{"id":49911934,"url":"https://github.com/burakkaygusuz/web-security-scanner","last_synced_at":"2026-05-16T13:12:57.518Z","repository":{"id":307336493,"uuid":"1014288249","full_name":"burakkaygusuz/web-security-scanner","owner":"burakkaygusuz","description":"A Java-based web security browser, it detects common web vulnerabilities such as SQL Injection, XSS and sensitive information disclosure.","archived":false,"fork":false,"pushed_at":"2025-07-30T16:58:19.000Z","size":145,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-07-30T19:17:18.745Z","etag":null,"topics":["crawler","java","vulnerability-scanner","web-security","xss"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/burakkaygusuz.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-07-05T12:20:29.000Z","updated_at":"2025-07-30T16:58:17.000Z","dependencies_parsed_at":"2025-07-30T19:19:22.983Z","dependency_job_id":null,"html_url":"https://github.com/burakkaygusuz/web-security-scanner","commit_stats":null,"previous_names":["burakkaygusuz/web-security-scanner"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/burakkaygusuz/web-security-scanner","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/burakkaygusuz%2Fweb-security-scanner","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/burakkaygusuz%2Fweb-security-scanner/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/burakkaygusuz%2Fweb-security-scanner/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/burakkaygusuz%2Fweb-security-scanner/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/burakkaygusuz","download_url":"https://codeload.github.com/burakkaygusuz/web-security-scanner/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/burakkaygusuz%2Fweb-security-scanner/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33104054,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-16T04:41:52.686Z","status":"ssl_error","status_checked_at":"2026-05-16T04:41:52.009Z","response_time":115,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["crawler","java","vulnerability-scanner","web-security","xss"],"created_at":"2026-05-16T13:12:53.145Z","updated_at":"2026-05-16T13:12:57.505Z","avatar_url":"https://github.com/burakkaygusuz.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Web Security Scanner\n\n\nA comprehensive Java-based web security scanner designed to identify common web vulnerabilities such as SQL Injection, Cross-Site Scripting (XSS), CSRF vulnerabilities, and Sensitive Information Exposure. Built with Spring Boot for modularity and enterprise-grade features.\n\n## 🚀 Features\n\n- **SQL Injection Detection**: Identifies potential SQL injection vulnerabilities by injecting various payloads into URL parameters and forms\n- **Cross-Site Scripting (XSS) Detection**: Detects XSS vulnerabilities by injecting XSS payloads into URL parameters and checking for their reflection in the response\n- **CSRF Protection Testing**: Comprehensive CSRF token validation and same-site cookie testing\n- **Sensitive Information Exposure**: Scans web page content for patterns indicative of sensitive data like email addresses, phone numbers, SSNs, API keys, and credit card numbers\n- **Web Crawler**: Intelligent web crawler that navigates through the target website to discover and scan multiple pages\n- **Rate Limiting**: Built-in rate limiting to avoid overwhelming target servers\n- **Configurable Scanning**: Flexible configuration system for payloads, patterns, and scan settings\n- **Comprehensive Reporting**: Detailed vulnerability reports with color-coded output\n- **Database Integration**: Persistent storage of scan results using H2 database\n- **Spring Boot Architecture**: Enterprise-grade architecture with dependency injection and configuration management\n\n## 🛠️ Technologies Used\n\n- **Java 21**: Core programming language with modern features\n- **Spring Boot 3.2.0**: Enterprise application framework with dependency injection, configuration management, and auto-configuration\n- **Spring Data JPA**: Data persistence layer with H2 database\n- **Spring Boot Actuator**: Production-ready monitoring