takeover": modules/subtakeover.md
+    - "15 · Nuclei": modules/nuclei.md
+  - Contributing: contributing.md
+  - Changelog: changelog.md
@@ -0,0 +1,6 @@
+mkdocs>=1.6.0
+mkdocs-material>=9.5.0
+mkdocs-minify-plugin>=0.8.0
+mkdocs-git-revision-date-localized-plugin>=1.2.4
+pymdown-extensions>=10.7
+mike>=2.0.0