{"config":{"lang":["en"],"separator":"[\\s\\-]+","pipeline":["stopWordFilter"],"fields":{"title":{"boost":1000.0},"text":{"boost":1.0},"tags":{"boost":1000000.0}}},"docs":[{"location":"","title":"WebSec-Audit","text":"\ud83d\udd10 WebSec-Audit <p>Professional Web Security Audit Framework \u2014 modular, extensible, Bash-native</p>   [![Version](https://img.shields.io/badge/version-1.0.1-blue?style=flat-square)](https://github.com/davidalvarezp/websec-audit/releases) [![License](https://img.shields.io/badge/license-MIT-green?style=flat-square)](https://github.com/davidalvarezp/websec-audit/blob/main/LICENSE) [![Bash](https://img.shields.io/badge/bash-5.0%2B-orange?style=flat-square)](https://www.gnu.org/software/bash/) [![Platform](https://img.shields.io/badge/platform-Debian%20%7C%20Ubuntu%20%7C%20Kali-lightgrey?style=flat-square)](https://github.com/davidalvarezp/websec-audit) [![CI](https://img.shields.io/github/actions/workflow/status/davidalvarezp/websec-audit/ci.yml?label=CI&amp;style=flat-square)](https://github.com/davidalvarezp/websec-audit/actions)   <p>Legal Notice</p> <p>This tool is intended exclusively for authorised security assessments. Only run it against systems you own or have explicit written permission to test. Unauthorised use is illegal. The author assumes no liability for misuse.</p>"},{"location":"#what-is-websec-audit","title":"What is websec-audit?","text":"<p>websec-audit is a Bash framework that automates comprehensive web application security audits. It integrates 15+ independent modules \u2014 from passive reconnaissance to active exploitation \u2014 and produces professional findings reports in three formats.</p> <p>Designed to run on Debian, Ubuntu and Kali Linux with zero mandatory dependencies beyond <code>curl</code> and <code>nmap</code>.</p>"},{"location":"#feature-highlights","title":"Feature highlights","text":"<ul> <li> <p> Modular architecture</p> <p>Enable or disable any of the 15+ modules with a single <code>--skip-&lt;module&gt;</code> flag.</p> </li> <li> <p> Three scan modes</p> <p>Normal, Aggressive and Stealth \u2014 adapt the scan depth to each engagement.</p> </li> <li> <p> Rich reports</p> <p>Interactive HTML dashboard, structured JSON and plain-text log \u2014 generated automatically.</p> </li> <li> <p> Broad coverage</p> <p>Recon \u00b7 Port scan \u00b7 SSL/TLS \u00b7 Headers \u00b7 SQLi \u00b7 XSS \u00b7 SSRF \u00b7 CORS \u00b7 CMS \u00b7 Takeover \u00b7 Nuclei</p> </li> <li> <p> Proxy support</p> <p>Route all traffic through Burp Suite or any HTTP proxy with <code>--proxy</code>.</p> </li> <li> <p> Tool-agnostic</p> <p>Graceful fallback when optional tools are absent. Core scan works with only <code>curl</code> + <code>nmap</code>.</p> </li> </ul>"},{"location":"#modules-at-a-glance","title":"Modules at a glance","text":"Module 01 Reconnaissance WHOIS \u00b7 DNS \u00b7 AXFR \u00b7 Subdomains \u00b7 SPF/DMARC \u00b7 Dorks Module 02 Port Scanning nmap \u00b7 service detection \u00b7 risk analysis Module 03 Fingerprinting WhatWeb \u00b7 WAF detection \u00b7 version leakage Module 04 SSL/TLS testssl.sh \u00b7 ciphers \u00b7 cert expiry \u00b7 HSTS Module 05 HTTP Headers CSP \u00b7 cookies \u00b7 clickjacking \u00b7 redirects Module 06 Dir &amp; File Enum gobuster \u00b7 ffuf \u00b7 40+ sensitive paths Module 07 Nikto Web server CVEs \u00b7 misconfigurations Module 08 SQL Injection sqlmap \u00b7 auto + aggressive mode Module 09 XSS dalfox \u00b7 reflected \u00b7 DOM-based Module 10 CMS Scanning WordPress \u00b7 Drupal \u00b7 Joomla \u00b7 Magento Module 11 CORS wildcard \u00b7 reflected origin \u00b7 null origin Module 12 Open Redirect 20 params \u00d7 10 payloads Module 13 SSRF AWS \u00b7 GCP \u00b7 Azure IMDS \u00b7 internal IPs Module 14 Subdomain Takeover subjack \u00b7 nuclei \u00b7 20+ services Module 15 Nuclei CVE templates \u00b7 misconfiguration scan"},{"location":"#quick-start","title":"Quick start","text":"<pre><code>git clone https://github.com/davidalvarezp/websec-audit.git\ncd websec-audit\nchmod +x install.sh websec-audit.sh\nsudo ./install.sh\n./websec-audit.sh -t https://target.com\n</code></pre> <p> See Installation and Quick Start for details.</p>"},{"location":"#author","title":"Author","text":"<p>Built by davidalvarezp.</p> <p> github.com/davidalvarezp \u00b7  linkedin.com/in/davidalvarezp</p>"},{"location":"changelog/","title":"Changelog","text":"<p>All notable changes are documented here. Format follows Keep a Changelog. Versioning follows Semantic Versioning.</p>"},{"location":"changelog/#101-2026-03-23","title":"1.0.1 \u2014 2026-03-23","text":""},{"location":"changelog/#added","title":"Added","text":"<ul> <li>Module 15 \u2014 Nuclei template scan integration</li> <li>Module 14 \u2014 Subdomain Takeover: subjack + Nuclei + CNAME analysis for 20+ services</li> <li>Module 13 \u2014 SSRF: cloud IMDS probing (AWS/GCP/Azure), decimal/hex IP encoding</li> <li>Module 12 \u2014 Open Redirect: 20 params \u00d7 10 payloads</li> <li>Module 11 \u2014 CORS: null origin, credentialed, wildcard detection</li> <li>Module 10 \u2014 CMS: WordPress REST API user enumeration, debug.log, xmlrpc.php</li> <li>Module 09 \u2014 XSS: dalfox integration + 8 reflected payloads \u00d7 15 parameters</li> <li>Module 08 \u2014 SQLi: sqlmap with forms crawl and tamper scripts in aggressive mode</li> <li>Module 07 \u2014 Nikto: severity-based finding classification</li> <li>Module 06 \u2014 Dir Enum: 40 sensitive path probes (<code>.git</code>, <code>.env</code>, AWS credentials, Dockerfiles)</li> <li>Module 05 \u2014 HTTP Headers: CSP deep audit, SameSite=None, Cache-Control</li> <li>Module 04 \u2014 SSL/TLS: HSTS preload, cert expiry thresholds (14/30/90 days)</li> <li>Module 03 \u2014 Fingerprint: WAF detection, version-leaking header enumeration</li> <li>Module 02 \u2014 Port Scan: risk analysis for 20+ dangerous ports</li> <li>Module 01 \u2014 Recon: SPF <code>+all</code> detection, DMARC <code>p=none</code>, 700+ Google Dorks</li> <li>Interactive HTML report with severity filter, live search and risk bar</li> <li>JSON report with full metadata envelope</li> <li><code>--format json|html|txt|all</code> flag</li> <li><code>--no-banner</code> and <code>--version</code> flags</li> <li>Graceful interrupt \u2014 partial reports generated on SIGINT/SIGTERM</li> <li><code>findings.jsonl</code> written as-discovered for resilient partial runs</li> <li>Aggressive mode: nmap <code>-A -O --script=vuln,auth</code>, sqlmap level 5 + tamper, deep DOM XSS</li> <li>Stealth mode: nmap <code>-sS -T2 -f</code>, sqlmap delay, safe-freq</li> </ul>"},{"location":"changelog/#changed","title":"Changed","text":"<ul> <li>Fully rewritten in English</li> <li>Modular <code>module_*()</code> function architecture</li> <li><code>add_finding()</code> emits structured JSONL with id, severity, module, title, description, evidence, recommendation, timestamp</li> <li>Output directory reorganised into 9 subdirectories</li> </ul>"},{"location":"changelog/#fixed","title":"Fixed","text":"<ul> <li>SPF detection now handles multi-TXT records</li> <li>HSTS check handles missing header without error</li> <li>JSON report correctly escapes multi-line evidence strings</li> </ul>"},{"location":"changelog/#100-2026-01-13","title":"1.0.0 \u2014 2026-01-13","text":""},{"location":"changelog/#added_1","title":"Added","text":"<ul> <li>Initial release</li> <li>Core modules: recon, port scan, SSL, headers, dir brute-force, nikto, sqlmap</li> <li>Basic HTML report</li> <li>Spanish-language interface</li> </ul>"},{"location":"contributing/","title":"Contributing","text":"<p>Contributions are welcome. This page covers everything you need to know before opening a PR.</p>"},{"location":"contributing/#getting-started","title":"Getting started","text":"<ol> <li>Fork the repository on GitHub</li> <li>Clone your fork: <code>git clone https://github.com/YOUR_USER/websec-audit.git</code></li> <li>Create a feature branch: <code>git checkout -b feature/your-feature</code></li> <li>Make your changes</li> <li>Run <code>shellcheck -S warning websec-audit.sh</code> \u2014 zero warnings required</li> <li>Commit using conventional commits (see below)</li> <li>Push and open a Pull Request against <code>main</code></li> </ol>"},{"location":"contributing/#code-style","title":"Code style","text":"<ul> <li>Target bash 5.0+</li> <li>Use <code>set -euo pipefail</code> at the top of every script</li> <li>Quote all variable expansions: <code>\"$var\"</code> not <code>$var</code></li> <li>Use <code>[[ ]]</code> for conditions</li> <li>Declare local variables with <code>local var</code> then assign separately (avoids SC2155)</li> <li>Run <code>shellcheck</code> before every commit</li> </ul>"},{"location":"contributing/#adding-a-new-module","title":"Adding a new module","text":"<ol> <li>Add a toggle: <code>MOD_MYMODULE=1</code></li> <li>Add <code>--skip-mymodule</code> to <code>parse_args()</code></li> <li>Write the function:</li> </ol> <pre><code>module_mymodule() {\n  [[ $MOD_MYMODULE -eq 0 ]] &amp;&amp; return\n  log_section \"MODULE XX \u2014 NAME\"\n\n  # your logic\n\n  add_finding \"HIGH\" \"MYMODULE\" \"Title\" \"Description\" \"evidence\" \"Remediation.