web-security-scanner 开源项目推荐（30 个）

stanislav-web /OpenDoor

OWASP 网络侦查与目录发现平台

edoardottt /csprecon

Discover new target domains using Content Security Policy

eldarshiraliyev /BugScanner

🐛 Advanced web vulnerability scanner with 5-rule false-positive reduction, WAF evasion, and modern HTML reports

Ammar-1993 /wavss

Automated web-based vulnerability scanner designed to identify common security flaws such as SQL Injection and XSS. WAVSS crawls websites, performs comprehensive scans, and generates detailed PDF reports with remediation guidance.

DrXOps /pentool

A modern, console-based web penetration testing toolkit with a TUI. Features an HTTP/HTTPS proxy, active/passive vulnerability scanner, Repeater, Intruder, Spider, and more. Free & open-source.

sylhetyhackvenger /SubOracle

SubOracle is an advanced subdomain intelligence and attack surface reconnaissance framework designed for security researchers and penetration testers. It helps identify digital assets, discover subdomains, analyze external footprints, and improve visibility of an organization's online infrastructure through structured reconnaissance workflow.

Tagoletta /AccessContextFuzzer

🛡️ Burp Suite extension for automated access control bypass, path traversal & Web Cache Deception testing. Header spoofing, URL encoding, cache deception pipelines – all in one tool.

b3n3d1ck /web-security-auditor

Audit keamanan web: masukkan URL, keluar rapor A-F berisi celah + cara perbaikinya. PHP, tanpa dependency.

himfatihoner /scaNNer

Single-binary, web-UI penetration-testing scan orchestrator — one Go binary drives ~34 modules (nmap, nuclei, wpscan, hydra, impacket, netexec…) into structured findings. Async & cancellable, with RBAC, 2FA, a VPN killswitch, an assets inventory and CSV/JSON/PDF reports.

sylhetyhackvenger /HeartBleed-Pro

Try it Now... Recon, VA, & Business Logic Scan in one powerhouse tool. Expose hidden risks and logic flaws others miss. Zero noise, 360° visibility.

RanaKhan77 /Website-Vulnerability-Scanner

Open-source website vulnerability scanner — deterministic, tool-based scanning across OWASP classes: XSS, SQLi, SSRF, subdomain takeover, WordPress, MCP & AI/LLM security, JS library SCA. CVSS-scored evidence, HTML/PDF reports, continuous monitoring. Zero AI, self-hosted, Docker.

davidjenner /Unicorn

🦄 All-in-one website intelligence tool. Replaces whois, whatmydns, wpscan & who.is in one free web app. Built for authorized security recon.

saalineo /blue.whale

1 bilion % sure you web app has so much issue and i can find it easily ...

LogicLune /Sentriq-AI

Sentriq AI — A local-first web security assessment toolkit for authorized SQL injection testing, authentication and access-control checks, Supabase/PostgreSQL auditing, and evidence-based security reports.

nichu42 /clearload

Stateless website privacy & security auditor. Scans for SSL/TLS encryption, cookies, trackers, and GDPR/ePrivacy compliance violations using Playwright.

moon0deva /Sentinel

Sentinel — Automated security assessment platform with local AI, CVE intelligence, and SOC monitoring. No API keys required.

pratik-khairnar-sec /BlindStrike

Time-Based & Boolean Blind SQL Injection Testing Framework — v7.0.0

b3n3d1ck /nightjar

A workspace for reviewing web security findings

alphanesh /Cyrasec

CYRASEC is a multi-engine web vulnerability scanner that combines tools like dirsearch and nuclei, using AI-assisted analysis to detect, prioritize, and report web security issues efficiently in one streamlined workflow.

nn0z /XSS-Scanner

XSS Injection Scanner is an automated security testing tool designed to detect Cross-Site Scripting (XSS) vulnerabilities in web applications