waymap - Waymap is a fast and optimized web vulnerability s

项目说明

<p align="center">
<img src="logo.png" alt="Waymap Logo" width="400">
</p>

<h1 align="center">Waymap v8.2.1 - Web Scanner & Security Toolkit</h1>

<p align="center">
<a href=" src=" alt="PyPI "></a>
<a href=" src=" alt="Python "></a>
<a href=" src=" alt="License"></a>
<a href=" src=" alt="PyPI Downloads"></a>
</p>

<p align="center">
<a href=" src=" alt="GitHub Stars"></a>
<a href=" src=" alt="GitHub Forks"></a>
<a href=" src=" alt="GitHub Issues"></a>
<a href=" src=" alt="Last Commit"></a>
</p>

<p align="center">
<a href=" src=" alt="Repo Size"></a>
<a href=" src=" alt="Latest Release"></a>
<a href=""><img src="
</p>

---

Author: Trix Cyrus (Vicky) | License: GPLv3

Waymap is a fast, practical web scanner for authorized security testing. It automates SQLi, XSS, command injection, SSTI, LFI, CORS, CRLF, open redirect, API, recon, misconfiguration, and WordPress checks - with session-based results, multi-threading, crawling, authentication, reporting, Google dork discovery, and AI-powered analysis.

---

What’s New in v8.2.1

Bug Fixes

Debian Packaging: Fixed Debian package installation issues

- Remo from setup.py to fix import errors
- Remo dependencies (python3-fpdf, python3-selectolax)
- Added py3dist-o for Python package mapping
- Fixed build script to work from any directory
- Simplified packaging to use setup.py for data files

Kali Linux Compatibility: Package now builds and installs correctly on Kali Linux

---

What’s New in v8.2.0

Features & Optimizations

Consolidated WordPress Scan: Rebuilt the WordPress profile scanner into a modular core scanning engine. Added 7 new security checks including WP-Cron, exposed debug.log / install.php, author user enumeration, REST namespace audits, directory listings, and login page .

Intelligent Scan Skipping: All scanners (SQLi, XSS, CMDi, LFI, SSTI, CRLF, CORS, Open Redirect, WordPress, Recon) check if a target parameter or URL has already been found in previous runs, skipping repetiti.

SerpApi Target Discovery: Switched Google dorking from SearchAPI to SerpApi for impro, added credit-conserving cached queries, and implemented the --page parameter to control result page depth.

Package Footprint Optimization: Removed over 2 MB of unused wordlists, reducing final installation size by over 90%.

---

What’s New in v8.1.1

Optimized Acti

No More Redundant Directory Fuzzing: Remo brute-force checks for Admin Panels (~140 paths), Backup Files (~810 paths), and Exposed Configs (~50 paths) from the reconnaissance engine, a duplicates with dedicated modules (misconfig and auth-logic). This saves over 1000 slow, synchronous requests.

Enhanced Swagger & GraphQL detection: Maintained lightweight API discovery probes and updated the scanner summary output to directly list identified Swagger/OpenAPI and GraphQL endpoints.

Enhanced SSTI Scan & Engine Detection

Detailed Engine Signatures: Added comprehensi signatures for template engines.

False Positi: Incorporated timing baseline and content techniques.

Scanner Module Hardening

Impro and security checks across CORS, CRLF, LFI, and Open Redirect scan modules.

Bug Fix: Restored missing exit_clean import in prompt_line() to fix interactive UI Ctrl+C handlers.

