Skip to content

README.md

Latest commit

 

History

History
102 lines (69 loc) · 3.9 KB

README.md

File metadata and controls

102 lines (69 loc) · 3.9 KB
Raw

Web Security Audit Toolkit

A collection of automated Python scripts designed to perform a security audit on a website. This toolkit helps identify common vulnerabilities and misconfigurations in a simple, straightforward way.

Getting Started

Follow these steps to get the toolkit up and running on your local machine.

Prerequisites

  • You must have Python 3 installed on your system.

Installation

  1. Get the code: Clone or download the project files to a folder on your computer.

  2. Install required packages: All necessary Python libraries are listed in requirements.txt. Open your terminal in the project folder and run:

    pip install -r requirements.txt

    Note: The Selenium-based tests use Selenium Manager to automatically download the correct web driver. Ensure you have Google Chrome or Chromium installed.

How to Use

The main script to run all tests is main.py. You provide it with a target URL and can specify the intensity of the audit.

Running an Audit

You can choose from three audit levels. If you don't specify a level, it will run a basic audit by default.

  • Basic Audit (Recommended for a quick check):

    python3 main.py http://example.com

    or

    python3 main.py --level basic http://example.com

  • Advanced Audit (More detailed):

    python3 main.py --level advanced http://example.com

  • Extreme Audit (Intrusive - use with caution):

    python3 main.py --level extreme http://example.com

Running Specific Tests

If you only want to run one or more specific tests, use the --tests flag followed by the test names.

python3 main.py --tests tech headers http://example.com

Audit Levels Explained

  • Basic Audit (--level basic)

    This is a quick and safe check. It looks at your website's public information and basic security settings without trying to break anything. It's like checking if your doors and windows are closed.

  • Advanced Audit (--level advanced)

    This audit is more thorough and includes all basic checks. It actively looks for hidden pages and checks for more complex security settings. It's like checking the locks and looking for less obvious entry points.

  • Extreme Audit (--level extreme)

    This is the most intense audit and includes all advanced checks. It actively tries to find vulnerabilities by sending test payloads to your website. Warning: This is an intrusive scan and should only be run on websites you have explicit permission to test.

Available Scripts

Here is a list of the currently available test scripts:

Test Name Audit Level Description
tech Basic Identifies website technologies (e.g., WordPress).
headers Basic Checks for important security headers.
clickjacking Basic Tests if the site is vulnerable to clickjacking.
links Basic Finds broken links on the homepage.
dns Basic Performs a WHOIS, DNS, and NSLOOKUP.
screenshot Basic Takes a screenshot of the homepage using a browser.
subdomain Advanced Tries to find common subdomains.
insecure-forms Advanced Checks for login forms that submit data over insecure HTTP.
xss Extreme Runs a basic test for Reflected Cross-Site Scripting (XSS).
dom-xss Extreme Runs a basic test for DOM-based XSS vulnerabilities.

License

This project is licensed under the MIT License - see the LICENSE file for details.