Web Application Security Scanner

#!/usr/bin/env python3
"""
Web Application Security Scanner

READ THE DOCUMENTATION BEFORE YOU RUN THIS:
    https://permitany.com/scripts/web-app-scanner

It covers what the script does, whether it is safe to run, the
inventory file and credentials it needs, how to read the output,
and what to do when something fails.

    pip install "requests>=2.28"
"""

import argparse, json, re, sys, urllib.parse
from datetime import datetime
# Windows consoles default to a legacy code page (cp1252), which cannot encode
# the arrows, box-drawing and check-mark characters used in the output below.
# Printing one raises UnicodeEncodeError and kills the script mid-scan, so make
# stdout UTF-8 and degrade unencodable characters instead of crashing.
for _stream in (sys.stdout, sys.stderr):
    try:
        _stream.reconfigure(encoding="utf-8", errors="replace")
    except (AttributeError, ValueError):
        pass        # already wrapped, or not a real stream (piped/redirected)

try:
    import requests
    from requests.packages.urllib3.exceptions import InsecureRequestWarning
    # Suppressed because an unverified request is a DELIBERATE, reported
    # decision here (see check_target_tls), not a silent default.
    requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
except ImportError:
    print("[!] pip install requests")
    sys.exit(1)

SENSITIVE_FILES = [
    ".git/config", ".git/HEAD", ".env", ".env.local", ".env.production",
    "backup.zip", "backup.tar.gz", "db.sql", "phpinfo.php",
    "wp-admin/", "wp-config.php", "robots.txt", "sitemap.xml",
    "admin/", "administrator/", "config.php", "web.config",
    "server-status", "server-info", ".htaccess", "Dockerfile",
    "docker-compose.yml", "package.json", "composer.json"
]

SQLI_PAYLOADS = [
    "' OR '1'='1",
    "' OR '1'='1' --",
    "\" OR \"1\"=\"1",
    "'; DROP TABLE users--",
    "1 AND 1=1",
    "1 AND 1=2",
    "' UNION SELECT null,null--",
]

XSS_PAYLOADS = [
    "<script>alert(1)</script>",
    "\"><script>alert(1)</script>",
    "<img src=x onerror=alert(1)>",
    "javascript:alert(1)",
    "'><svg onload=alert(1)>",
]

TRAVERSAL_PAYLOADS = [
    "../../../etc/passwd",
    "..%2F..%2F..%2Fetc%2Fpasswd",
    "....//....//....//etc/passwd",
    "%2e%2e%2f%2e%2e%2fetc%2fpasswd",
    "../../../windows/win.ini",
    "..\\..\\..\\windows\\win.ini",
]

OPEN_REDIRECT_PARAMS = ["redirect", "url", "next", "return", "returnUrl", "return_to", "goto"]
EVIL_URL = "https://evil.example.com"

REQUIRED_HEADERS = {
    "Strict-Transport-Security": "HSTS — browser won't enforce HTTPS on next visit",
    "Content-Security-Policy": "CSP — XSS attacks have no mitigation layer",
    "X-Frame-Options": "Clickjacking — site can be embedded in iframe",
    "X-Content-Type-Options": "MIME sniffing — browser may interpret files as different type",
    "Referrer-Policy": "Leaks URL in Referer header to third parties",
    "Permissions-Policy": "Browser features not restricted (camera, microphone, geolocation)",
}

KNOWN_CVE_SERVERS = {
    "Apache/2.4.49": "CVE-2021-41773 Path Traversal / RCE — CRITICAL — PATCH IMMEDIATELY",
    "Apache/2.4.50": "CVE-2021-42013 Path Traversal / RCE — CRITICAL — PATCH IMMEDIATELY",
    "nginx/1.14": "CVE-2019-9511 HTTP/2 DoS — update to 1.20+",
    "PHP/5": "EOL since 2018 — dozens of unpatched CVEs",
    "PHP/7.0": "EOL since 2019 — update to 8.x",
    "PHP/7.1": "EOL since 2019 — update to 8.x",
    "OpenSSL/1.0": "Multiple CVEs — EOL — update to 3.x",
}

SESSION = requests.Session()
SESSION.headers.update({"User-Agent": "Mozilla/5.0 (Security-Scanner/1.0 authorized)"})
TIMEOUT = 10
# Verification is ON by default. check_target_tls() turns it off for the rest of
# the scan if the target's certificate cannot be verified - but only after
# recording WHY as a finding, so the information is not lost the way a blanket
# verify=False loses it.
SESSION.verify = True


def check_target_tls(url: str, insecure: bool) -> bool:
    """
    Decide whether the scan runs verified, and report the target's TLS state.

    Returns True if the rest of the scan should verify certificates.

