Overview The Vulnerability Scanner module (modules/vuln_scanner.py) integrates two powerful tools for web security testing:
Nikto : Web server vulnerability scannerSQLMap : Automated SQL injection detection and exploitation tool
VulnerabilityScanner Class Defined at vuln_scanner.py:13, this class orchestrates web vulnerability detection.
Initialization class VulnerabilityScanner : def __init__ ( self , target , ports_data ): """Initialize vulnerability scanner""" self .target = target self .ports_data = ports_data self .web_ports = [] self .vulnerabilities = [] self .web_vulns = [] self .sql_vulns = [] self .identify_web_services()
Target IP address or domain
List of open ports from Scanner module
Web Service Detection identify_web_services() Automatically detects HTTP/HTTPS services from port scan results.
def identify_web_services ( self ): """Identify HTTP/HTTPS services from port scan""" common_web_ports = [ 80 , 443 , 8080 , 8443 , 8000 , 8888 , 3000 , 5000 ] web_services = [ 'http' , 'https' , 'ssl/http' , 'http-proxy' , 'http-alt' ] for port in self .ports_data: service = port.get( 'service' , '' ).lower() port_num = port.get( 'port' ) if any (web_svc in service for web_svc in web_services) or port_num in common_web_ports: protocol = 'https' if port_num == 443 or 'https' in service else 'http' self .web_ports.append({ 'port' : port_num, 'protocol' : protocol, 'url' : f " { protocol } :// { self .target } : { port_num } " })
Detected Services:
Standard ports: 80 (HTTP), 443 (HTTPS)
Alternative ports: 8080, 8443, 8000, 8888, 3000, 5000
Service names: http, https, ssl/http, http-proxy, http-alt
Nikto Integration scan_with_nikto() Runs Nikto web vulnerability scanner against detected web services.
def scan_with_nikto ( self , url ): """Run Nikto web vulnerability scanner""" cmd = [ 'nikto' , '-h' , url, '-Format' , 'json' , '-output' , f 'logs/nikto_ { self .target } _ { timestamp } .json' , '-Tuning' , '123456789' , # All tests '-timeout' , '10' ] result = subprocess.run(cmd, capture_output = True , text = True , timeout = 300 ) vulns = self .parse_nikto_output(result.stdout) return vulns
Nikto Parameters: Output format (json for automated parsing)
Test categories: 1-9 enables all vulnerability checks
Request timeout in seconds (default: 10)
Nikto Vulnerability Categories Tuning Category 1 Interesting files/directories 2 Misconfiguration 3 Information disclosure 4 Injection (XSS/Script/HTML) 5 Remote file retrieval 6 Denial of service 7 Remote file inclusion 8 Command execution 9 SQL injection
SQLMap Integration scan_sql_injection() Scans for SQL injection vulnerabilities using SQLMap.
def scan_sql_injection ( self , url ): """Scan for SQL injection vulnerabilities using SQLMap""" cmd = [ 'sqlmap' , '-u' , url, '--batch' , '--crawl=2' , '--level=1' , '--risk=1' , '--random-agent' , '--timeout=30' , '--retries=2' , '--threads=5' ] result = subprocess.run(cmd, capture_output = True , text = True , timeout = 180 ) return self .parse_sqlmap_output(result.stdout)
SQLMap Parameters: Never ask for user input, use default behavior
Crawl depth for finding injection points (default: 2)
Level of tests to perform (1-5, default: 1)
Risk of tests (1-3, default: 1 for safe testing)
Number of concurrent HTTP requests (default: 5)
SQL Injection Types Detected Boolean-based
Time-based
Error-based
UNION-based
Stacked queries
Uses boolean logic to infer database content through true/false responses. Example: id=1 AND 1=1 (true) vs id=1 AND 1=2 (false)
Uses database sleep functions to confirm vulnerability through response delays. Example: id=1 AND SLEEP(5)
Forces database errors to extract information from error messages. Example: id=1' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT(...)))
Uses UNION SQL operator to extract data from other tables. Example: id=1 UNION SELECT username,password FROM users
Executes multiple SQL statements separated by semicolons. Example: id=1; DROP TABLE users--
Vulnerability Severity Vulnerabilities are classified into four severity levels:
CVSS 9.0-10.0 Remote code execution, SQL injection with data exfiltration, authentication bypass
CVSS 7.0-8.9 XSS with session hijacking, privilege escalation, file upload vulnerabilities
CVSS 4.0-6.9 Information disclosure, CSRF, insecure direct object references
CVSS 0.1-3.9 Verbose error messages, outdated software, missing security headers
Complete Workflow def run_full_scan ( self ): """Execute complete vulnerability scanning workflow""" # 1. Identify web services if not self .web_ports: return { 'vulnerabilities' : [], 'web_vulnerabilities' : [], 'sql_vulnerabilities' : []} # 2. Scan each web service with Nikto for web_port in self .web_ports: nikto_vulns = self .scan_with_nikto(web_port[ 'url' ]) self .web_vulns.extend(nikto_vulns) # 3. Test for SQL injection for web_port in self .web_ports: sql_vulns = self .scan_sql_injection(web_port[ 'url' ]) self .sql_vulns.extend(sql_vulns) return { 'vulnerabilities' : self .vulnerabilities, 'web_vulnerabilities' : self .web_vulns, 'sql_vulnerabilities' : self .sql_vulns }
Usage Example from modules.vuln_scanner import VulnerabilityScanner from modules.scanner import Scanner # Get port scan results scanner = Scanner( "example.com" ) scan_results = scanner.run_full_scan() # Initialize vulnerability scanner vuln_scanner = VulnerabilityScanner( "example.com" , scan_results[ 'ports' ]) # Run vulnerability scan vulnerabilities = vuln_scanner.run_full_scan() print ( f "Web vulnerabilities: { len (vulnerabilities[ 'web_vulnerabilities' ]) } " ) print ( f "SQL injection points: { len (vulnerabilities[ 'sql_vulnerabilities' ]) } " )
{ "web_vulnerabilities" : [ { "type" : "web" , "url" : "http://example.com:80" , "severity" : "MEDIUM" , "description" : "Server leaks inodes via ETags" , "osvdb" : "3233" } ], "sql_vulnerabilities" : [ { "type" : "sql_injection" , "url" : "http://example.com/login.php?id=1" , "parameter" : "id" , "injection_type" : "boolean-based blind" , "payload" : "1 AND 1=1" , "severity" : "CRITICAL" } ] }
Skipping Web Scans Use the --skip-web CLI flag to disable web vulnerability scanning:
python3 main.py -t example.com --skip-web
Web vulnerability scanning can be time-intensive (10-30 minutes per service). Use --skip-web for faster reconnaissance-only scans.
Web Vulnerabilities Guide Detailed guide to web vulnerability scanning
Configuration Nikto and SQLMap timeout settings
CLI Options —skip-web flag documentation
PDF Reports How web vulnerabilities appear in reports