\"\n}\n</code></pre> <ol> <li>Call it in <code>main()</code> before <code>generate_reports</code></li> <li>Add to the module table in <code>README.md</code> and these docs</li> <li>Add a <code>CHANGELOG.md</code> entry</li> </ol>"},{"location":"contributing/#commit-conventions","title":"Commit conventions","text":"<pre><code>feat(module): add GraphQL introspection detection\nfix(ssl): handle certificates with no expiry date\ndocs(readme): add Kali installation instructions\nrefactor(headers): extract cookie analysis into helper\n</code></pre> <p>Types: <code>feat</code> \u00b7 <code>fix</code> \u00b7 <code>docs</code> \u00b7 <code>refactor</code> \u00b7 <code>perf</code> \u00b7 <code>test</code> \u00b7 <code>chore</code></p>"},{"location":"contributing/#issue-templates","title":"Issue templates","text":"<p>Use the GitHub issue templates:</p> <ul> <li>Bug report \u2014 for unexpected behaviour or errors</li> <li>Feature request \u2014 for new modules or improvements</li> </ul>"},{"location":"contributing/#full-guide","title":"Full guide","text":"<p>The complete contributing guide is in the repository: CONTRIBUTING.md </p>"},{"location":"installation/","title":"Installation","text":"<p>WebSec-Audit runs on Debian 11/12/13, Ubuntu 20.04/22.04/24.04 and Kali Linux 2023+.</p>"},{"location":"installation/#automatic-install-recommended","title":"Automatic install (recommended)","text":"<p>The bundled <code>install.sh</code> script handles everything: APT packages, Go binaries, Ruby gems, Python packages and wordlists.</p> <pre><code>git clone https://github.com/davidalvarezp/websec-audit.git\ncd websec-audit\nchmod +x install.sh websec-audit.sh\nsudo ./install.sh\n</code></pre> <p>The installer detects your architecture (<code>amd64</code> / <code>arm64</code>) and downloads the correct pre-compiled binaries for tools not available via APT.</p> <p>Install log</p> <p>The installer writes a full log to <code>/tmp/websec_install_&lt;timestamp&gt;.log</code>. Check it if anything fails.</p>"},{"location":"installation/#manual-install","title":"Manual install","text":""},{"location":"installation/#required-core-functionality","title":"Required (core functionality)","text":"<pre><code>sudo apt-get install -y curl nmap\n</code></pre>"},{"location":"installation/#recommended-significantly-improves-coverage","title":"Recommended (significantly improves coverage)","text":"<pre><code>sudo apt-get install -y \\\n  nikto sqlmap gobuster dirb \\\n  whatweb wafw00f sslscan \\\n  python3 python3-pip jq ruby \\\n  dnsutils whois wordlists\n</code></pre>"},{"location":"installation/#optional-tools-install-individually","title":"Optional tools (install individually)","text":"testssl.shwpscandalfoxsubfindernucleidroopescan <pre><code>git clone --depth 1 https://github.com/drwetter/testssl.sh.git /opt/testssl.sh\nsudo ln -s /opt/testssl.sh/testssl.sh /usr/local/bin/testssl.sh\n</code></pre> <pre><code>sudo gem install wpscan --no-document\n</code></pre> <pre><code># Download latest release for your arch\nwget https://github.com/hahwul/dalfox/releases/latest/download/dalfox_linux_amd64.tar.gz\ntar -xzf dalfox_linux_amd64.tar.gz\nsudo mv dalfox /usr/local/bin/\n</code></pre> <pre><code>wget https://github.com/projectdiscovery/subfinder/releases/latest/download/subfinder_linux_amd64.zip\nunzip subfinder_linux_amd64.zip\nsudo mv subfinder /usr/local/bin/\n</code></pre> <pre><code>wget https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei_linux_amd64.zip\nunzip nuclei_linux_amd64.zip\nsudo mv nuclei /usr/local/bin/\nnuclei -update-templates\n</code></pre> <pre><code>pip3 install droopescan\n</code></pre>"},{"location":"installation/#kali-linux","title":"Kali Linux","text":"<p>Most tools are pre-installed. Run the installer to fill any remaining gaps:</p> <pre><code>sudo ./install.sh\n</code></pre>"},{"location":"installation/#verifying-the-installation","title":"Verifying the installation","text":"<pre><code>./websec-audit.sh --version\n</code></pre> <p>Expected output:</p> <pre><code>websec-audit v1.0.1 \u2014 davidalvarezp\n</code></pre> <p>The tool also performs a dependency check at the start of every scan, listing which tools are available and which are missing.</p>"},{"location":"installation/#dependency-matrix","title":"Dependency matrix","text":"Tool Required Module(s) <code>curl</code> \u2705 All HTTP modules <code>nmap</code> \u2705 Port Scanning <code>nikto</code> optional Nikto <code>sqlmap</code> optional SQL Injection <code>gobuster</code> optional Dir &amp; File Enum <code>ffuf</code> optional Dir &amp; File Enum (fallback) <code>dirb</code> optional Dir &amp; File Enum (fallback) <code>whatweb</code> optional Fingerprinting <code>wafw00f</code> optional Fingerprinting <code>sslscan</code> optional SSL/TLS <code>testssl.sh</code> optional SSL/TLS (preferred) <code>wpscan</code> optional CMS \u2014 WordPress <code>droopescan</code> optional CMS \u2014 Drupal/Joomla <code>dalfox</code> optional XSS <code>subfinder</code> optional Reconnaissance <code>amass</code> optional Reconnaissance <code>dnsrecon</code> optional Reconnaissance <code>subjack</code> optional Subdomain Takeover <code>nuclei</code> optional Nuclei + Takeover <code>jq</code> optional JSON report parsing <code>python3</code> optional URL encoding, HTML reports <code>whois</code> optional Reconnaissance <code>dig</code> optional DNS analysis"},{"location":"modes/","title":"Scan Modes","text":"<p>WebSec-Audit supports three scan modes that control depth, noise and speed across all modules.</p>"},{"location":"modes/#normal-default","title":"Normal (default)","text":"<p>Balanced scan suitable for most engagements. Moderate threads, mid-level tool aggression.</p> <pre><code>./websec-audit.sh -t https://target.com\n</code></pre> Aspect Behaviour nmap <code>-sV -sC --open -T4 --top-ports 1000</code> sqlmap <code>--level=3 --risk=2</code> gobuster Small wordlist, 10 threads dalfox Standard mode WhatWeb Aggression level 1 Nikto Default plugins"},{"location":"modes/#aggressive","title":"Aggressive","text":"<p>Deepest scan. More findings, significantly more network noise. Use only when the scope explicitly permits it.</p> <pre><code>./websec-audit.sh -t https://target.com --aggressive\n./websec-audit.sh -t https://target.com --aggressive -T 20 --ports full\n</code></pre> Aspect Behaviour nmap Adds <code>-A -O --script=vuln,auth,default,discovery</code> sqlmap <code>--level=5 --risk=3 --forms --crawl=&lt;depth&gt; --dbs --tamper=space2comment</code> gobuster Large wordlist (<code>dirbuster medium</code>) dalfox <code>--deep-domxss --follow-redirects</code> WhatWeb Aggression level 3 Nikto <code>--Plugins @@ALL</code> Nuclei Includes <code>low</code> severity templates Port profile Can be combined with <code>--ports full</code> for <code>-p-</code> scan <p>Noise warning</p> <p>Aggressive mode will almost certainly trigger IDS/IPS alerts and WAF blocks. Always confirm with the client that this level of noise is within scope.</p>"},{"location":"modes/#stealth","title":"Stealth","text":"<p>Slower scan designed to minimise the detection footprint. Useful for red team engagements or environments with sensitive monitoring.</p> <pre><code>./websec-audit.sh -t https://target.com --stealth\n</code></pre> Aspect Behaviour nmap <code>-sS -T2 -f --data-length 32 --randomize-hosts</code> sqlmap <code>--delay=2 --safe-freq=3 --smart</code> gobuster Small wordlist, reduced threads HTTP requests Longer intervals between requests <p>Stealth limitations</p> <p>Stealth mode reduces noise but does not guarantee evasion. A determined blue team will still detect the scan. For full covert operations, consider manual testing with specific targeted checks only.