    The certificate is treated as something to REPORT rather than a
    precondition for scanning. A staging host with a self-signed certificate is
    the normal case for this tool, so refusing to scan it would make the tool
    useless; silently accepting it would hide a real finding. Both are avoided
    by probing once, naming the specific failure, and continuing.
    """
    parsed = urllib.parse.urlparse(url)

    if parsed.scheme == "http":
        add_finding("HIGH", "Transport Security",
                    "Target is served over plain HTTP, not HTTPS",
                    "Everything in this session crosses the network in cleartext and "
                    "can be read or modified in transit. Serve the site over HTTPS and "
                    "redirect HTTP to it.")
        print("    ✗ Plain HTTP — this scan and the site's traffic are unencrypted")
        return True        # no TLS to verify; nothing to turn off

    if insecure:
        print("    ⚠ --insecure: certificate not verified, and not reported")
        return False

    try:
        requests.get(url, timeout=TIMEOUT, verify=True,
                     headers=dict(SESSION.headers), allow_redirects=False)
        print("    ✓ TLS certificate verified")
        return True
    except requests.exceptions.SSLError as exc:
        reason = str(getattr(exc, "args", [""])[0])
        low = reason.lower()
        if "certificate has expired" in low or "certificate_expired" in low:
            why = "the certificate has expired"
        elif "self signed" in low or "self-signed" in low:
            why = "the certificate is self-signed, so it chains to no trusted root"
        elif "hostname" in low or "doesn't match" in low or "subjectaltname" in low:
            why = ("the certificate is valid but was not issued for this hostname "
                   "(check for a misconfigured load balancer or vhost)")
        elif "unable to get local issuer" in low or "unable to verify" in low:
            why = ("the issuer is not trusted here — the server may be omitting an "
                   "intermediate certificate")
        else:
            why = f"verification failed: {reason[:160]}"
        add_finding("HIGH", "Transport Security",
                    f"TLS certificate does not verify — {why}",
                    "Users see a browser warning, which trains them to click through it. "
                    "Install a certificate from a trusted CA, or add your internal root to "
                    "the trust stores that need it. Run /scripts/ssl-cert-checker against "
                    "this host for the expiry date, chain and key details.")
        print(f"    ✗ TLS certificate does not verify — {why}")
        print("      Continuing unverified so the rest of the scan still runs.")
        return False
    except Exception:
        # Not a certificate problem - let the main connection attempt report it.
        return True

findings = []

def add_finding(severity, category, detail, recommendation=""):
    findings.append({
        "severity": severity, "category": category,
        "detail": detail, "recommendation": recommendation
    })

def check_security_headers(url, response):
    print("\n[*] Security Headers Audit...")
    for header, desc in REQUIRED_HEADERS.items():
        if header.lower() not in {k.lower() for k in response.headers}:
            print(f"    \u2717 {header}: MISSING — {desc}")
            add_finding("MEDIUM", "Missing Security Header", f"{header} not set", f"Add header: {header}")
        else:
            val = response.headers.get(header, "")
            print(f"    \u2713 {header}: {val[:60]}")

def check_server_disclosure(response):
    server = response.headers.get("Server", "")
    x_powered = response.headers.get("X-Powered-By", "")
    if server:
        print(f"\n[*] Server: {server}")
        for pattern, cve in KNOWN_CVE_SERVERS.items():
            if pattern in server:
                print(f"    \u2717 CRITICAL CVE: {cve}")
                add_finding("CRITICAL", "Server Version CVE", f"Server: {server} — {cve}", "Update immediately")
        if "/" in server:
            add_finding("LOW", "Server Version Disclosure", f"Server header reveals: {server}",
                        "Set 'ServerTokens Prod' (Apache) or 'server_tokens off' (nginx)")
    if x_powered:
        print(f"    X-Powered-By: {x_powered}  ← version disclosure")
        add_finding("LOW", "Technology Disclosure", f"X-Powered-By: {x_powered}",
                    "Remove X-Powered-By header")

def discover_params(url):
    parsed = urllib.parse.urlparse(url)
    params = dict(urllib.parse.parse_qsl(parsed.query))
    return params, parsed

