🛡️ WebSentinel — OWASP Top 10 Vulnerability Scanner

A Python-based web vulnerability scanner targeting the OWASP Top 10, built as a portfolio project for offensive security roles.

---

What It Scans

#	Check	OWASP Reference	Severity Range
1	Security Headers	A05 – Security Misconfiguration	LOW → HIGH
2	Open Redirect	A01 – Broken Access Control	HIGH
3	SQL Injection Indicators	A03 – Injection	CRITICAL
4	Exposed Admin Panels & Paths	A05 – Security Misconfiguration	MEDIUM → HIGH
5	Sensitive File Exposure (.env, backups, .git)	A05 – Security Misconfiguration	MEDIUM → CRITICAL
6	Cookie Security Flags	A02 – Cryptographic Failures	MEDIUM
7	CORS Misconfiguration	A05 – Security Misconfiguration	HIGH → CRITICAL
8	Reflected XSS Indicators	A03 – Injection	HIGH
9	Dangerous HTTP Methods (PUT, DELETE, TRACE)	A05 – Security Misconfiguration	MEDIUM

---

Quick Start

# 1. Clone and install
git clone https://github.com/yourusername/websentinel.git
cd websentinel
pip install -r requirements.txt

# 2. Spin up a vulnerable test target (Docker required)
docker run --rm -d -p 3000:3000 bkimminich/juice-shop   # OWASP Juice Shop
# OR
docker run --rm -d -p 80:80 vulnerables/web-dvwa         # DVWA

# 3. Run the scanner
python scanner.py http://localhost:3000

# 4. Save a JSON report
python scanner.py http://localhost:3000 --output report.json

---

Example Output

 ██╗    ██╗███████╗██████╗ ███████╗███████╗███╗   ██╗████████╗██╗███╗   ██╗███████╗██╗
 ...

Target  : http://localhost:3000
Started : 2025-05-03 14:22:11
────────────────────────────────────────────────────

▶ Running: Security Headers…        [4 issue(s)]  (0.3s)
▶ Running: Open Redirect…           [1 issue(s)]  (0.8s)
▶ Running: SQL Injection Indicators… [clean]       (1.2s)
▶ Running: Exposed Admin / Paths…   [3 issue(s)]  (2.1s)
...

════════════════════════════════════════════════════
  SCAN COMPLETE  —  11 finding(s)
════════════════════════════════════════════════════

  [1] Open Redirect Detected
      Severity : HIGH
      OWASP    : A01:2021 – Broken Access Control
      Detail   : Parameter 'url' redirects to arbitrary external URLs...
      Evidence : GET http://localhost:3000?url=https://evil.example.com
               : → 302 Location: https://evil.example.com
      Fix      : Validate and whitelist redirect targets.

  Severity Breakdown:
  HIGH        ███████ (7)
  MEDIUM      ████ (4)

---

Testing Against Intentionally Vulnerable Apps

OWASP Juice Shop (Recommended)

docker run --rm -d -p 3000:3000 bkimminich/juice-shop
python scanner.py http://localhost:3000 -o juice_shop_report.json

Juice Shop is a modern Node.js app with intentional OWASP Top 10 vulnerabilities — perfect for validating scanner accuracy.

DVWA (Damn Vulnerable Web App)

docker run --rm -d -p 80:80 -p 3306:3306 vulnerables/web-dvwa
# Default credentials: admin / password
python scanner.py http://localhost/dvwa -o dvwa_report.json

Expected Findings Per App

Finding Type	Juice Shop	DVWA
Missing Security Headers	✅	✅
Open Redirect	✅	❌
SQLi Indicators	❌ (uses ORM)	✅
Exposed Paths	✅ (/api-docs)	✅ (/phpmyadmin)
Sensitive Files	✅	✅
Weak Cookies	✅	✅
CORS Issues	✅	❌

---

Architecture

scanner.py
├── HTTP helper layer      (requests session, timeout/SSL handling)
├── Check modules (×9)     (each returns list of Finding dicts)
├── Orchestrator           (runs all checks, collects results)
├── Reporter               (coloured terminal + JSON export)
└── CLI                    (argparse, --output, --verbose)

Each check module is self-contained and returns a list of finding dicts — easy to extend, test in isolation, or plug into a CI pipeline.

---

Extending the Scanner

Adding a new check is three steps:

# 1. Write a check function
def check_my_new_vuln(base_url):
    findings = []
    r = get(base_url + "/some/path")
    if r and "dangerous_pattern" in r.text:
        findings.append(finding(
            title="My New Vulnerability",
            severity="HIGH",
            description="Explanation of the issue.",
            evidence=f"GET {base_url}/some/path → match found",
            remediation="How to fix it.",
            owasp_ref="A05:2021 – Security Misconfiguration",
        ))
    return findings

# 2. Register it in the CHECKS list
CHECKS = [
    ...
    ("My New Check", check_my_new_vuln),
]

# 3. Run and verify against DVWA or Juice Shop

---

Roadmap

• Rate limiting / throttle control (--delay flag)
• Authenticated scanning (session cookie / Bearer token injection)
• HTML report output (Jinja2 template)
• Subdomain enumeration pre-scan
• CI/CD integration example (GitHub Actions)
• Threading for faster path enumeration

---

⚠️ Legal Disclaimer

This tool is for authorised security testing only. Only run it against systems you own or have explicit written permission to test. Unauthorised scanning may violate computer crime laws including Japan's Unauthorised Computer Access Law (不正アクセス行為の禁止等に関する法律).

---

Skills Demonstrated

• Python — modular CLI tool with clean architecture
• Web security — OWASP Top 10 (2021) concepts applied practically
• HTTP internals — headers, redirects, CORS, cookies, methods
• Security tooling — similar patterns to Nikto, Nuclei, Burp Suite active scan
• Responsible disclosure mindset — severity ratings, remediation guidance

---

Built as a portfolio project for entry-level offensive security / web app pentesting roles.