</p>"},{"location":"modes/#mode-comparison","title":"Mode comparison","text":"Feature Normal Aggressive Stealth nmap scripts default vuln + auth + discovery SYN + fragmented sqlmap level 3 5 3 sqlmap risk 2 3 2 Crawling No Yes (--depth) No Full port scan Optional Recommended Not recommended WAF evasion None None Partial Speed Medium Fast Slow Noise Medium High Low Detection risk Medium High Low-Medium"},{"location":"modes/#combining-flags","title":"Combining flags","text":"<p>Modes can be combined with any module or output flag:</p> <pre><code># Aggressive + custom threads + JSON only + proxy\n./websec-audit.sh -t https://target.com \\\n  --aggressive -T 20 \\\n  --proxy http://127.0.0.1:8080 \\\n  --format json \\\n  -o /tmp/red-team-audit\n</code></pre>"},{"location":"quickstart/","title":"Quick Start","text":"<p>Get up and running in under 2 minutes.</p> <p>Authorised targets only</p> <p>Only scan systems you own or have explicit written permission to test. For practice, use DVWA, WebGoat, or a HackTheBox / TryHackMe machine.</p>"},{"location":"quickstart/#1-clone-and-install","title":"1. Clone and install","text":"<pre><code>git clone https://github.com/davidalvarezp/websec-audit.git\ncd websec-audit\nchmod +x install.sh websec-audit.sh\nsudo ./install.sh\n</code></pre>"},{"location":"quickstart/#2-run-your-first-scan","title":"2. Run your first scan","text":"<pre><code>./websec-audit.sh -t https://target.com\n</code></pre> <p>The scan runs all 15 modules sequentially. Depending on the target and available tools, a standard scan takes 5\u201320 minutes.</p>"},{"location":"quickstart/#3-review-the-results","title":"3. Review the results","text":"<p>When the scan finishes you will see a summary like this:</p> <pre><code>  \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n  \u2502  TARGET   : https://target.com                    \u2502\n  \u2502  IP       : 93.184.216.34                         \u2502\n  \u2502  RISK     : HIGH                                  \u2502\n  \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n  \u2502  CRITICAL : 2                                     \u2502\n  \u2502  HIGH     : 5                                     \u2502\n  \u2502  MEDIUM   : 7                                     \u2502\n  \u2502  LOW      : 4                                     \u2502\n  \u2502  INFO     : 3                                     \u2502\n  \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n  \u2502  TOTAL    : 21 finding(s)                         \u2502\n  \u2502  DURATION : 487s                                  \u2502\n  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n  HTML report : results_target_YYYYMMDD_HHMMSS/reports/report_*.html\n  JSON report : results_target_YYYYMMDD_HHMMSS/reports/report_*.json\n  Audit log   : results_target_YYYYMMDD_HHMMSS/logs/audit_*.log\n</code></pre> <p>Open the HTML report in your browser for the interactive dashboard.</p>"},{"location":"quickstart/#common-usage-patterns","title":"Common usage patterns","text":"Standard scanAggressive (deeper)Stealth (low noise)Through Burp SuiteSkip slow modulesJSON output onlyFull port scan <pre><code>./websec-audit.sh -t https://target.com\n</code></pre> <pre><code>./websec-audit.sh -t https://target.com --aggressive -T 20\n</code></pre> <pre><code>./websec-audit.sh -t https://target.com --stealth\n</code></pre> <pre><code>./websec-audit.sh -t https://target.com --proxy http://127.0.0.1:8080\n</code></pre> <pre><code>./websec-audit.sh -t https://target.com --skip-nikto --skip-sqli\n</code></pre> <pre><code>./websec-audit.sh -t https://target.com --format json -o /tmp/audit\n</code></pre> <pre><code>./websec-audit.sh -t https://target.com --ports full --aggressive\n</code></pre>"},{"location":"quickstart/#output-directory-structure","title":"Output directory structure","text":"<pre><code>results_target_20240101_120000/\n\u251c\u2500\u2500 logs/\n\u2502   \u251c\u2500\u2500 audit_20240101_120000.log     # full timestamped log\n\u2502   \u2514\u2500\u2500 findings.jsonl                # one JSON object per finding\n\u251c\u2500\u2500 recon/          WHOIS, DNS records, subdomains, WhatWeb, WAF, dorks\n\u251c\u2500\u2500 portscan/       nmap (.txt .xml .gnmap)\n\u251c\u2500\u2500 ssl/            testssl.json / sslscan.txt\n\u251c\u2500\u2500 headers/        response headers\n\u251c\u2500\u2500 dirs/           gobuster results, sensitive paths found\n\u251c\u2500\u2500 vulns/          sqlmap/, xss/, nuclei/\n\u251c\u2500\u2500 cms/            wpscan_results.json, droopescan_*.json\n\u251c\u2500\u2500 misc/           cors_tests.txt, open_redirect.txt, ssrf_tests.txt, subtakeover.txt\n\u2514\u2500\u2500 reports/\n    \u251c\u2500\u2500 report_*.html   \u2190 open this in your browser\n    \u251c\u2500\u2500 report_*.json\n    \u2514\u2500\u2500 report_*.txt\n</code></pre>"},{"location":"quickstart/#next-steps","title":"Next steps","text":"<ul> <li>Read the full Usage reference for all flags and options</li> <li>Understand Scan Modes to choose the right intensity</li> <li>Browse the Module docs to learn what each module checks</li> <li>Review Reports &amp; Output to understand the report format</li> </ul>"},{"location":"reports/","title":"Reports &amp; Output","text":"<p>After every scan, WebSec-Audit generates three report formats automatically inside the output directory.</p>"},{"location":"reports/#output-directory","title":"Output directory","text":"<pre><code>results_&lt;domain&gt;_&lt;timestamp&gt;/\n\u251c\u2500\u2500 logs/\n\u2502   \u251c\u2500\u2500 audit_&lt;timestamp&gt;.log     # live timestamped console log\n\u2502   \u2514\u2500\u2500 findings.jsonl            # one JSON line per finding (written as discovered)\n\u251c\u2500\u2500 recon/\n\u251c\u2500\u2500 portscan/\n\u251c\u2500\u2500 ssl/\n\u251c\u2500\u2500 headers/\n\u251c\u2500\u2500 dirs/\n\u251c\u2500\u2500 vulns/\n\u251c\u2500\u2500 cms/\n\u251c\u2500\u2500 misc/\n\u2514\u2500\u2500 reports/\n    \u251c\u2500\u2500 report_&lt;timestamp&gt;.html\n    \u251c\u2500\u2500 report_&lt;timestamp&gt;.json\n    \u2514\u2500\u2500 report_&lt;timestamp&gt;.txt\n</code></pre> <p>You can override the base directory with <code>-o /path/to/dir</code>.</p>"},{"location":"reports/#html-report","title":"HTML report","text":"<p>The most human-friendly format. Open it in any browser \u2014 no server needed.</p>"},{"location":"reports/#features","title":"Features","text":"<ul> <li>Risk badge \u2014 top-level risk rating (CRITICAL / HIGH / MEDIUM / LOW / INFO ONLY)</li> <li>Summary cards \u2014 count per severity level with a visual risk bar</li> <li>Scan metadata panel \u2014 target, IP, duration, mode, modules executed</li> <li>Interactive findings table:<ul> <li>Filter by severity with one click</li> <li>Live full-text search across all fields</li> <li>Each row shows: severity badge, module, title, description, evidence and remediation</li> </ul> </li> <li>Dark theme \u2014 easy on the eyes during long review sessions</li> </ul>"},{"location":"reports/#severity-colour-coding","title":"Severity colour coding","text":"Badge Severity Meaning CRITICAL Critical Immediate exploitation risk. Fix before going live. HIGH High Significant security risk. Fix urgently. MEDIUM Medium Notable risk. Fix in next release cycle. LOW Low Minor risk or best-practice violation. INFO Info Informational only. No direct security impact."},{"location":"reports/#json-report","title":"JSON report","text":"<p>Fully structured, machine-readable report. Ideal for:</p> <ul> <li>Integration with ticketing systems (Jira, Linear, etc.)</li> <li>Feeding into a SIEM or vulnerability management platform</li> <li>Programmatic post-processing with <code>jq</code></li> </ul>"},{"location":"reports/#schema","title":"Schema","text":"<pre><code>{\n  \"metadata\": {\n    \"tool\": \"websec-audit\",\n    \"version\": \"1.0.1\",\n    \"author\": \"davidalvarezp\",\n    \"target\": \"https://target.com\",\n    \"domain\": \"target.com\",\n    \"ip\": \"93.184.216.34\",\n    \"start_time\": \"2026-03-23 12:00:00\",\n    \"duration_secs\": 487\n  },\n  \"summary\": {\n    \"total\": 21,\n    \"critical\": 2,\n    \"high\": 5,\n    \"medium\": 7,\n    \"low\": 4,\n    \"info\": 3\n  },\n  \"findings\": [\n    {\n      \"id\": 1,\n      \"severity\": \"CRITICAL\",\n      \"module\": \"RECON\",\n      \"title\": \"DNS Zone Transfer (AXFR) is permitted\",\n      \"description\": \"Name server ns1.target.com allows AXFR \u2014 full DNS zone disclosed.