---

What’s New in v8.0.0

AI/LLM Integration (Major Release)

AI-Powered Analysis:

AI Adapti Generation - Uses LLMs to generate context-aware, WAF-e payloads for SQLi, XSS, CMDi, and other injection attacks

AI False Positi - Analyzes findings with AI to reduce false positives and provide confidence scores

AI Attack Surface Discovery - Le AI to disco endpoints, parameters, and attack from HTML/Ja

AI Crawler Enhancer - Extracts hidden URLs and API endpoints using AI analysis of page content

AI Result Analysis - Provides detailed se justification, impact assessment, and remediation steps for findings

AI Chain Analysis - Identifies potential chains that could lead to more severe exploits

Supported LLM Pro:

Groq (default, fastest) - llama-4-scout, compound, compound-mini models

Cerebras - gpt-oss-120b, zai-glm-4.7, gemma-4-31b

OpenAI - GPT-5.5, GPT-5, GPT-5 mini, GPT-5 nano

Anthropic - Claude Opus 4.8, Claude Sonnet 5, Claude Haiku 4.5

Ollama - Local models (llama3.1, etc.)

NVIDIA - nemotron-3-super-120b-a12b

AI Usage:

Architecture Impro

Event Bus System:

New e architecture for finding events

Real-time finding emission to subscribers

Impro tracking and reporting

Reconnaissance Intelligence Engine:

Passi (subdomain enumeration, technology detection)

Cheap acti (robots.txt, sitemap.xml, meta tags)

Deep acti (admin panel discovery, WAF detection)

Comprehensi reporting

Fingerprint Engine:

Intelligent request deduplication

Pattern-based URL normalization

Reduced redundant scanning

Enhanced HTTP Layer:

Retry logic with exponential backoff

Connection pooling optimization

Persistent keep-ali

Impro handling

Scanner Impro

XSS Scanner:

Fixed URL filtering for parameterized URLs

Impro logic

Enhanced DOM XSS detection

Better confidence scoring

SQLi Scanner:

Added support for new SQLi techniques: Union-Based, Stacked-Queries, and Inline-Query injections

Added Database Enumeration support (database extraction engine)

Impro injection accuracy

Better baseline timing for time-based SQLi

Enhanced error detection patterns

Fixed boolean SQLi parameter handling

Crawler & Discovery Engine:

Impro efficiency and high-speed page discovery

Better target parameter extraction and deduplication mapping

General Impro:

Fixed confidence/se string-to-float con

Enhanced admin panel discovery and display

Impro manager event emission

Better session management

Enhanced reporting capabilities

Performance & Reliability

Fixed thread pools - No adapti, consistent performance

Improved rate limiting - Better handling of API rate limits

Enhanced error handling - More robust error recovery

Better logging - Impro and error messages

---

Installation

installation:

---

Quick Start

---

CLI Reference

Target

| Flag | Short | Description |
|------|-------|-------------|
| --target | -t | Single target URL |
| --multi-target | -mt | File with one URL per line |

Scan Configuration

| Flag | Short | Description |
|------|-------|-------------|
| --scan | -s | Scan type (see Scan Types) |
| --crawl | -c | Crawl depth 0–10 (finds parameterized URLs) |
| --technique | -k | SQLi techniques: B boolean, E error, T time, U union, I inline, S stacked (e.g. BETUIS) |
| --profile | -p | Scan profile: wordpress |
| --threads | | Worker threads (default: 1, max: 10) |
| --no-prompt | | Skip interacti (CI/automation) |
| -- | -v | output |

Utilities

| Flag | Description |
|------|-------------|
| --check-waf | Detect WAF on --target |
| --waf URL | Detect WAF on a specific URL |
| --check-updates | Check GitHub for new |
| -- | Print and exit |

Reporting

| Flag | Description |
|------|-------------|
| --report-format | Comma-separated: html, csv, markdown, pdf |
| --output-dir | Report output directory (default: reports) |

Authentication

| Flag | Short | Description |
|------|-------|-------------|
| --auth-type | | form, basic, digest, bearer, api_key |
| --auth-url | | Login URL (form auth) |
| --username | -u | Username |
| --password | -pw | Password |
| --token | | Bearer token or API key |
| --auth-header | | API key header name (default: X-API-Key) |

API Scanning

| Flag | Description |
|------|-------------|
| --api-type | rest (default) or graphql |
| --api-endpoints | Comma-separated REST paths (e.g. /users,/login) |