and management features\n- **Maven**: Project management and build automation tool\n- **OkHttp**: High-performance HTTP client for making requests\n- **JSoup**: HTML parsing and manipulation library\n- **JLine**: Advanced command-line interface interactions\n- **SLF4J + Logback**: Comprehensive logging framework\n- **Jackson**: JSON processing for configuration and reporting\n- **Resilience4j**: Rate limiting and fault tolerance\n- **JUnit 5**: Unit testing framework\n- **AssertJ**: Fluent assertion library for tests\n- **Mockito**: Mocking framework for unit tests\n\n## How to Build\n\nTo build the project, navigate to the root directory of the project and run the following Maven command:\n\n```bash\nmvn clean install\n```\n\n## How to Run\n\n**Important:** The scanner CLI is disabled by default for flexibility. To run the scanner from the command line, you must enable it by passing `-Dscanner.cli.enabled=true`.\n\nYou can run the scanner by providing a target URL as a command-line argument.\n\n**Example Usage:**\n\nTo scan a target website (e.g., `http://example.com`):\n\n```bash\nmvn spring-boot:run -Dspring-boot.run.arguments=\"http://example.com\" -Dscanner.cli.enabled=true\n```\n\nOr, after building the JAR:\n\n```bash\njava -jar target/web-security-scanner-\u003cversion\u003e.jar http://example.com --scanner.cli.enabled=true\n```\n\n**Exit Code Configuration:**\n\nBy default, the scanner always exits with code 0 (success) when the scan completes successfully, regardless of whether vulnerabilities are found. This allows the scanner to be used in CI/CD pipelines without failing the build based on vulnerability detection.\n\nTo make the scanner exit with a non-zero code when vulnerabilities are found (useful for security gates in CI/CD):\n\n```bash\n# Using Maven\nmvn spring-boot:run -Dspring-boot.run.arguments=\"http://example.com\" -Dspring-boot.run.jvmArguments=\"-Dscanner.cli.fail-on-vulnerabilities=true\" -Dscanner.cli.enabled=true\n\n# Using JAR\njava -jar target/web-security-scanner-\u003cversion\u003e.jar http://example.com --scanner.cli.enabled=true --scanner.cli.fail-on-vulnerabilities=true\n```\n\nWith `fail-on-vulnerabilities=true`:\n- Exit code 0: No vulnerabilities found\n- Exit code 1: Vulnerabilities found\n- Exit code 2: Scan error occurred\n\n**Testing with a Vulnerable Website:**\n\nFor testing purposes, you can use a known vulnerable website like `http://testphp.vulnweb.com/`. This will demonstrate the scanner's ability to detect various vulnerabilities.\n\n```bash\nmvn spring-boot:run -Dspring-boot.run.arguments=\"http://testphp.vulnweb.com\" -Dscanner.cli.enabled=true\n```\n\nor\n\n```bash\njava -jar target/web-security-scanner-\u003cversion\u003e.jar http://testphp.vulnweb.com --scanner.cli.enabled=true\n```\n\nThe scanner will output detected vulnerabilities directly to the console.\n\n## 📊 Configuration\n\nThe scanner uses Spring Boot's externalized configuration system. You can customize scanning behavior through:\n\n### Application Properties\n\n- **`application.yml`**: Main configuration file with default settings\n- **`application-test.yml`**: Test-specific configuration\n- **`scanner.cli.enabled`**: Enable/disable CLI mode (default: true)\n- **`scanner.cli.fail-on-vulnerabilities`**: Exit with non-zero code when vulnerabilities are found (default: false)\n\n### Configurable Settings\n\n- **SQL Injection Payloads**: Customize SQL injection test payloads\n- **XSS Payloads**: Configure XSS detection patterns\n- **Sensitive Data Patterns**: Regular expressions for detecting sensitive information\n- **Scan Settings**: Max depth, timeout, rate limiting\n- **CSRF Settings**: Token validation rules and cookie policies\n\n### Example Configuration\n\n```yaml\nscanner:\n  cli:\n    enabled: true\n    auto-shutdown: true\n    fail-on-vulnerabilities: false  # Set to true for CI/CD security gates\n  scanSettings:\n    maxDepth: 3\n    timeoutSeconds: 30\n    rateLimitRequestsPerSecond: 3\n  csrfSettings:\n    testForms: true\n    checkSameSiteCookies: true\n    minimumTokenLength: 16\n```\n\n## 🧪 Testing\n\nThe project includes comprehensive unit and integration tests.