\",\n      \"evidence\": \"dig AXFR target.com @ns1.target.com\",\n      \"recommendation\": \"Restrict AXFR to authorised secondary name servers only.\",\n      \"timestamp\": \"2024-01-01T12:00:12Z\"\n    }\n  ]\n}\n</code></pre>"},{"location":"reports/#useful-jq-queries","title":"Useful <code>jq</code> queries","text":"<pre><code># Count by severity\njq '.summary' report_*.json\n\n# List all critical findings\njq '.findings[] | select(.severity==\"CRITICAL\") | .title' report_*.json\n\n# Export findings as CSV\njq -r '.findings[] | [.id,.severity,.module,.title] | @csv' report_*.json\n\n# Filter by module\njq '.findings[] | select(.module==\"HEADERS\")' report_*.json\n</code></pre>"},{"location":"reports/#txt-report","title":"TXT report","text":"<p>Full timestamped plain-text log. Contains:</p> <ul> <li>Scan metadata header</li> <li>Risk summary table</li> <li>Complete audit log with all module output</li> </ul> <p>Ideal for formal deliverables that require a plaintext audit trail.</p>"},{"location":"reports/#jsonl-findings-file","title":"JSONL findings file","text":"<p><code>findings.jsonl</code> is written as findings are discovered \u2014 one JSON object per line. This means if the scan is interrupted (Ctrl-C), you still have a valid, processable findings file.</p> <pre><code># Count findings in a partial scan\nwc -l findings.jsonl\n\n# Pretty-print the last finding\ntail -1 findings.jsonl | jq .\n</code></pre>"},{"location":"reports/#controlling-report-format","title":"Controlling report format","text":"<pre><code># Generate all formats (default)\n./websec-audit.sh -t https://target.com\n\n# JSON only\n./websec-audit.sh -t https://target.com --format json\n\n# HTML only\n./websec-audit.sh -t https://target.com --format html\n\n# TXT only\n./websec-audit.sh -t https://target.com --format txt\n</code></pre>"},{"location":"usage/","title":"All Options","text":"<p>Complete CLI reference for WebSec-Audit.</p> <pre><code>./websec-audit.sh -t &lt;target&gt; [options]\n</code></pre>"},{"location":"usage/#required","title":"Required","text":"Flag Description <code>-t</code>, <code>--target &lt;url\\|ip&gt;</code> Target URL or IP address. If no scheme is provided, <code>https://</code> is assumed."},{"location":"usage/#output","title":"Output","text":"Flag Default Description <code>-o</code>, <code>--output &lt;dir&gt;</code> <code>./results_&lt;domain&gt;_&lt;ts&gt;</code> Directory where all results are saved <code>--format &lt;fmt&gt;</code> <code>all</code> Report format: <code>json</code> | <code>html</code> | <code>txt</code> | <code>all</code>"},{"location":"usage/#scan-options","title":"Scan options","text":"Flag Default Description <code>-T</code>, <code>--threads &lt;n&gt;</code> <code>10</code> Concurrent threads passed to brute-force tools <code>-p</code>, <code>--ports &lt;profile&gt;</code> <code>top-1000</code> Port profile: <code>top-100</code> | <code>top-1000</code> | <code>full</code> <code>--timeout &lt;s&gt;</code> <code>10</code> Connection timeout in seconds for all HTTP/TCP operations <code>--depth &lt;n&gt;</code> <code>3</code> Crawl depth used in aggressive sqlmap and CMS scans <code>--proxy &lt;url&gt;</code> (none) Route all traffic through this proxy (e.g. <code>http://127.0.0.1:8080</code>) <code>--aggressive</code> off Aggressive mode \u2014 deeper scans, higher noise, more findings <code>--stealth</code> off Stealth mode \u2014 slower, lower detection footprint <p>Warning</p> <p><code>--aggressive</code> and <code>--stealth</code> are mutually exclusive. If both are provided, <code>--aggressive</code> takes precedence.</p>"},{"location":"usage/#module-control","title":"Module control","text":"<p>Every module can be individually disabled. Useful for scoping an audit or skipping slow/noisy tools.</p> Flag Module disabled <code>--skip-recon</code> Reconnaissance (WHOIS, DNS, subdomain enum) <code>--skip-portscan</code> Port scanning (nmap) <code>--skip-fingerprint</code> Web fingerprinting (WhatWeb, WAF) <code>--skip-ssl</code> SSL/TLS analysis <code>--skip-headers</code> HTTP security headers <code>--skip-dirbrute</code> Directory &amp; file brute-forcing <code>--skip-nikto</code> Nikto web scanner <code>--skip-sqli</code> SQL injection (sqlmap) <code>--skip-xss</code> XSS testing (dalfox + manual) <code>--skip-cms</code> CMS detection &amp; scanning <code>--skip-cors</code> CORS misconfiguration tests <code>--skip-redirect</code> Open redirect tests <code>--skip-ssrf</code> SSRF tests <code>--skip-subtakeover</code> Subdomain takeover checks <code>--skip-nuclei</code> Nuclei template scan"},{"location":"usage/#wordlists","title":"Wordlists","text":"Flag Default Description <code>--wl-dirs-small &lt;file&gt;</code> <code>/usr/share/wordlists/dirb/common.txt</code> Small wordlist for directory brute-force (normal mode) <code>--wl-dirs-big &lt;file&gt;</code> <code>/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt</code> Large wordlist (aggressive mode) <code>--wl-dns &lt;file&gt;</code> <code>/usr/share/wordlists/dnsmap.txt</code> DNS subdomain brute-force wordlist"},{"location":"usage/#misc","title":"Misc","text":"Flag Description <code>-v</code>, <code>--verbose</code> Print verbose debug output to stdout <code>--no-color</code> Disable ANSI colour output (useful for piping / CI) <code>--no-banner</code> Suppress the ASCII banner (useful for scripting) <code>-V</code>, <code>--version</code> Print version and exit <code>-h</code>, <code>--help</code> Print usage and exit"},{"location":"usage/#examples","title":"Examples","text":"<pre><code># Basic scan\n./websec-audit.sh -t https://target.com\n\n# Aggressive with 20 threads, custom output dir\n./websec-audit.sh -t https://target.com --aggressive -T 20 -o /tmp/audit\n\n# Stealth through Burp Suite\n./websec-audit.sh -t https://target.com --stealth --proxy http://127.0.0.1:8080\n\n# Skip slow modules, verbose, JSON only\n./websec-audit.sh -t https://target.com --skip-nikto --skip-sqli -v --format json\n\n# Full port scan, deep crawl\n./websec-audit.sh -t https://target.com --ports full --depth 5 --aggressive\n\n# Headers and SSL audit only (everything else skipped)\n./websec-audit.sh -t https://target.com \\\n  --skip-recon --skip-portscan --skip-fingerprint \\\n  --skip-dirbrute --skip-nikto --skip-sqli --skip-xss \\\n  --skip-cms --skip-cors --skip-redirect --skip-ssrf \\\n  --skip-subtakeover --skip-nuclei\n\n# No colour, no banner \u2014 clean output for CI/logging\n./websec-audit.sh -t https://target.com --no-color --no-banner\n</code></pre>"},{"location":"modules/","title":"Modules Overview","text":"<p>WebSec-Audit is built around 15 independent modules. Each module can be enabled or disabled individually with <code>--skip-&lt;module&gt;</code>.</p>"},{"location":"modules/#module-table","title":"Module table","text":"# Module <code>--skip</code> flag Primary tools Key checks 01 Reconnaissance <code>--skip-recon</code> whois \u00b7 dig \u00b7 subfinder \u00b7 amass WHOIS \u00b7 DNS \u00b7 AXFR \u00b7 subdomain enum \u00b7 SPF/DMARC \u00b7 Google Dorks 02 Port Scanning <code>--skip-portscan</code> nmap Open ports \u00b7 service versions \u00b7 risk analysis for 20+ dangerous ports 03 Fingerprinting <code>--skip-fingerprint</code> whatweb \u00b7 wafw00f Tech stack \u00b7 WAF detection \u00b7 version-leaking headers 04 SSL/TLS <code>--skip-ssl</code> testssl.sh \u00b7 sslscan \u00b7 openssl Deprecated protocols \u00b7 weak ciphers \u00b7 cert expiry \u00b7 HSTS 05 HTTP Headers <code>--skip-headers</code> curl CSP \u00b7 X-Frame-Options \u00b7 cookies \u00b7 HTTP\u2192HTTPS redirect 06 Dir &amp; File Enum <code>--skip-dirbrute</code> gobuster \u00b7 ffuf \u00b7 dirb Directory brute-force \u00b7 40+ sensitive path probes 07 Nikto <code>--skip-nikto</code> nikto Web server CVEs \u00b7 misconfigurations \u00b7 outdated software 08 SQL Injection <code>--skip-sqli</code> sqlmap SQLi detection \u00b7 exploitation \u00b7 database enumeration 09 XSS <code>--skip-xss</code> dalfox \u00b7 curl Reflected XSS \u00b7 DOM-based XSS \u00b7 common parameters 10 CMS Scanning <code>--skip-cms</code> wpscan \u00b7 droopescan WordPress \u00b7 Drupal \u00b7 Joomla \u00b7 Magento plugins/themes/users 11 CORS <code>--skip-cors</code> curl Wildcard \u00b7 reflected origin \u00b7 null origin \u00b7 credentialed 12 Open Redirect <code>--skip-redirect</code> curl 20 params \u00d7 10 redirect payloads 13 SSRF <code>--skip-ssrf</code> curl AWS/GCP/Azure IMDS \u00b7 localhost \u00b7 RFC1918 ranges 14 Subdomain Takeover <code>--skip-subtakeover</code> subjack \u00b7 nuclei \u00b7 dig Dangling CNAMEs across 20+ services 15 Nuclei <code>--skip-nuclei</code> nuclei CVE templates \u00b7 misconfiguration templates"},{"location":"modules/#execution-order","title":"Execution order","text":"<p>Modules run sequentially in the order listed above. The output of earlier modules (subdomain list from Module 01, open ports from Module 02) is used as input for later modules.