vulnscope

A web security scanner. Point it at a site and it crawls within scope, runs a set of non-destructive checks for common misconfigurations and exposures, and produces a scored report as text, JSON, or HTML. Pure standard library — no install, no dependencies.

Scan only targets you own or are explicitly authorized to test.

python vulnscope.py example.com
python -m vulnscope example.com            # same thing, as a module
python vulnscope.py example.com --html report.html
python vulnscope.py example.com --json > out.json

Common flags:

--active          add light input-reflection probes (XSS/SQL surface)
--max-pages N     crawl budget (default 25)
--depth N         crawl depth (default 3)
--delay S         seconds between requests (be polite / avoid rate limits)
--timeout S       per-request timeout
--html FILE       write an HTML report
--json            machine-readable output

Exit code is 1 if any medium/high finding is reported, else 0, so it works in CI.

Passive and configuration checks (always run):

• Security headers: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy.
• Clickjacking: framing not restricted.
• Cookies: missing Secure / HttpOnly / SameSite flags.
• TLS: HTTP-only sites, weak protocol versions, expired/expiring certificates.
• HTTP methods: TRACE (XST), advertised PUT/DELETE.
• CORS: origin-reflecting or wildcard policies combined with credentials.
• Exposed files: .git, .env, .svn, config backups, phpinfo, server-status, archives — fingerprinted against the site's 404 to avoid false positives.
• Directory listing.
• Information disclosure: server/framework version banners, language stack traces, SQL/PHP error output.
• Mixed content and forms posting over HTTP or without a CSRF token field.

Active checks (with --active, still single benign probes, no exploitation):

• Reflected parameters (XSS surface) via a harmless canary value.
• SQL error surfaces via a single quote.

vulnscope https://example.com

  score 67/100 (C)    0 high  3 medium  4 low  0 info

  [MEDIUM] Missing strict-transport-security
    https://example.com
    fix: Add HSTS to force HTTPS.
  ...

The score starts at 100 and subtracts a weight per finding by severity. --html writes a self-contained styled report; --json emits the full finding list.

vulnscope.py        run without installing
vulnscope/
  __main__.py       python -m vulnscope
  cli.py            arguments and scan orchestration
  core.py           HttpClient, Finding, scoring
  crawler.py        scope-bound crawler (links + forms)
  checks.py         all checks
  report.py         text / json / html rendering

Checks return Finding objects with a severity, category, URL, detail, evidence, and remediation. Adding a check is a function that returns a list of findings; wire it into cli.run.

Python 3.9+. No third-party packages.

MIT