def test_sqli(base_url, params):
    if not params:
        print("\n[*] SQLi Test — no URL parameters found, testing form POST if available...")
        return
    print(f"\n[*] SQLi Test — {base_url} params: {list(params.keys())}...")
    for param, original in params.items():
        for payload in SQLI_PAYLOADS[:3]:
            test_params = dict(params)
            test_params[param] = payload
            try:
                r = SESSION.get(base_url, params=test_params, timeout=TIMEOUT)
                errors = ["sql syntax", "mysql_fetch", "ORA-", "pg_query", "sqlite",
                          "syntax error", "unclosed quotation", "ODBC SQL"]
                if any(e.lower() in r.text.lower() for e in errors):
                    msg = f"SQLi detected in param '{param}' with payload: {payload}"
                    print(f"    \u2717 CRITICAL: {msg}")
                    print(f"           SQL error in response — database commands accepted")
                    add_finding("CRITICAL", "SQL Injection", msg,
                                "Use parameterized queries / prepared statements")
                    return
                if r.status_code == 200 and len(r.text) != len(SESSION.get(base_url, params=params, timeout=TIMEOUT).text):
                    msg = f"Possible SQLi in param '{param}' (response length changed with payload)"
                    print(f"    \u26a0 SUSPICIOUS: {msg}")
                    add_finding("HIGH", "Possible SQL Injection", msg,
                                "Manual verification recommended")
                    return
            except Exception:
                pass

def test_xss(base_url, params):
    if not params:
        return
    print(f"\n[*] XSS Test — {base_url}...")
    for param, original in params.items():
        for payload in XSS_PAYLOADS[:2]:
            test_params = dict(params)
            test_params[param] = payload
            try:
                r = SESSION.get(base_url, params=test_params, timeout=TIMEOUT)
                if payload in r.text and "text/html" in r.headers.get("content-type", ""):
                    msg = f"Reflected XSS in param '{param}' — payload echoed unescaped"
                    print(f"    \u2717 HIGH: {msg}")
                    print(f"           Attacker can inject scripts into victim's browser")
                    add_finding("HIGH", "Cross-Site Scripting (XSS)", msg,
                                "HTML-encode all user input before output. Implement CSP.")
                    return
            except Exception:
                pass

def test_directory_traversal(base_url, params):
    print(f"\n[*] Directory Traversal Test...")
    if params:
        for param in params:
            for payload in TRAVERSAL_PAYLOADS[:2]:
                test_params = dict(params)
                test_params[param] = payload
                try:
                    r = SESSION.get(base_url, params=test_params, timeout=TIMEOUT)
                    if any(sig in r.text for sig in ["root:x:", "[extensions]", "[fonts]"]):
                        msg = f"Directory traversal in param '{param}' — system file read!"
                        print(f"    \u2717 CRITICAL: {msg}")
                        add_finding("CRITICAL", "Directory Traversal", msg,
                                    "Validate and sanitize file path inputs. Use allowlist.")
                        return
                except Exception:
                    pass

def check_sensitive_files(base_url):
    print(f"\n[*] Sensitive File Exposure Check...")
    parsed = urllib.parse.urlparse(base_url)
    base = f"{parsed.scheme}://{parsed.netloc}"
    for path in SENSITIVE_FILES:
        try:
            url = f"{base}/{path}"
            r = SESSION.get(url, timeout=TIMEOUT, allow_redirects=False)
            if r.status_code in (200, 301, 302):
                severity = "CRITICAL" if path in (".env", ".env.local", ".env.production", "wp-config.php") else "HIGH"
                hint = ""
                if ".env" in path:
                    hint = " — DB credentials, API keys likely exposed!"
                elif ".git" in path:
                    hint = " — source code leaked!"
                elif "backup" in path:
                    hint = " — database or application backup exposed!"
                print(f"    \u2717 {severity}: GET /{path} → {r.status_code}{hint}")
                add_finding(severity, "Sensitive File Exposed", f"/{path} returned HTTP {r.status_code}{hint}",
                            f"Block access to /{path} in web server config")
            elif r.status_code == 403:
                print(f"    \u26a0 MEDIUM: GET /{path} → 403 (exists but forbidden)")
            else:
                print(f"    \u2713 GET /{path} → {r.status_code}")
        except Exception:
            pass

def check_open_redirect(base_url):
    print(f"\n[*] Open Redirect Check...")
    parsed = urllib.parse.urlparse(base_url)
    base = f"{parsed.scheme}://{parsed.netloc}"
    for param in OPEN_REDIRECT_PARAMS:
        try:
            url = f"{base}/?{param}={EVIL_URL}"
            r = SESSION.get(url, timeout=TIMEOUT, allow_redirects=False)
            if r.status_code in (301, 302, 303, 307, 308):
                loc = r.headers.get("Location", "")
                if "evil.example.com" in loc or EVIL_URL in loc:
                    print(f"    \u2717 HIGH: Open redirect via ?{param}= — redirects to attacker URL")
                    add_finding("HIGH", "Open Redirect", f"?{param}={EVIL_URL} causes redirect",
                                "Validate redirect targets against an allowlist of trusted domains")
                    return
        except Exception:
            pass

