WebAnalyzer

The open-source reconnaissance dashboard

Run 28 recon & security modules against a domain from one interface — then turn the results into a shareable report.

WebAnalyzer bridges passive OSINT enumeration and active vulnerability assessment, wraps it in a real dashboard, and gives you an executive report at the end. Built for penetration testers, bug bounty hunters, and security researchers.

🖥️ Live Dashboard · ⚡ API & Docs · 📝 Deep-dive Article

---

Why WebAnalyzer?

Most reconnaissance tooling is a pile of separate CLIs you glue together yourself. WebAnalyzer takes the opposite approach:

• 🎛️ One interface, many tools. WHOIS, DNS, subdomains, WAF fingerprinting, SSL/TLS, CloudFlare origin unmasking, port scanning, content & secret scanning, API testing — selectable per scan, from a CLI or a web dashboard.
• 📊 A dashboard, not just logs. A React command center visualizes scores, findings, network maps, threat intel and attack paths in real time — with results persisted to MySQL so nothing is lost between sessions.
• 📄 Reports you can hand over. Every scan can be exported as JSON, CSV, or a styled executive HTML/PDF security report with remediation advice.
• 🛡️ Built to survive real targets. User-agent rotation, adaptive rate-limit backoff, proxy hooks and WAF-aware pacing keep scans running against protected infrastructure.

WebAnalyzer doesn't try to out-scan nuclei or amass — it gives you a cohesive interface and reporting layer on top of proven reconnaissance techniques.

---

Quick start

🐳 Docker Compose (recommended — everything in one command)

Spins up the MySQL database, FastAPI backend, and React dashboard together, with all system dependencies (Python, Go, Node, Nmap, Subfinder) baked in.

git clone https://github.com/frkndncr/WebAnalyzer.git
cd WebAnalyzer
docker compose up -d --build

• Dashboard: http://localhost:8080
• API docs: http://localhost:8000/docs

📦 pip (CLI only)

pip install webanalyzer-security
webanalyzer

⚡ Manual (developer mode)

git clone https://github.com/frkndncr/WebAnalyzer.git
cd WebAnalyzer
pip install -r requirements.txt

# Backend
uvicorn api:app --host 0.0.0.0 --port 8000 --reload

# Frontend (in a second terminal)
cd dashboard && npm install && npm run dev   # http://localhost:5173

The database is optional for single scans (results also persist to logs/<domain>/results.json). To enable durable storage, set DB_HOST, DB_NAME, DB_USER, DB_PASSWORD — the schema auto-initializes on first connect.

Hosting a public instance? Set DEMO_MODE=true to rate-limit scan requests per client and refuse internal/private/reserved targets (SSRF protection). It's off by default so self-hosted users can scan their own infrastructure. See .env.example.

In demo mode the intrusive modules (Nmap, active content testing, subdomain-takeover and origin probing, exposed-file, cloud-bucket and zone-transfer checks) only run on domains whose owner has proven control by publishing a DNS TXT record (_webanalyzer.<domain>, shown by the dashboard or GET /api/verify/<domain>). Passive modules (WHOIS, DNS, headers, certificates, archive lookups, ...) stay open to everyone, so a public instance can't be used to port-scan or attack third parties.

---

What it does

Analysis modules

Module	What it finds	Risk
Domain Information	WHOIS, registrar, registration & expiry dates	🟢
DNS Analysis	A / AAAA / MX / TXT / CNAME records	🟢
SEO Analysis	Meta tags, Open Graph, indexing signals	🟢
Web Technologies	Server, frameworks, CMS fingerprinting	🟢
GEO Analysis	IP geolocation & hosting provider	🟢
Security Analysis	Headers, SSL/TLS, WAF detection, scoring	🟡
Subdomain Discovery	Subdomain enumeration (Subfinder)	🟡
Contact Intelligence	Emails, phones, social profiles	🟡
Advanced Content Scan	Deep crawl, secrets, JS taint analysis, SSRF	🟡
Web Archive Spy	Wayback Machine historical secret scraping	🟡
SSL SAN Association	crt.sh & certificate-based asset mapping	🟡
Subdomain Takeover	Dangling CNAME / takeover detection	🔴
CloudFlare Bypass	Origin IP unmasking behind the WAF	🔴
Nmap Zero-Day Scan	Port scanning & service fingerprinting	🔴
Phishing Detection	Typosquatted / look-alike domain resolver	🔴
API Security Scanner	API endpoint discovery & vulnerability testing	🟣
Email Security	SPF, DKIM, DMARC and MTA-STS	🟢
TLS Health	Certificate expiry & trust, key strength, legacy protocols	🟢
DNS Health	Single/dangling nameservers, CAA, DNSSEC	🟢
Cookies & CORS	Cookie flags, permissive cross-origin policy	🟢
HTTP Methods & Redirects	HTTP→HTTPS redirect, risky methods, TRACE	🟢
Privacy & Trackers	Third-party trackers, consent and privacy-policy signals (KVKK/GDPR)	🟢
JS Library Vulnerabilities	Known CVEs in the JavaScript libraries a page loads (OSV)	🟢
Asset Inventory	Addresses, owning networks (ASN), certificate-transparency host names	🟡
Security.txt	RFC 9116 vulnerability-disclosure contact	🟢
Exposed Files	.git, .env, backups, phpinfo, actuator, debug consoles	🔴
Cloud Storage	Publicly listable S3 / GCS buckets named after the domain	🔴
DNS Zone Transfer	Open AXFR on the domain's nameservers	🔴