</p> <pre><code>graph LR\n  A[Target Info] --&gt; B[Recon]\n  B --&gt; C[Port Scan]\n  C --&gt; D[Fingerprint]\n  D --&gt; E[SSL/TLS]\n  E --&gt; F[Headers]\n  F --&gt; G[Dir Enum]\n  G --&gt; H[Nikto]\n  H --&gt; I[SQLi]\n  I --&gt; J[XSS]\n  J --&gt; K[CMS]\n  K --&gt; L[CORS]\n  L --&gt; M[Redirect]\n  M --&gt; N[SSRF]\n  N --&gt; O[Takeover]\n  O --&gt; P[Nuclei]\n  P --&gt; Q[Reports]</code></pre>"},{"location":"modules/#skipping-multiple-modules","title":"Skipping multiple modules","text":"<pre><code># Quick headers + SSL check only\n./websec-audit.sh -t https://target.com \\\n  --skip-recon --skip-portscan --skip-fingerprint \\\n  --skip-dirbrute --skip-nikto --skip-sqli --skip-xss \\\n  --skip-cms --skip-cors --skip-redirect --skip-ssrf \\\n  --skip-subtakeover --skip-nuclei\n\n# Reconnaissance only (no active scanning)\n./websec-audit.sh -t https://target.com \\\n  --skip-portscan --skip-fingerprint --skip-ssl \\\n  --skip-headers --skip-dirbrute --skip-nikto \\\n  --skip-sqli --skip-xss --skip-cms --skip-cors \\\n  --skip-redirect --skip-ssrf --skip-subtakeover --skip-nuclei\n</code></pre>"},{"location":"modules/cms/","title":"Module 10 \u00b7 CMS Scanning","text":"<p>Flag: <code>--skip-cms</code></p> <p>Detects the CMS powering the target and runs the appropriate scanner.</p>"},{"location":"modules/cms/#detection","title":"Detection","text":"<p>The module detects CMS by analysing the response body and headers for known fingerprints:</p> CMS Detection signals WordPress <code>wp-content</code>, <code>wp-includes</code>, <code>wordpress</code> in body/headers Drupal <code>sites/all/modules</code>, <code>Drupal.settings</code>, <code>X-Generator: Drupal</code> Joomla <code>/media/jui</code>, <code>generator: Joomla</code>, cookie names Magento <code>Mage.Cookies</code>, <code>/skin/frontend</code>, <code>magento</code>"},{"location":"modules/cms/#wordpress-wpscan","title":"WordPress (wpscan)","text":"<p>wpscan is run with:</p> Mode Flags Normal <code>--url &lt;target&gt; --no-banner --format json</code> Aggressive <code>--enumerate ap,at,cb,dbe,u --plugins-detection aggressive</code> <p>Parsed results:</p> Condition Severity Plugin vulnerabilities found HIGH Theme vulnerabilities found MEDIUM Users enumerable via REST API MEDIUM <p>WordPress-specific path probes:</p> Path Condition Severity <code>/xmlrpc.php</code> Accessible MEDIUM <code>/wp-json/wp/v2/users</code> Returns user list MEDIUM <code>/wp-content/debug.log</code> Accessible HIGH <code>/?author=1</code> Author enumeration works LOW <code>/wp-login.php</code> Accessible INFO"},{"location":"modules/cms/#drupal-joomla-droopescan","title":"Drupal / Joomla (droopescan)","text":"<p>droopescan is used for Drupal and Joomla targets, detecting:</p> <ul> <li>Core version and known vulnerabilities</li> <li>Installed plugins/modules with known CVEs</li> <li>Themes</li> </ul>"},{"location":"modules/cms/#output-files","title":"Output files","text":"<pre><code>cms/\n\u251c\u2500\u2500 wpscan_results.json\n\u251c\u2500\u2500 wpscan_console.txt\n\u251c\u2500\u2500 droopescan_drupal.json\n\u2514\u2500\u2500 droopescan_joomla.json\n</code></pre>"},{"location":"modules/cors/","title":"Module 11 \u00b7 CORS Misconfiguration","text":"<p>Flag: <code>--skip-cors</code></p> <p>Tests the target's CORS policy against 7 adversarial origins.</p>"},{"location":"modules/cors/#test-origins","title":"Test origins","text":"<pre><code>https://evil.com\nhttps://&lt;domain&gt;.evil.com\nhttps://evil.&lt;domain&gt;\nnull\nhttps://attacker.io\nhttp://localhost\nhttps://not&lt;domain&gt;\n</code></pre> <p>Each origin is sent in an <code>Origin</code> header with <code>Access-Control-Request-Method: GET</code> and <code>Access-Control-Request-Headers: Authorization</code>.</p>"},{"location":"modules/cors/#checks-and-findings","title":"Checks and findings","text":"Condition Severity Attacker origin reflected in <code>ACAO</code> + <code>ACAC: true</code> CRITICAL Attacker origin reflected in <code>ACAO</code> (no credentials) MEDIUM Wildcard <code>*</code> in <code>Access-Control-Allow-Origin</code> MEDIUM <code>null</code> origin accepted HIGH"},{"location":"modules/cors/#why-cors-matters","title":"Why CORS matters","text":"<p>A misconfigured CORS policy allows an attacker's website to make authenticated cross-origin requests on behalf of a victim user \u2014 reading sensitive API responses, exfiltrating data, or performing actions under their session.</p> <p>The most critical case is:</p> <pre><code>Access-Control-Allow-Origin: https://evil.com\nAccess-Control-Allow-Credentials: true\n</code></pre> <p>This combination allows a malicious site to make credentialed requests and read the responses.</p>"},{"location":"modules/cors/#remediation","title":"Remediation","text":"<ul> <li>Validate <code>Origin</code> against an explicit allowlist \u2014 never reflect it back directly</li> <li>Never use <code>Access-Control-Allow-Origin: *</code> on endpoints that handle authenticated data</li> <li>Never combine <code>ACAO: *</code> with <code>ACAC: true</code> (browsers block this, but other clients do not)</li> <li>Never trust the <code>null</code> origin</li> </ul>"},{"location":"modules/cors/#output-files","title":"Output files","text":"<pre><code>misc/\n\u2514\u2500\u2500 cors_tests.txt\n</code></pre>"},{"location":"modules/dirbrute/","title":"Module 06 \u00b7 Dir &amp; File Enumeration","text":"<p>Flag: <code>--skip-dirbrute</code></p> <p>Combines wordlist-based directory brute-forcing with targeted probing of 40+ known sensitive paths.</p>"},{"location":"modules/dirbrute/#directory-brute-force","title":"Directory brute-force","text":"Mode Wordlist used Normal <code>--wl-dirs-small</code> (default: dirb/common.txt) Aggressive <code>--wl-dirs-big</code> (default: dirbuster/directory-list-2.3-medium.txt) <p>Tool priority: gobuster \u2192 ffuf \u2192 dirb</p> <pre><code># Use a custom wordlist\n./websec-audit.sh -t https://target.com --wl-dirs-small /path/to/custom.txt\n</code></pre>"},{"location":"modules/dirbrute/#sensitive-path-probing","title":"Sensitive path probing","text":"<p>40+ paths are probed directly with <code>curl</code> regardless of the brute-force wordlist. Findings are severity-classified automatically:</p> CriticalHighMediumLow / Info Path Why <code>/.git/HEAD</code> Git repository exposed <code>/.git/config</code> Git config exposed <code>/.env</code> Environment file with credentials <code>/.env.local</code> Local environment file <code>/.env.production</code> Production secrets <code>/wp-config.php</code> WordPress database credentials <code>/wp-config.php.bak</code> Backup of WP config <code>/configuration.php</code> Joomla config <code>/config/database.yml</code> Rails DB config <code>/.aws/credentials</code> AWS credentials file <code>/db.sql</code>, <code>/dump.sql</code>, <code>/backup.sql</code> Database dumps Path Why <code>/phpinfo.php</code>, <code>/info.php</code> PHP environment disclosure <code>/phpmyadmin/</code>, <code>/adminer.php</code> Database admin interfaces <code>/web.config</code> IIS config / credentials <code>/backup.zip</code>, <code>/backup.tar.gz</code> Backup archives <code>/console</code> Interactive console (RCE risk) <code>/Dockerfile</code>, <code>/docker-compose.yml</code> Infrastructure secrets Path Why <code>/admin/</code>, <code>/administrator/</code> Admin panels <code>/.htaccess</code> Apache config <code>/server-status</code>, <code>/server-info</code> Apache status pages <code>/_profiler/</code>, <code>/_debugbar</code> Framework debug panels <code>/graphiql</code> GraphQL IDE <code>/.DS_Store</code> Directory structure leak <code>/package.json</code>, <code>/composer.json</code> Dependency exposure Path Why <code>/robots.txt</code> May disclose hidden paths <code>/sitemap.xml</code> Site structure <code>/api/swagger.json</code>, <code>/swagger-ui.html</code> API docs <code>/graphql</code> GraphQL endpoint <code>/.well-known/security.txt</code> Security contact policy"},{"location":"modules/dirbrute/#output-files","title":"Output files","text":"<pre><code>dirs/\n\u251c\u2500\u2500 gobuster_dirs.txt\n\u251c\u2500\u2500 gobuster_dns.txt\n\u251c\u2500\u2500 ffuf_results.json\n\u251c\u2500\u2500 dirb_results.txt\n\u2514\u2500\u2500 sensitive_paths_found.txt   # only paths that returned 200/301/302\n</code></pre>"},{"location":"modules/fingerprint/","title":"Module 03 \u00b7 Fingerprinting","text":"<p>Flag: <code>--skip-fingerprint</code></p> <p>Identifies the technology stack, detects WAFs, and flags response headers that leak version information.