\n\n### Running Tests\n\n```bash\n# Run all tests\nmvn test\n\n# Run tests with specific profile\nmvn test -Dspring.profiles.active=test\n\n# Run specific test class\nmvn test -Dtest=ConfigLoaderTest\n\n# Run tests with coverage\nmvn test jacoco:report\n```\n\n### Test Coverage\n\n- **86 total tests** covering all major components\n- **Unit Tests**: Model classes, utilities, configuration\n- **Integration Tests**: Full application context, service layer\n- **Spring Boot Tests**: Configuration validation, dependency injection\n\n### Test Categories\n\n- **Configuration Tests**: Scanner configuration loading and validation\n- **Model Tests**: Vulnerability models, form data, CSRF scenarios\n- **Service Tests**: Report generation, data persistence\n- **Utility Tests**: URL utilities, helper functions\n- **Integration Tests**: End-to-end scanning workflows\n\n## 🔍 Spring Boot Features\n\n- **Externalized Configuration**: Flexible configuration through YAML/Properties files\n- **Dependency Injection**: Clean, testable architecture with Spring's IoC container\n- **Auto-Configuration**: Automatic setup of components based on classpath\n- **Actuator Endpoints**: Health checks, metrics, and monitoring\n- **Profile-Based Configuration**: Different settings for development, testing, and production\n- **Data Persistence**: JPA-based data access with H2 database\n- **Command Line Interface**: Optional CLI mode with JLine integration\n\n## Code Formatting\n\nThis project uses Google Java Format to maintain consistent code style.\n\n### Automatic Formatting\n\nCode is automatically formatted during the Maven build process. The formatter runs in the `process-sources` phase.\n\n### Manual Formatting\n\nTo manually format all Java files:\n\n```bash\nmvn com.spotify.fmt:fmt-maven-plugin:format\n```\n\n### Check Formatting\n\nTo check if all files are properly formatted without making changes:\n\n```bash\nmvn com.spotify.fmt:fmt-maven-plugin:check\n```\n\nThis command will fail if any files are not properly formatted, which is useful for CI/CD pipelines.\n\n### IDE Integration\n\nFor local development, it's recommended to install the Google Java Format plugin for your IDE:\n\n- **IntelliJ IDEA**: Install the \"google-java-format\" plugin\n- **Eclipse**: Install the Google Java Format plugin\n- **VS Code**: Install the \"Language Support for Java(TM) by Red Hat\" extension with Google Java Format support\n\n\n## 🛡️ Security Considerations\n\n- **Rate Limiting**: Built-in rate limiting prevents overwhelming target servers\n- **Configurable Timeouts**: Prevents hanging requests\n- **Responsible Disclosure**: Only scan systems you own or have explicit permission to test\n- **No Persistent Attacks**: The scanner performs read-only vulnerability detection\n\n## 📈 Performance\n\n- **Concurrent Scanning**: Multi-threaded scanning for improved performance\n- **Memory Efficient**: Streaming processing of large responses\n- **Configurable Limits**: Adjustable depth and timeout settings\n- **Connection Pooling**: Efficient HTTP connection management\n\n## 📝 License\n\nThis project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.\n\n## ⚠️ Legal Disclaimer\n\nThis tool is intended for educational and authorized security testing purposes only. Users are responsible for ensuring they have proper authorization before scanning any systems. The developers are not responsible for any misuse of this tool.\n\n## 📞 Support\n\nFor questions, issues, or contributions:\n\n- 🐛 [Report Issues](https://github.com/burakkaygusuz/web-security-scanner/issues)\n- 💬 [Discussions](https://github.com/burakkaygusuz/web-security-scanner/discussions)\n- 🔄 [Pull Requests](https://github.com/burakkaygusuz/web-security-scanner/pulls)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fburakkaygusuz%2Fweb-security-scanner","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fburakkaygusuz%2Fweb-security-scanner","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fburakkaygusuz%2Fweb-security-scanner/lists"}