websec-audit/docs/index.md

title, description, hide

title	description	hide
Web Security Audit Framework	Professional Web Security Audit Framework — modular, extensible, Bash-native.	navigation toc

WebSec-Audit

Professional Web Security Audit Framework — modular, extensible, Bash-native

!!! danger "Legal Notice" This tool is intended exclusively for authorised security assessments. Only run it against systems you own or have explicit written permission to test. Unauthorised use is illegal. The author assumes no liability for misuse.

---

What is WebSec-Audit?

WebSec-Audit is a Bash framework that automates comprehensive web application security audits. It integrates 15+ independent modules — from passive reconnaissance to active exploitation — and produces professional findings reports in three formats.

Designed to run on Debian, Ubuntu and Kali Linux with zero mandatory dependencies beyond curl and nmap.

---

Feature highlights

• :material-puzzle: Modular architecture

  Enable or disable any of the 15+ modules with a single --skip-<module> flag.

• :material-speedometer: Three scan modes

  Normal, Aggressive and Stealth — adapt the scan depth to each engagement.

• :material-file-chart: Rich reports

  Interactive HTML dashboard, structured JSON and plain-text log — generated automatically.

• :material-shield-search: Broad coverage

  Recon · Port scan · SSL/TLS · Headers · SQLi · XSS · SSRF · CORS · CMS · Takeover · Nuclei

• :material-bug-play: Proxy support

  Route all traffic through Burp Suite or any HTTP proxy with --proxy.

• :material-tools: Tool-agnostic

  Graceful fallback when optional tools are absent. Core scan works with only curl + nmap.

---

Modules at a glance

Module 01

Reconnaissance

WHOIS · DNS · AXFR · Subdomains · SPF/DMARC · Dorks

Module 02

Port Scanning

nmap · service detection · risk analysis

Module 03

Fingerprinting

WhatWeb · WAF detection · version leakage

Module 04

SSL/TLS

testssl.sh · ciphers · cert expiry · HSTS

Module 05

HTTP Headers

CSP · cookies · clickjacking · redirects

Module 06

Dir & File Enum

gobuster · ffuf · 40+ sensitive paths

Module 07

Nikto

Web server CVEs · misconfigurations

Module 08

SQL Injection

sqlmap · auto + aggressive mode

Module 09

XSS

dalfox · reflected · DOM-based

Module 10

CMS Scanning

WordPress · Drupal · Joomla · Magento

Module 11

CORS

wildcard · reflected origin · null origin

Module 12

Open Redirect

20 params × 10 payloads

Module 13

SSRF

AWS · GCP · Azure IMDS · internal IPs

Module 14

Subdomain Takeover

subjack · nuclei · 20+ services

Module 15

Nuclei

CVE templates · misconfiguration scan

---

Quick start

git clone https://github.com/davidalvarezp/websec-audit.git
cd websec-audit
chmod +x install.sh websec-audit.sh
sudo ./install.sh
./websec-audit.sh -t https://target.com

:material-arrow-right: See Installation and Quick Start for details.

---

Author

Built by davidalvarezp.

:material-github: github.com/davidalvarezp · :material-linkedin: linkedin.com/in/davidalvarezp