</p>"},{"location":"modules/fingerprint/#technology-detection","title":"Technology detection","text":"<p>Uses WhatWeb (aggression level 1 in normal mode, 3 in aggressive) to identify:</p> <ul> <li>Web server (nginx, Apache, IIS, LiteSpeed, Caddy)</li> <li>Programming language and framework (PHP, Django, Rails, Laravel, ASP.NET, Express)</li> <li>CMS (WordPress, Drupal, Joomla, Magento)</li> <li>JavaScript libraries and versions</li> <li>Analytics and tracking tools</li> <li>CDN and cloud provider</li> </ul> <p>Output saved to <code>recon/whatweb.json</code> and <code>recon/whatweb_brief.txt</code>.</p>"},{"location":"modules/fingerprint/#waf-detection","title":"WAF detection","text":"<p>Uses wafw00f to identify the presence and type of Web Application Firewall.</p> Condition Severity No WAF detected LOW WAF identified INFO <p>A missing WAF is flagged as Low because it means there is no automatic filtering layer between the internet and the application.</p>"},{"location":"modules/fingerprint/#version-leaking-headers","title":"Version-leaking headers","text":"<p>The following response headers are checked. Any that disclose technology names or version numbers are flagged:</p> <p><code>Server</code> \u00b7 <code>X-Powered-By</code> \u00b7 <code>X-AspNet-Version</code> \u00b7 <code>X-AspNetMvc-Version</code> \u00b7 <code>X-Generator</code> \u00b7 <code>X-CF-Powered-By</code> \u00b7 <code>Via</code></p> Condition Severity Version-leaking header present LOW"},{"location":"modules/fingerprint/#fallback","title":"Fallback","text":"<p>If <code>whatweb</code> is not installed, the module falls back to header-based detection using <code>curl</code>, scanning for technology names in the response headers and body.</p>"},{"location":"modules/fingerprint/#output-files","title":"Output files","text":"<pre><code>recon/\n\u251c\u2500\u2500 whatweb.json\n\u251c\u2500\u2500 whatweb_brief.txt\n\u251c\u2500\u2500 waf_detection.txt\n\u2514\u2500\u2500 basic_headers_raw.txt     # fallback only\n</code></pre>"},{"location":"modules/headers/","title":"Module 05 \u00b7 HTTP Headers","text":"<p>Flag: <code>--skip-headers</code></p> <p>Audits HTTP response headers for security misconfigurations.</p>"},{"location":"modules/headers/#required-security-headers","title":"Required security headers","text":"Header Severity if absent Notes <code>Content-Security-Policy</code> MEDIUM Also audits CSP value for <code>unsafe-inline</code>, <code>unsafe-eval</code>, wildcards <code>X-Frame-Options</code> MEDIUM Clickjacking protection <code>X-Content-Type-Options</code> LOW MIME sniffing prevention <code>Referrer-Policy</code> LOW URL leakage control <code>Permissions-Policy</code> LOW Browser API restrictions <code>Cross-Origin-Opener-Policy</code> LOW Cross-origin isolation <code>Cross-Origin-Resource-Policy</code> LOW Resource access control"},{"location":"modules/headers/#csp-deep-audit","title":"CSP deep audit","text":"<p>When CSP is present, the module further checks:</p> CSP Condition Severity <code>unsafe-inline</code> or <code>unsafe-eval</code> present MEDIUM Wildcard (<code>*</code>) in <code>script-src</code> or <code>default-src</code> HIGH"},{"location":"modules/headers/#version-leaking-headers","title":"Version-leaking headers","text":"<p>Headers that should not be present in production:</p> <p><code>Server</code> \u00b7 <code>X-Powered-By</code> \u00b7 <code>X-AspNet-Version</code> \u00b7 <code>X-AspNetMvc-Version</code> \u00b7 <code>X-Generator</code> \u00b7 <code>X-CF-Powered-By</code></p> <p>Each flagged as LOW.</p>"},{"location":"modules/headers/#cookie-security-flags","title":"Cookie security flags","text":"<p>Every <code>Set-Cookie</code> response header is analysed for:</p> Missing flag Severity <code>HttpOnly</code> MEDIUM <code>Secure</code> MEDIUM <code>SameSite</code> LOW <code>SameSite=None</code> without <code>Secure</code> MEDIUM"},{"location":"modules/headers/#http-https-redirect","title":"HTTP \u2192 HTTPS redirect","text":"<p>Checks whether HTTP requests are automatically upgraded to HTTPS.</p> Condition Severity HTTP does not redirect to HTTPS MEDIUM"},{"location":"modules/headers/#cache-control","title":"Cache-Control","text":"Condition Severity <code>Cache-Control</code> header absent LOW"},{"location":"modules/headers/#output-files","title":"Output files","text":"<pre><code>headers/\n\u251c\u2500\u2500 response_headers.txt\n\u2514\u2500\u2500 initial_response.txt\n</code></pre>"},{"location":"modules/nikto/","title":"Module 07 \u00b7 Nikto","text":"<p>Flag: <code>--skip-nikto</code></p> <p>Runs Nikto against the target and classifies findings by severity.</p>"},{"location":"modules/nikto/#what-nikto-checks","title":"What Nikto checks","text":"<ul> <li>Outdated server software with known CVEs</li> <li>Default files and scripts (admin panels, test pages, install scripts)</li> <li>Dangerous HTTP methods (PUT, DELETE, TRACE)</li> <li>Server misconfigurations</li> <li>Cookie and header issues not covered by Module 05</li> <li>Common web application vulnerabilities</li> </ul>"},{"location":"modules/nikto/#mode-behaviour","title":"Mode behaviour","text":"Mode Nikto flags Normal Default plugins, 10-minute max Aggressive <code>--Plugins @@ALL</code> \u2014 runs every available plugin"},{"location":"modules/nikto/#severity-classification","title":"Severity classification","text":"<p>Nikto findings are auto-classified:</p> Pattern in output Assigned severity <code>vuln</code>, <code>exploit</code>, <code>inject</code>, <code>XSS</code>, <code>CVE</code>, <code>OSVDB-XXXX</code> HIGH <code>outdated</code>, <code>version</code>, <code>disclose</code>, <code>found</code>, <code>enabled</code> MEDIUM Everything else LOW"},{"location":"modules/nikto/#output-files","title":"Output files","text":"<pre><code>vulns/\n\u251c\u2500\u2500 nikto.txt\n\u2514\u2500\u2500 nikto.json\n</code></pre> <p>Nikto can be noisy</p> <p>Nikto generates many false positives. Review each finding manually before including it in a formal report. Use <code>--skip-nikto</code> in quick assessments where time is limited.</p>"},{"location":"modules/nuclei/","title":"Module 15 \u00b7 Nuclei","text":"<p>Flag: <code>--skip-nuclei</code></p> <p>Runs the Nuclei engine against the target using the community template library.</p>"},{"location":"modules/nuclei/#severity-filter","title":"Severity filter","text":"Mode Templates included Normal <code>medium</code>, <code>high</code>, <code>critical</code> Aggressive <code>low</code>, <code>medium</code>, <code>high</code>, <code>critical</code>"},{"location":"modules/nuclei/#template-categories-covered","title":"Template categories covered","text":"<ul> <li>CVE templates (known software vulnerabilities)</li> <li>Default credentials</li> <li>Exposed panels and dashboards</li> <li>Misconfiguration (cloud, server, application)</li> <li>Technology detection</li> <li>Network exposure</li> <li>Fuzzing templates (aggressive mode)</li> </ul>"},{"location":"modules/nuclei/#template-updates","title":"Template updates","text":"<p>Templates are updated automatically during <code>install.sh</code>. To manually update:</p> <pre><code>nuclei -update-templates\n</code></pre>"},{"location":"modules/nuclei/#findings","title":"Findings","text":"<p>Each Nuclei match is imported as a finding with its native severity (<code>critical</code>, <code>high</code>, <code>medium</code>, <code>low</code>, <code>info</code>).</p>"},{"location":"modules/nuclei/#output-files","title":"Output files","text":"<pre><code>vulns/nuclei/\n\u251c\u2500\u2500 nuclei_results.txt\n\u2514\u2500\u2500 nuclei_results.json\n</code></pre> <p>Tip</p> <p>Nuclei is also used internally by Module 14 (Subdomain Takeover) with the <code>takeovers/</code> template tag.</p>"},{"location":"modules/portscan/","title":"Module 02 \u00b7 Port Scanning","text":"<p>Flag: <code>--skip-portscan</code></p> <p>Runs nmap against the target and performs automated risk analysis on every open port.