Automated web vulnerability scanner: SQL Injection, XSS, Directory Bruteforcing, Security Headers, and Target Fingerprinting — all in one B-Tier project.
WebPentest is a modular web application security scanner. It tests for the most common and impactful web vulnerabilities found in OWASP Top 10, generates professional pentest reports, and is built entirely in Python.
| Module | Description |
|---|---|
| Fingerprinting | Detect server, language, framework, SSL/TLS info, forms, HTML comments |
| SQL Injection | Error-based, boolean-based, and time-based blind SQLi detection |
| XSS | Reflected XSS across URL parameters with 10 evasion payloads |
| Security Headers | Detect missing CSP, HSTS, X-Frame-Options, X-XSS-Protection |
| Directory Scan | Bruteforce hidden files and directories (admin, .git, .env, backups) |
| HTML Reports | Professional dark-themed pentest report with severity color coding |
git clone https://github.com/raza360ahmed/WebPentest.git
cd WebPentest
pip install -r requirements.txt
# Full scan on intentionally vulnerable test target (legal & safe)
python main.py http://testphp.vulnweb.com --scan all
# SQLi only on a specific URL with parameters
python main.py http://testphp.vulnweb.com --url "http://testphp.vulnweb.com/artists.php?artist=1" --scan sqli
# Directory bruteforce only
python main.py http://testphp.vulnweb.com --scan dirs --threads 30
# Run tests
python -m pytest tests/ -vpython main.py TARGET [OPTIONS]
positional:
target Base URL (e.g., http://testphp.vulnweb.com)
options:
--url -u Specific URL with parameters for SQLi/XSS testing
--scan -s Modules: fingerprint sqli xss headers dirs all
--threads -t Dir scan threads (default: 20)
--timeout Request timeout seconds (default: 10)
--wordlist -w Custom wordlist file for dir scanning
--output -o Report directory (default: reports/)
--delay Delay between requests in seconds
Only scan systems you own or have explicit permission to test.
These are intentionally vulnerable systems for legal practice:
| Target | Description |
|---|---|
http://testphp.vulnweb.com |
Acunetix demo — SQLi, XSS, file exposure |
http://demo.testfire.net |
IBM demo bank — login bypass, SQLi |
http://localhost/dvwa |
DVWA — run locally with Docker |
WebPentest/
├── main.py # CLI entry point
├── requirements.txt
├── README.md
├── .gitignore
│
├── src/
│ ├── fingerprint.py # Target recon & tech detection
│ ├── sqli.py # SQL injection scanner
│ ├── xss.py # XSS + security headers
│ ├── dirscanner.py # Directory/file bruteforcer
│ └── reporter.py # JSON + CSV + HTML reports
│
├── tests/
│ └── test_webpentest.py # 15 unit tests
│
├── wordlists/ # Add custom wordlists here
└── reports/ # Generated reports (auto-created)
The HTML report includes:
- Overall risk level (CRITICAL / HIGH / MEDIUM / LOW)
- Severity breakdown by count
- Target fingerprint (server, tech stack, SSL info)
- Each finding with URL, parameter, payload, evidence, and remediation
Detects error-based, boolean-based, and time-based blind SQLi by injecting standard payloads into URL parameters and analyzing responses for database error strings and timing anomalies.
Tests for reflected XSS by injecting 10 payloads covering different HTML contexts (script tags, event handlers, SVG, image onerror) and checking if they appear unescaped in the response.
Checks for Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-XSS-Protection, and X-Content-Type-Options.
Hidden Directories (VARIABLE)
Bruteforces common paths including admin panels, backup files, .git, .env, config files, and API endpoints.
This tool is for authorized penetration testing and educational use only.
Unauthorized use against systems you don't own is illegal.
Ahmed Raza
BS Digital Forensics & Cyber Security — Hamdard University
GitHub · LinkedIn
MIT License