Automated Web Vulnerability Scanner

A Python-based automated security testing tool designed to identify common web application vulnerabilities such as SQL Injection (SQLi), Blind SQL Injection, Cross-Site Scripting (XSS), and missing security headers.

---

Overview

Web applications are among the most frequently targeted systems in modern cybersecurity. Manual vulnerability testing can be time-consuming and requires significant expertise. This project automates the process of identifying common web vulnerabilities through crawling, payload injection, and response analysis.

The scanner was developed as an educational cybersecurity project to demonstrate practical vulnerability assessment techniques and web security concepts.

---

Features

• Automated Web Crawling
• Form Discovery and Extraction
• SQL Injection Detection
• Blind SQL Injection Detection (Boolean-Based)
• Time-Based SQL Injection Detection
• Cross-Site Scripting (XSS) Detection
• Security Header Analysis
• JSON Report Generation
• DVWA Integration for Testing

---

Technologies Used

Technology	Purpose
Python	Core Development
Requests	HTTP Request Handling
BeautifulSoup4	HTML Parsing
JSON	Report Generation
Docker	DVWA Deployment
DVWA	Vulnerable Testing Environment

---

Project Structure

Automated-Web-Vulnerability-Scanner/
│
├── main.py
├── crawler.py
├── scanner.py
├── report.py
├── requirements.txt
├── screenshots/
└── README.md

Module Description

main.py

Acts as the entry point of the application. Handles user input, DVWA authentication, session creation, and scanner execution.

crawler.py

Responsible for crawling web pages, extracting forms and hyperlinks, and performing security header analysis.

scanner.py

Implements vulnerability detection logic including SQL Injection, Blind SQL Injection, Time-Based SQL Injection, and XSS testing.

report.py

Generates and stores vulnerability findings in JSON format.

---

Installation

Clone the repository:

git clone https://github.com/Dushyant479/Automated-Web-Vulnerability-Scanner.git
cd Automated-Web-Vulnerability-Scanner

Install dependencies:

pip install -r requirements.txt

---

Running DVWA

Start DVWA using Docker:

docker run --rm -it -p 8080:80 vulnerables/web-dvwa

Open:

http://localhost:8080

Login Credentials:

Username: admin
Password: password

Reset the database before testing.

---

Running the Scanner

Execute:

python main.py

Enter the target URL when prompted.

Example:

Enter target URL: http://localhost:8080/vulnerabilities/xss_r/
Are you testing DVWA? (yes/no): yes

---

Sample Vulnerabilities Detected

The scanner is capable of identifying:

• SQL Injection
• Blind SQL Injection (Boolean-Based)
• Time-Based SQL Injection
• Cross-Site Scripting (XSS)
• Missing Security Headers

Example security headers checked:

• Content-Security-Policy
• X-Frame-Options
• X-XSS-Protection
• Strict-Transport-Security
• X-Content-Type-Options

---

Sample Output

Detected vulnerabilities are stored in JSON format:

{
    "url": "http://localhost:8080/vulnerabilities/xss_r/",
    "type": "XSS",
    "payload": "<script>alert(1)</script>",
    "severity": "Medium"
}

---

Screenshots

DVWA Testing Environment

Project Structure

Scanner Execution Output

Generated JSON Report

---

Limitations

• Limited support for JavaScript-heavy applications
• Basic session management
• Possible false positives
• Limited URL parameter testing

---

Future Enhancements

• Graphical User Interface (GUI)
• Multi-threaded Scanning
• Improved Session and CSRF Handling
• Additional OWASP Vulnerability Checks
• Export Reports in PDF and HTML Formats

---

Author

Dushyant Chaudhary