</p>"},{"location":"modules/portscan/#port-profiles","title":"Port profiles","text":"<code>--ports</code> value nmap flag Use case <code>top-100</code> <code>--top-ports 100</code> Quick check <code>top-1000</code> (default) <code>--top-ports 1000</code> Standard <code>full</code> <code>-p-</code> Full coverage (slow)"},{"location":"modules/portscan/#mode-behaviour","title":"Mode behaviour","text":"Mode Extra flags Normal <code>-sV -sC --open -T4</code> Aggressive Adds <code>-A -O --script=vuln,auth,default,discovery</code> Stealth <code>-sS -T2 -f --data-length 32 --randomize-hosts</code>"},{"location":"modules/portscan/#automated-risk-analysis","title":"Automated risk analysis","text":"<p>Every open port is evaluated against a built-in risk table:</p> Port Service Severity Reason 21 FTP CRITICAL Plaintext credentials 23 Telnet CRITICAL Unencrypted remote shell 2375 Docker API CRITICAL Unauthenticated container access 445 SMB HIGH EternalBlue / ransomware risk 3306 MySQL HIGH DB exposed to internet 3389 RDP HIGH Brute-force target 5432 PostgreSQL HIGH DB exposed to internet 6379 Redis HIGH Often unauthenticated 9200 Elasticsearch HIGH Often unauthenticated 27017 MongoDB HIGH Often unauthenticated 25 SMTP MEDIUM Open relay risk 8080/8443 HTTP alt LOW Admin panel exposure"},{"location":"modules/portscan/#output-files","title":"Output files","text":"<pre><code>portscan/\n\u251c\u2500\u2500 nmap.txt      # human-readable\n\u251c\u2500\u2500 nmap.xml      # machine-readable, compatible with Metasploit\n\u2514\u2500\u2500 nmap.gnmap    # grepable format\n</code></pre>"},{"location":"modules/recon/","title":"Module 01 \u00b7 Reconnaissance","text":"<p>Flag: <code>--skip-recon</code></p> <p>The reconnaissance module performs passive and semi-passive information gathering before any active scanning begins.</p>"},{"location":"modules/recon/#sub-checks","title":"Sub-checks","text":""},{"location":"modules/recon/#whois-lookup","title":"WHOIS lookup","text":"<p>Queries the WHOIS database for registrar, registrant, expiry date and nameservers. Output saved to <code>recon/whois.txt</code>.</p>"},{"location":"modules/recon/#dns-record-enumeration","title":"DNS record enumeration","text":"<p>Queries all major record types: <code>A</code>, <code>AAAA</code>, <code>MX</code>, <code>TXT</code>, <code>NS</code>, <code>SOA</code>, <code>CNAME</code>, <code>CAA</code>, <code>DMARC</code>. Output saved to <code>recon/dns_records.txt</code>.</p> <p>SPF analysis \u2014 flags missing SPF records and dangerous <code>+all</code> policies:</p> Condition Severity No SPF record MEDIUM SPF uses <code>+all</code> HIGH No DMARC record MEDIUM DMARC <code>p=none</code> LOW"},{"location":"modules/recon/#dns-zone-transfer-axfr","title":"DNS Zone Transfer (AXFR)","text":"<p>Attempts AXFR against all discovered nameservers. A successful transfer exposes the entire DNS zone.</p> Condition Severity AXFR permitted CRITICAL"},{"location":"modules/recon/#subdomain-enumeration","title":"Subdomain enumeration","text":"<p>Uses multiple tools in parallel and deduplicates results into <code>recon/subdomains.txt</code>:</p> <ul> <li>subfinder \u2014 passive DNS sources (certificate transparency, DNS databases)</li> <li>amass \u2014 passive enumeration</li> <li>dnsrecon \u2014 standard DNS queries</li> <li>Fallback \u2014 wordlist-based DNS brute-force (first 500 entries) if no enumeration tool is available</li> </ul>"},{"location":"modules/recon/#google-dorks","title":"Google Dorks","text":"<p>Generates a curated list of Google Dorks for manual research \u2014 not executed automatically. Saved to <code>recon/google_dorks.txt</code>. Categories include: information disclosure, admin panels, credentials, config files, exposed APIs.</p>"},{"location":"modules/recon/#tools-used","title":"Tools used","text":"Tool Role Fallback <code>whois</code> WHOIS lookup None <code>dig</code> DNS queries <code>host</code> <code>subfinder</code> Passive subdomain enum Wordlist brute-force <code>amass</code> Extended passive enum Optional <code>dnsrecon</code> DNS standard checks Optional"},{"location":"modules/recon/#skip-this-module","title":"Skip this module","text":"<pre><code>./websec-audit.sh -t https://target.com --skip-recon\n</code></pre>"},{"location":"modules/recon/#output-files","title":"Output files","text":"<pre><code>recon/\n\u251c\u2500\u2500 whois.txt\n\u251c\u2500\u2500 dns_records.txt\n\u251c\u2500\u2500 axfr.txt\n\u251c\u2500\u2500 subfinder.txt\n\u251c\u2500\u2500 amass.txt\n\u251c\u2500\u2500 dnsrecon.json\n\u251c\u2500\u2500 subdomains.txt          # deduplicated, used by Module 14\n\u251c\u2500\u2500 whatweb.json\n\u251c\u2500\u2500 waf_detection.txt\n\u2514\u2500\u2500 google_dorks.txt\n</code></pre>"},{"location":"modules/redirect/","title":"Module 12 \u00b7 Open Redirect","text":"<p>Flag: <code>--skip-redirect</code></p> <p>Tests 20 common redirect parameters with 10 payload variants.</p>"},{"location":"modules/redirect/#parameters-tested","title":"Parameters tested","text":"<p><code>next</code>, <code>url</code>, <code>redirect</code>, <code>redirect_uri</code>, <code>redirect_url</code>, <code>return</code>, <code>return_url</code>, <code>returnUrl</code>, <code>returnTo</code>, <code>go</code>, <code>goto</code>, <code>dest</code>, <code>destination</code>, <code>target</code>, <code>forward</code>, <code>redir</code>, <code>link</code>, <code>to</code>, <code>r</code>, <code>out</code>, <code>ref</code>, <code>continue</code>, <code>callback</code>, <code>successUrl</code>, <code>failureUrl</code></p>"},{"location":"modules/redirect/#payloads","title":"Payloads","text":"<pre><code>https://evil.com\n//evil.com\n///evil.com\nhttps:evil.com\n/\\evil.com\nhttps://evil.com%2F%2E%2E\n%2F%2Fevil.com\nhttps:///evil.com\n/%5Cevil.com\nhttps://evil.com@&lt;target-domain&gt;\n</code></pre>"},{"location":"modules/redirect/#findings","title":"Findings","text":"Condition Severity Redirect to external domain confirmed MEDIUM"},{"location":"modules/redirect/#remediation","title":"Remediation","text":"<p>Validate redirect targets against an allowlist of known-safe internal paths or domains. If the application must redirect to external URLs, use an intermediate confirmation page.</p>"},{"location":"modules/redirect/#output-files","title":"Output files","text":"<pre><code>misc/\n\u2514\u2500\u2500 open_redirect.txt\n</code></pre>"},{"location":"modules/sqli/","title":"Module 08 \u00b7 SQL Injection","text":"<p>Flag: <code>--skip-sqli</code></p> <p>Uses sqlmap to detect and confirm SQL injection vulnerabilities in the target URL.</p>"},{"location":"modules/sqli/#sqlmap-configuration","title":"sqlmap configuration","text":"Mode sqlmap flags Normal <code>--batch --random-agent --level=3 --risk=2 --timeout=&lt;n&gt; --threads=&lt;n&gt;</code> Aggressive <code>--level=5 --risk=3 --forms --crawl=&lt;depth&gt; --dbs --tamper=space2comment</code> Stealth Adds <code>--delay=2 --safe-freq=3 --smart</code>"},{"location":"modules/sqli/#what-is-checked","title":"What is checked","text":"<ul> <li>GET parameters in the target URL</li> <li>POST forms (aggressive mode via <code>--forms</code>)</li> <li>Crawled pages (aggressive mode via <code>--crawl</code>)</li> </ul> <p>sqlmap tests for:</p> <ul> <li>Boolean-based blind SQLi</li> <li>Error-based SQLi</li> <li>Time-based blind SQLi</li> <li>UNION-based SQLi</li> <li>Stacked queries</li> </ul>"},{"location":"modules/sqli/#findings","title":"Findings","text":"Condition Severity SQL injection confirmed CRITICAL No SQLi on primary URL INFO"},{"location":"modules/sqli/#remediation","title":"Remediation","text":"<p>Use parameterised queries (prepared statements) in every database interaction. Never concatenate user-supplied input directly into SQL strings.</p> PHP (PDO)Python (psycopg2)Node.js (pg) <pre><code>$stmt = $pdo-&gt;prepare('SELECT * FROM users WHERE id = ?');\n$stmt-&gt;execute([$_GET['id']]);\n</code></pre> <pre><code>cursor.execute(\"SELECT * FROM users WHERE id = %s\", (user_id,))\n</code></pre> <pre><code>const res = await client.query('SELECT * FROM users WHERE id = $1', [userId]);\n</code></pre>"},{"location":"modules/sqli/#output-files","title":"Output files","text":"<pre><code>vulns/sqlmap/\n\u251c\u2500\u2500 sqlmap_console.txt\n\u2514\u2500\u2500 &lt;target&gt;/           # sqlmap output directory per target\n</code></pre>"},{"location":"modules/ssl/","title":"Module 04 \u00b7 SSL/TLS","text":"<p>Flag: <code>--skip-ssl</code></p> <p>Info</p> <p>This module is automatically skipped if the target is served over plain HTTP. In that case, a HIGH finding is raised: \"Target is served over HTTP (no TLS)\".