项目说明
WAVSS: Web Application Scanner System
O
WAVSS is a comprehensi web-based scanner designed to help de, cybersecurity professionals, and website owners identify common security in web applications. The system performs web crawling, scans for such as SQL Injection and Cross-Site Scripting (XSS), and generates detailed, actionable PDF reports. These reports are delivered directly to users to facilitate proacti management.
---
Features
Automated Web Crawling: Efficiently maps the target website by collecting all accessible URLs for thorough scanning.
Multi- Scanning: Detects a of common web including SQL Injection, XSS, Directory Listing, and more.
Real-Time Scan Updates: Provides li updates during crawling and scanning processes.
User Management: Supports guest users with limited access and registered users with full scanning capabilities.
Detailed Reporting: Generates comprehensive PDF reports summarizing findings, descriptions, remediation steps, and scan metrics.
Email Delivery: Automatically sends generated reports to the registered user’s email for easy access and record keeping.
Scan History: Maintains a history of scans allowing users to review past results and download previous reports.
---
Technology Stack
Frontend: HTML, CSS, Ja (for dynamic, user-friendly interfaces)
Backend: PHP (handles crawling, scanning logic, and report generation)
Database: MySQL (stores user data, scan results, and details)
Libraries: TCPDF (PDF generation), SimpleHTMLDOM (HTML parsing)
---
System Workflow
1. User inputs target URL to be scanned.
2. Crawler module collects all URLs within the target domain.
3. User selects scan options to specify which to test.
4. Scanner module performs dynamic testing on collected URLs.
5. System aggregates scan results and generates a detailed PDF report.
6. Report is emailed automatically to the user.
7. Scan history is saved for future review and report download.
---
Installation & Setup
1. Ensure you have a web server with PHP and MySQL support (e.g., XAMPP).
2. Import the provided SQL database schema (wa.sql) into your MySQL server.
3. Place the project files in your web server’s root directory.
4. Configure database connection parameters in the relevant PHP configuration file (test_db.php or similar).
5. Access the application via your browser to register and start scanning.
---
Usage
Register a new account or log in if you already have one.
Na to the crawler interface to input the target website URL.
Start crawling to collect URLs and wait for the process to complete.
Choose specific to scan or proceed with the default selection.
Initiate the scanning process and monitor progress in real-time.
After completion, view the generated report online or download it.
Reports are automatically sent to your registered email for con.
Review past scans and reports in the scan history section.
---
Implemented Features (Phases 0 - 6)
The WA has undergone a massi and security o across se phases:
Phase 0 & 1: Security Foundation & Code Quality
Robust Authentication: Argon2id password hashing with backward-compatible legacy upgrades, plus TOTP-based Two-Factor Authentication (2FA).
Core App Security: Comprehensi of SQL Injection Prepared Statements, XSS sanitization, and cryptographically secure CSRF tokens on all state-changing endpoints.
Abuse Pre: Rate limiting, acti concurrency locks, and mandatory Domain Ownership via DNS/TXT to prevent unauthorized external scanning.
Modern Standards: Complete integration of Composer dependency management, Monolog rotating logs, and PHP-CS-Fixer styling enforcement.
Phase 2 & 3: Testing & CI/CD Stability
Automated : Full PHPUnit test co for core business logic.
Dockerization: Fully containerized ecosystem (Apache/PHP 8.2 + MariaDB) with automated schema seeding and health checks.
Continuous Integration: GitHub Actions pipeline running strict PHP syntax linting, unit tests, and deterministic End-to-End (E2E) automated regression scans against an internal target on every commit.
Phase 4 & 5: Modern Architecture & Core Modules
True Background Queue: Asynchronous job processing powered by a dedicated CLI worker daemon, replacing fragile HTTP self-triggering loops.
Headless REST API: Fully authenticated endpoints (/scan, /status, /report) supporting automated CI/CD triggering and dynamic output formatting (JSON, HTML, PDF).
AI-Assisted Triage: Optional Gemini LLM integration to analyze scan findings, e confidence scores, and append plain-language explanations.
Data & Scheduling: Client-side Chart.js dashboards for tracking historical trends, alongside an integrated cron-dri for recurring scans.
Expanded Test Suite: Added acti for Missing Security Headers and Sensitive File Exposure (e.g., .env, .git), featuring strict content signature .
Phase 6: Final Review & Integration
Module Acti: Fully activated the pre orphaned Security Headers and Sensitive File Exposure detection modules across the Web UI, Cron Scheduler, and REST API.
2FA Stability: Hardened the TOTP Two-Factor Authentication enrollment flow by ensuring all necessary cryptographic and image-generation libraries (PHP GD) are strictly enforced at the container level.
Future Enhancements
Real-time threat intelligence feed integration.
*Note on Blind SQL Injection:* While the scanner detects error-based SQL Injection, automated detection of Blind/Time-based SQL Injection was intentionally excluded from manual implementation in this tool to prevent the generation of functional exploitation payloads (like SLEEP() commands) that can cause unintended denial-of-service on target servers. For testing Blind SQLi, we recommend using specialized open-source tools such as sqlmap under controlled conditions.
---
License
This project is currently private. Please contact the maintainer for licensing inquiries.
---
Contact
For any questions, feedback, or support, please contact:
Ammar-1993
WhatsApp: Click here
Gmail: Click here
---
Thank you for using WAVSS — helping you secure your web applications efficiently and effectively!
项目信息
开发语言：PHP
Star 数：8
技术要点
该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Automated web-based vulnerability scanner designed to identify common security flaws such as SQL Injection and XSS. WAVSS crawls websites, performs comprehensive scans, and generates detailed PDF reports with remediation guidance.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。
从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。
使用与学习建议
1. 下载源码压缩包，解压到本地环境。
2. 根据项目类型准备对应的运行环境与依赖。
3. 按照 README 中的步骤完成配置与部署。
4. 在隔离的测试环境中运行验证，避免影响生产系统。
免责声明
本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。