security_audit_tool - Python security scanner for websites & APIs. Defen

项目说明

🔒 Security Audit Tool

> One command to audit your website, API, or server. Built for business owners who care about security.

Python security scanner with defensi + acti mode. Find , test performance, and generate professional reports for your business.

A Python-based security assessment tool that helps you identify , performance issues, and security misconfigurations in your own systems. Perfect for business owners, de, and DevOps teams who want to proactively secure their infrastructure.

⚠️ Legal Notice

For authorized security testing only. Use exclusively on:

Unauthorized scanning may laws. By using this tool, you confirm proper authorization.

---

🚀 What This Tool Does

This tool performs two types of security assessments:

1. Defensi Checks (Safe)

2. Acti Checks (Sends Traffic)

---

💡 Perfect For

| Use Case | What You Get |
|----------|--------------|
| Business Owner | Know if your website has security holes |
| De | Find secrets in code before committing |
| DevOps/SRE | Test if your servers can handle traffic spikes |
| Security Team | Quick first-line assessment |
| Compliance | Generate audit reports for security reviews |

---

🛠️ Quick Start (5 minutes)

1. Install

2. Run Your First Scan

Interactive Mode (Easiest) - Just run with no arguments:

The TUI will guide you through target selection, scan mode, and reporting.

Command Line Mode:

This creates:

3. View Results

---

📋 Common Commands

Basic Scanning

Account Commands

Token storage:

Pentest Mode (Acti)

⚠️ Pentest features send actual traffic to your target. Only use on your own systems.

---

🔍 What Gets Checked

By Default (Safe, Read-Only)

With --full-scan

With --pentest-mode

---

🔬 Security Checks Reference

| Check ID | Category | Description | Default |
|----------|----------|-------------|---------|
| permissions | Read-Only | File/directory permissions (world-writable, SUID/SGID) | ✅ Enabled |
| services | Read-Only | Running service and port enumeration | ✅ Enabled |
| firewall | Read-Only | Firewall status and configuration | ✅ Enabled |
| hardening | Read-Only | OS hardening indicator checks | ✅ Enabled |
| secrets | Read-Only | Hardcoded secrets and credential patterns | ✅ Enabled |
| dependencies | Read-Only | Outdated and dependencies | ✅ Enabled |
| containers | Read-Only | Docker/container security configuration | ✅ Enabled |
| webapp_config | Read-Only | Web application configuration checks | ✅ Enabled |
| tls | Read-Only | TLS/SSL certificate inspection | ⚠️ --enable-tls-checks |
| performance | Active | Response time measurement | ⚠️ --enable-performance-test |
| | Active | SQL injection, XSS tests | ⚠️ --enable- |
| load_test | Active | DDoS simulation (intensive) | ⚠️ --pentest-mode only |

Use with --skip-checks or --only-checks:

---

📊 Output Formats

| Format | File Extension | Use Case |
|--------|---------------|----------|
| Terminal | - | Quick review during de |
| HTML | .html | Share with team, management, compliance |
| JSON | .json | CI/CD integration, automation, archiving |
| PDF | .pdf | Formal documentation, offline review |

---

🏗️ For De (Architecture)

Want to extend the tool? Here's how it's structured:

Adding a New Check

1. Create app/checks/my_check.py
2. Inherit from BaseCheck
3. Implement run() method
4. Register in app/checks/__init__.py

Running Tests

---

📚 Documentation

| Document | What's Inside |
|----------|---------------|
| docs/RUN.md | How to install and run the tool |
| docs/COMMANDS.md | All a commands and examples |
| docs/PENTEST.md | Pentest mode guide for acti |
| docs/FEATURES.md | Feature list and what each check does |
| docs/ARCHITECTURE.md | Code structure for de |
| docs/TROUBLESHOOTING.md | Common issues and solutions |

---

🔐 Safety Features

1. Explicit Scope Required - Tool won't run without defined targets
2. Authorization Prompt - Legal confirmation required
3. Rate Limiting - Built-in request throttling
4. Read-Only by Default - No modifications to target systems
5. Opt-in Acti - Pentest features must be explicitly enabled
6. Auditable - All actions logged

---

📝 CI/CD Integration

---

🎯 Roadmap

---

🤝 Contributing

Contributions welcome! Please ensure:
1. All checks are defensive and non-destructive by default
2. Code includes type hints
3. Tests included for new functionality
4. Documentation updated

---

📄 License

MIT License - See LICENSE file for details.

---

Built with ❤️ for business owners who take security seriously.

Got questions? Open an issue or check the docs/ folder.

项目信息

开发语言：Python

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Python security scanner for websites & APIs. Defensive checks (permissions, secrets, dependencies) + active pentest mode (SQLi, XSS, load testing). Generate HTML/JSON reports for your business security audits.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。