</p>"},{"location":"modules/ssl/#checks-performed","title":"Checks performed","text":""},{"location":"modules/ssl/#protocol-support","title":"Protocol support","text":"<p>Flags deprecated and vulnerable protocols:</p> Protocol Severity SSLv2 HIGH SSLv3 HIGH TLS 1.0 HIGH TLS 1.1 HIGH TLS 1.2 \u2705 Acceptable TLS 1.3 \u2705 Preferred"},{"location":"modules/ssl/#cipher-suites","title":"Cipher suites","text":"<p>Flags weak or broken ciphers:</p> <ul> <li>RC4, NULL, EXPORT, anonymous (anon), DES, 3DES \u2192 HIGH</li> </ul>"},{"location":"modules/ssl/#certificate-validity","title":"Certificate validity","text":"Condition Severity Certificate expired CRITICAL Expires in &lt; 14 days CRITICAL Expires in &lt; 30 days HIGH Expires in &lt; 90 days MEDIUM Self-signed / untrusted HIGH"},{"location":"modules/ssl/#hsts","title":"HSTS","text":"Condition Severity HSTS header absent MEDIUM <code>max-age</code> &lt; 15552000 (6 months) LOW"},{"location":"modules/ssl/#tool-priority","title":"Tool priority","text":"<ol> <li>testssl.sh \u2014 comprehensive analysis, JSON output parsed automatically</li> <li>sslscan \u2014 protocol and cipher enumeration</li> <li>openssl \u2014 fallback, manual protocol checks</li> </ol>"},{"location":"modules/ssl/#output-files","title":"Output files","text":"<pre><code>ssl/\n\u251c\u2500\u2500 testssl.json      # if testssl.sh available\n\u251c\u2500\u2500 testssl.log\n\u251c\u2500\u2500 sslscan.txt       # if sslscan available\n\u2514\u2500\u2500 openssl_info.txt  # fallback\n</code></pre>"},{"location":"modules/ssrf/","title":"Module 13 \u00b7 SSRF","text":"<p>Flag: <code>--skip-ssrf</code></p> <p>Tests 25 common URL parameters with 16 SSRF payloads targeting cloud metadata services and internal network ranges.</p>"},{"location":"modules/ssrf/#payloads","title":"Payloads","text":"<pre><code>http://127.0.0.1/\nhttp://127.0.0.1:22/\nhttp://127.0.0.1:8080/\nhttp://localhost/\nhttp://[::1]/\nhttp://0.0.0.0/\nhttp://2130706433/          # 127.0.0.1 decimal\nhttp://0x7f000001/          # 127.0.0.1 hex\nhttp://169.254.169.254/     # shared IMDS\nhttp://169.254.169.254/latest/meta-data/\nhttp://169.254.169.254/latest/meta-data/iam/security-credentials/\nhttp://metadata.google.internal/\nhttp://metadata.google.internal/computeMetadata/v1/\nhttp://169.254.169.254/metadata/v1/\nhttp://192.168.0.1/\nhttp://10.0.0.1/\n</code></pre>"},{"location":"modules/ssrf/#detection-indicators","title":"Detection indicators","text":"<p>The response body is scanned for these strings to detect successful SSRF:</p> <p><code>ami-id</code> \u00b7 <code>instance-id</code> \u00b7 <code>availability-zone</code> \u00b7 <code>iam</code> \u00b7 <code>security-credentials</code> \u00b7 <code>computeMetadata</code> \u00b7 <code>root:</code> \u00b7 <code>daemon:</code> \u00b7 <code>mysql:</code> \u00b7 <code>127.0.0.1</code> \u00b7 <code>localhost</code> \u00b7 <code>internal</code></p>"},{"location":"modules/ssrf/#findings","title":"Findings","text":"Condition Severity Internal/cloud-metadata content in response CRITICAL No in-band SSRF detected INFO <p>Blind SSRF</p> <p>In-band SSRF (where the response is returned directly) is what this module detects. Blind SSRF \u2014 where the server makes an out-of-band request \u2014 requires an external listener. Use Burp Collaborator or Interactsh for blind SSRF testing.</p>"},{"location":"modules/ssrf/#remediation","title":"Remediation","text":"<ul> <li>Validate and allowlist all outbound URL destinations</li> <li>Block access to IMDS from application containers (IMDSv2 on AWS, metadata server firewall on GCP/Azure)</li> <li>Use egress firewalling to prevent unexpected outbound connections</li> </ul>"},{"location":"modules/ssrf/#output-files","title":"Output files","text":"<pre><code>misc/\n\u2514\u2500\u2500 ssrf_tests.txt\n</code></pre>"},{"location":"modules/subtakeover/","title":"Module 14 \u00b7 Subdomain Takeover","text":"<p>Flag: <code>--skip-subtakeover</code></p> <p>Analyses the subdomain list produced by Module 01 for dangling CNAMEs pointing to deprovisioned external services.</p> <p>Dependency</p> <p>This module requires the subdomain list from Module 01 (<code>recon/subdomains.txt</code>). Run with <code>--skip-recon</code> only if you provide a pre-existing subdomain list.</p>"},{"location":"modules/subtakeover/#method-1-subjack","title":"Method 1 \u2014 subjack","text":"<p>subjack scans the subdomain list and checks each entry against its fingerprint database of known takeover-vulnerable services.</p>"},{"location":"modules/subtakeover/#method-2-nuclei-takeover-templates","title":"Method 2 \u2014 Nuclei takeover templates","text":"<p>Nuclei runs against the subdomain list using the built-in <code>takeovers/</code> template category.</p>"},{"location":"modules/subtakeover/#method-3-manual-cname-analysis","title":"Method 3 \u2014 Manual CNAME analysis","text":"<p>For each subdomain with a CNAME record, the module checks whether the CNAME points to a known external service and whether the resource returns a 404/410/403/503 (indicating the resource no longer exists).</p> <p>Monitored services (20+):</p> <p>AWS S3 \u00b7 Elastic Beanstalk \u00b7 CloudFront \u00b7 GitHub Pages \u00b7 Heroku \u00b7 Zendesk \u00b7 Freshdesk \u00b7 HelpScout \u00b7 Surge.sh \u00b7 Netlify \u00b7 Render \u00b7 Azure Web Apps \u00b7 Azure API Management \u00b7 Shopify \u00b7 Squarespace \u00b7 Tumblr \u00b7 Ghost \u00b7 Webflow \u00b7 Fly.io \u00b7 Cloudflare Pages</p>"},{"location":"modules/subtakeover/#findings","title":"Findings","text":"Condition Severity Takeover confirmed (subjack / Nuclei) HIGH Dangling CNAME to known service + 404/410 HIGH"},{"location":"modules/subtakeover/#remediation","title":"Remediation","text":"<p>Remove the DNS CNAME record for the affected subdomain, or reclaim the resource at the external service before an attacker does.</p>"},{"location":"modules/subtakeover/#output-files","title":"Output files","text":"<pre><code>misc/\n\u251c\u2500\u2500 subtakeover.txt\n\u2514\u2500\u2500 nuclei_takeover.txt\n</code></pre>"},{"location":"modules/xss/","title":"Module 09 \u00b7 XSS","text":"<p>Flag: <code>--skip-xss</code></p> <p>Tests for reflected and DOM-based XSS using dalfox and a manual parameter probe.</p>"},{"location":"modules/xss/#dalfox-scan","title":"dalfox scan","text":"<p>dalfox is run against the target URL with automatic parameter discovery.</p> Mode Extra flags Normal <code>--silence --timeout &lt;n&gt;</code> Aggressive <code>--deep-domxss --follow-redirects</code> <p>dalfox tests for:</p> <ul> <li>Reflected XSS in URL parameters</li> <li>DOM-based XSS</li> <li>Blind XSS (with callback)</li> <li>Header injection</li> </ul>"},{"location":"modules/xss/#manual-reflected-xss-probe","title":"Manual reflected XSS probe","text":"<p>In addition to dalfox, the module probes common GET parameters with 8 payloads:</p> <pre><code>&lt;script&gt;alert(1)&lt;/script&gt;\n'&gt;&lt;img src=x onerror=alert(1)&gt;\n&lt;svg onload=alert(1)&gt;\n\"&gt;&lt;script&gt;alert(1)&lt;/script&gt;\njavascript:alert(1)\n';alert(1);//\n&lt;details open ontoggle=alert(1)&gt;\n&lt;iframe srcdoc='&lt;script&gt;alert(1)&lt;/script&gt;'&gt;\n</code></pre> <p>Parameters tested: <code>q</code>, <code>s</code>, <code>search</code>, <code>query</code>, <code>keyword</code>, <code>id</code>, <code>name</code>, <code>page</code>, <code>url</code>, <code>ref</code>, <code>return</code>, <code>redirect</code>, <code>next</code>, <code>view</code>, <code>lang</code></p> <p>If the payload is reflected verbatim in the response body, the finding is confirmed.</p>"},{"location":"modules/xss/#findings","title":"Findings","text":"Condition Severity XSS confirmed (dalfox or manual) HIGH"},{"location":"modules/xss/#remediation","title":"Remediation","text":"<ul> <li>Encode all user-controlled output before inserting it into HTML (use framework-native escaping)</li> <li>Implement a strict Content-Security-Policy that disallows inline scripts</li> <li>Set <code>X-Content-Type-Options: nosniff</code></li> </ul>"},{"location":"modules/xss/#output-files","title":"Output files","text":"<pre><code>vulns/xss/\n\u251c\u2500\u2500 dalfox_results.txt\n\u2514\u2500\u2500 reflected_xss.txt\n</code></pre>"}]}