wscan - Wscan is a web security scanner that focuses on w

项目说明

中文

wscan

A web security scanner for authorized security testing. Use the WebUI for the fastest start, or use the CLI for repeatable scans and automation.

> ⚠️ Authorization required: Only scan systems you own or are explicitly authorized to test. Passive mode also captures traffic sent through the configured proxy. Define a target scope before starting, and ne unrelated traffic through a passive task. See the License before use.

What you can do

and security issues covered

wscan focuses on common Web application and security misconfigurations. A co depends on the selected plugins, request data, authentication state, target behavior, and scan mode. The main categories include:

A finding is a lead for review, not automatically proof of impact. Confirm important findings manually within the authorized scope, especially checks in acti, authentication, file uploads, SSRF, or blind callbacks.

Quick start: WebUI

1. Start the WebUI

Download a release from Releases, or build the binary from this repository. Then run:

Open < in your browser. Use 0.0.0.0 only when the WebUI must be reachable from another machine, and protect the host with your network controls.

2. Create an active scan

1. Open New Scan.
2. Keep Active scan selected.
3. Enter an authorized target URL, such as .
4. Select a sa or configure the crawler and scope.
5. Choose Crawl + Scan, Crawl only, or Scan only.
6. Open the task to watch progress, pages, technologies, and .

Use Dynamic for Ja applications. Use Static for a faster HTML crawl.

3. Create a passive scan

Passive mode listens on a local MITM proxy and does not crawl the target itself.

1. Open New Scan and select Passi.
2. Enter the Scan target URL. This target defines the allowed host/path scope.
3. Keep the default proxy address, 127.0.0.1:7100, or choose another a address.
4. Select the plugins and scope you want to use.
5. Click Start listener.
6. Configure the authorized browser or client to use the displayed proxy address.
7. Install the generated project CA certificate (ca.crt) in that browser or client.
8. Browse the authorized target through the proxy.
9. Review traffic and findings in the task, then click Stop when finished.

The passive task requires a scan target so traffic to unrelated hosts is rejected. Do not use a passi as a general-purpose browser proxy.

Generate the CA when needed:

The CA private key (ca.key) is sensitive. Do not upload it or share it.

and exporting results

CLI quick reference

The CLI is useful for scripts, CI jobs, and reproducible scans. The command is ws or webscan.

Acti

CLI passive scan

Configure the browser/client proxy and CA as described in the WebUI passi section. Use the configured mitm.restriction in config.yaml to enforce hostname, path, port, and parameter restrictions for CLI passi.

Targets, scope, authentication, and proxy

For repeatable WebUI use, sa with their include/exclude patterns and authentication settings before launching a task.

Example upstream proxy configuration:

POC templates and custom plugins

POC templates are not bundled. If your authorized engagement requires them, point the POC option at a local Nuclei/Xray/Goby-compatible template directory:

Ad authoring references:

AI automated pentest

From the WebUI, create an AI Pentest project, enter an authorized target origin and a concrete goal, choose a worker, and start the project. The UI streams the agent's progress, tool calls, discovered facts, and findings.

Use a narrowly defined target and goal. Review every generated action and finding before treating it as a confirmed result. The local Claude Code worker requires the claude command to be a and authenticated; the rule-based worker can run without an LLM.

Reverse platform for blind callbacks

Start the reverse platform when an authorized test needs an external callback to confirm a blind :

See Best Practices for deployment and callback configuration.

MCP server

Expose task and scan operations to an authorized MCP client:

Do not expose the MCP or WebUI ports publicly without authentication and network access controls.

Configuration and troubleshooting

Best practices

License

See LICENSE.md.

项目信息

开发语言：Go

Star 数：714

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕 Wscan is a web security scanner that focuses on web security, dedicated to making web security accessible to everyone.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。