Discovery (SerpApi)

| Flag | Description |
|------|-------------|
| --dork | Google dork query |
| --dork-api-key | SerpApi key (or SERPAPI_API_KEY env) |
| --dork-output | Sa URLs to file |

WPScan

| Flag | Description |
|------|-------------|
| --wpscan-token | WPScan API token (or WPSCAN_API_TOKEN env) |

---

Scan Types

Use with --scan / -s:

| Scan | Description |
|------|-------------|
| sqli | SQL injection (boolean, error, time-based) |
| xss | Context-aware cross-site scripting |
| cmdi | Commix-style command injection (result, eval, blind time) |
| ssti | Ser template injection |
| lfi | Local file inclusion |
| open-redirect | Open redirect |
| crlf | CRLF / header injection |
| cors | CORS misconfiguration |
| api | REST or GraphQL API security |
| all | Run every standard scan |
| recon | Technology fingerprinting, sitemap, DNS, buckets |
| misconfig | Security headers, admin panels, sensiti |
| redirect | Host header injection, redirect, CRLF |
| injection-ad | SSRF, XXE, HPP, NoSQL, prototype pollution, etc. |
| graphql-suite | GraphQL introspection, batching, depth checks |
| auth-logic | IDOR, JWT, OAuth, access control signals |
| cache-smuggling | Cache poisoning, HTTP desync indicators |
| wordpress-extras | WP user enum, xmlrpc, readme exposure |
| optional | WebSocket, extended WAF, redirect chains |

---

Usage Examples

Basic scans

Each command below can be combined with --threads N, --no-prompt, and -v / --.

Crawling + scanning

When the target has no query parameters, use --crawl to disco URLs first.

Multi-threading combinations

Full / comprehensi

Multi-target scanning

API security testing

Authentication + scanning

WordPress

Google dork discovery

WAF detection

Reporting combinations

Recommended real-world combinations

---

Configuration

Secrets file

Create config/waymap/secrets.json:

En (o secrets file):

| | Used by |
|----------|---------|
| SERPAPI_API_KEY | --dork discovery |
| WPSCAN_API_TOKEN | --profile wordpress |
| WAYMAP_NO_PROMPT | Set automatically with --no-prompt |

Domain blacklist (dork discovery)

Edit config/waymap/domain_blacklist.txt - one domain per line.

Payloads & wordlists

Located in data/ (e.g. lfipayload.txt, sstipayload.txt). XSS and CMDi payloads are generated from their scanner logic.

---

Results & Output

All findings are saved per domain:

Reports (when --report-format is set) are written to --output-dir (default: reports/).

Result structure:

---

Project Structure

---

Requirements

Python 3.8+

See requirements.txt for packages (requests, beautifulsoup4, defusedxml, etc.)

---

Help & Updates

---

Legal / Disclaimer

Waymap is intended for authorized security testing and educational use only. Only scan systems you own or ha permission to test. The authors are not responsible for misuse.

---

Support

Issues:

---

Changelog Summary

| | Highlights |
|---------|------------|
| 8.1.1 | Hotfix: Restored missing exit_clean import in prompt_line() |
| 8.1.0 | Optimized Acti (remo fuzzing), Enhanced SSTI scan & engine detection, scanner module hardening |
| 8.0.0 | AI integration, Union/Stacked/Inline SQLi techniques, Database Enumeration support, Crawler impro and many more |
| 7.2.1 | Thread-safe results, SQLi/CMDi/CRLF fixes, defusedxml, Windows UI fix, report loading fix |
| 7.2.0 | Google dork discovery, WPScan profile, secrets management |
| 7.1.0 | API scanning, auth support, HTML/CS/PDF reports |

!Views

项目信息

开发语言：Python

Star 数：131

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Waymap is a fast and optimized web vulnerability scanner built for penetration testers. It helps in identifying vulnerabilities by testing against various payloads.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。