def check_cookie_flags(response):
    print(f"\n[*] Cookie Security Analysis...")
    cookies = response.headers.get("Set-Cookie", "")
    if not cookies:
        print("    No cookies set on initial request.")
        return
    for line in cookies.split(","):
        name = line.strip().split("=")[0].strip()
        httponly = "httponly" in line.lower()
        secure = "secure" in line.lower()
        samesite = "samesite" in line.lower()
        issues = []
        if not httponly: issues.append("HttpOnly: MISSING — cookie stealable via XSS")
        if not secure: issues.append("Secure: MISSING — cookie sent over HTTP")
        if not samesite: issues.append("SameSite: MISSING — CSRF risk")
        if issues:
            print(f"    Cookie: {name}")
            for issue in issues:
                print(f"      \u2717 {issue}")
            add_finding("MEDIUM", "Insecure Cookie Flags",
                        f"Cookie '{name}' missing flags: {', '.join(issues)}",
                        "Set HttpOnly; Secure; SameSite=Strict on all session cookies")
        else:
            print(f"    \u2713 Cookie: {name} — all flags set")

def check_cors(base_url):
    print(f"\n[*] CORS Misconfiguration Check...")
    try:
        r = SESSION.get(base_url, timeout=TIMEOUT,
                        headers={"Origin": "https://evil.example.com"})
        acao = r.headers.get("Access-Control-Allow-Origin", "")
        acac = r.headers.get("Access-Control-Allow-Credentials", "")
        if "evil.example.com" in acao or acao == "*":
            if acac.lower() == "true" or acao == "*":
                print(f"    \u2717 HIGH: CORS accepts Origin: evil.example.com — authenticated requests allowed!")
                add_finding("HIGH", "CORS Misconfiguration",
                            f"Access-Control-Allow-Origin: {acao} with Credentials: {acac}",
                            "Restrict CORS to specific trusted origins. Never combine * with credentials.")
            else:
                print(f"    \u26a0 MEDIUM: CORS accepts arbitrary origins (no credentials)")
                add_finding("MEDIUM", "CORS Misconfiguration", f"ACAO: {acao}",
                            "Restrict to specific trusted origins")
        else:
            print(f"    \u2713 CORS properly restricted: {acao or 'not set'}")
    except Exception as e:
        print(f"    [!] CORS check error: {e}")

def main():
    parser = argparse.ArgumentParser(description="Web App Security Scanner — OWASP Top 10")
    parser.add_argument("--url", required=True, help="Target URL (e.g. http://target.example.com)")
    parser.add_argument("--output", default=None, help="JSON output file")
    parser.add_argument("--insecure", action="store_true",
                        help="Skip TLS verification and do not report certificate "
                             "problems. Use only for a staging host whose self-signed "
                             "certificate you already know about — otherwise let the "
                             "scan report what it finds.")
    args = parser.parse_args()

    url = args.url.rstrip("/")
    print(f"[*] Web App Scanner — OWASP Top 10 | {url}")

    print("\n[*] Transport Security...")
    SESSION.verify = check_target_tls(url, args.insecure)

    try:
        resp = SESSION.get(url, timeout=TIMEOUT)
    except requests.exceptions.SSLError as e:
        print(f"[!] TLS error connecting to {url}: {e}")
        print("    Re-run with --insecure if this host's certificate is known-bad.")
        sys.exit(1)
    except Exception as e:
        print(f"[!] Cannot connect to {url}: {e}")
        sys.exit(1)

    print(f"[*] Target: {url} | HTTP {resp.status_code}")
    check_server_disclosure(resp)
    check_security_headers(url, resp)
    params, parsed = discover_params(url)
    test_sqli(url, params)
    test_xss(url, params)
    test_directory_traversal(url, params)
    check_sensitive_files(url)
    check_open_redirect(url)
    check_cookie_flags(resp)
    check_cors(url)

    critical = sum(1 for f in findings if f["severity"] == "CRITICAL")
    high = sum(1 for f in findings if f["severity"] == "HIGH")
    medium = sum(1 for f in findings if f["severity"] == "MEDIUM")
    low = sum(1 for f in findings if f["severity"] == "LOW")
    print(f"\n[*] Summary: {critical} CRITICAL | {high} HIGH | {medium} MEDIUM | {low} LOW")

    output = args.output or f"web_scan_{parsed.netloc}_{datetime.now().strftime('%Y-%m-%d')}.json"
    with open(output, "w") as fh:
        json.dump({"target": url, "scan_date": datetime.now().isoformat(),
                   "findings": findings, "summary": {"critical": critical, "high": high,
                   "medium": medium, "low": low}}, fh, indent=2)
    print(f"[*] Report saved: {output}")
    return 2 if critical else (1 if high or medium else 0)

if __name__ == "__main__":
    try:
        sys.exit(main())
    except KeyboardInterrupt:
        print("\nInterrupted.", file=sys.stderr)
        sys.exit(130)