Plus an Attack Path Planner that chains findings into a logical exploit roadmap. See docs/Modules.md for details.

Command line and CI

pip install webanalyzer-security

webanalyzer scan example.com                      # standard preset
webanalyzer scan example.com --passive -f sarif -o out.sarif --fail-on high
webanalyzer scan -l domains.txt -f jsonl | jq .   # one JSON object per domain
webanalyzer modules                               # list the modules

# a report for your client (open it, then Save as PDF)
webanalyzer scan example.com --passive -f html -o report.html --client "Acme Corp" --author "Your Team"

# only alert on what is new since the last scan
webanalyzer scan example.com -f json -o today.json --baseline last.json --fail-on high
webanalyzer diff last.json today.json -f markdown

Output as text, json, jsonl, SARIF (GitHub Code Scanning), markdown or a printable html report; exit code 1 when a finding reaches --fail-on, so a scan can gate a pipeline. There is also a GitHub Action:

- uses: frkndncr/WebAnalyzer@v3
  with:
    target: example.com
    upload-sarif: "true"     # findings appear in the repository's Security tab
    fail-on: high

See docs/CI.md for every option, exit codes and other CI systems.

Bulk processing

For large jobs (100s–50K+ domains), WebAnalyzer ships a MySQL-backed queue with worker pools, retries and checkpoint recovery:

python domains-check.py --input domains.json --output validated.json   # pre-validate
python bulk_scan.py --load validated.json --job-name "Security Audit"   # create a job
python bulk_scan.py --job-id 1 --workers 10                             # run it
python bulk_scan.py --stats 1                                           # monitor

Highlighted capabilities

• Origin IP unmasking — historical DNS records, subdomain leakage, and SSL SAN validation to find the real IP behind CloudFlare.
• Secrets & JS analysis — Shannon-entropy secret hunting with a 40+ pattern registry, plus taint tracking of location.search/.hash → innerHTML/eval DOM-XSS flows.
• Heuristic API detection — distinguishes real JSON/XML endpoints from HTML-in-404 noise via headers, server stack and response structure.
• Evasion — session/user-agent rotation, adaptive HTTP 429 backoff, and WAF-aware pacing. See docs/Features.md.

---

Architecture

graph LR
    subgraph Interfaces
      CLI[CLI - main.py]
      UI[React Dashboard]
    end
    API[FastAPI backend - api.py]
    ENG[Module engine + bulk processor]
    DB[(MySQL)]
    MODS[28 analysis modules]

    CLI --> ENG
    UI --> API --> ENG --> MODS
    ENG --> DB
    API --> DB

Loading

• Backend: Python 3.8+, FastAPI, a module execution framework, and an optional MySQL layer with connection pooling. Bulk mode processes 1K–50K+ domains via a job queue with retry and checkpoint recovery.
• Frontend: React 19 + Vite, a central API client, live polling, and hand-built SVG visualizations.
• Storage: MySQL is the durable source of truth; local JSON is a fallback cache.

Full details in docs/Architecture.md.

---

⚖️ Legal & ethical use

WebAnalyzer includes modules capable of active security testing (vulnerability scanning, origin unmasking, authentication-bypass checks).

Only scan systems you own or are explicitly authorized to test.

Respect rate limits and terms of service, follow responsible disclosure, and comply with the laws in your jurisdiction. Unauthorized security testing may be illegal. The authors are not liable for misuse. The public demo is provided for evaluation only — do not use it to test systems you don't own.

---

Contributing

Contributions are welcome — issues, feature requests, and pull requests all help. See CONTRIBUTING.md and the issue templates. Good places to start: a new analysis module (one file - see Writing a module), dashboard improvements, or test coverage.

# Run the backend test suite
pip install pytest && pytest

# Lint the dashboard
cd dashboard && npm install && npm run lint

---

Documentation

• Architecture
• Features
• Modules
• Advanced Content Scanner deep-dive
• Changelog · Türkçe README

---

License & author

Released under the MIT License.

Built by Furkan Dinçer — LinkedIn · Instagram · hi@c4softwarestudio.com

If WebAnalyzer is useful to you, consider giving it a ⭐ — it genuinely helps.