Create app.py

app.py

@@ -0,0 +1,67 @@
+import gradio as gr
+import requests
+
+SECURITY_HEADERS = [
+    "Content-Security-Policy",
+    "Strict-Transport-Security",
+    "X-Content-Type-Options",
+    "X-Frame-Options",
+    "X-XSS-Protection",
+    "Referrer-Policy",
+    "Permissions-Policy"
+]
+
+def scan_website(url):
+    if not url.startswith("http"):
+        url = "http://" + url
+
+    result = f"🔍 Scanning `{url}`...\n\n"
+
+    try:
+        response = requests.get(url, timeout=5)
+        headers = response.headers
+
+        # 1. Server and X-Powered-By headers
+        server = headers.get("Server", "Not disclosed")
+        powered_by = headers.get("X-Powered-By", "Not disclosed")
+
+        result += f"🖥️ Server: {server}\n"
+        result += f"⚙️ Powered By: {powered_by}\n\n"
+
+        # 2. HTTPS check
+        if url.startswith("https://"):
+            result += "✅ HTTPS is used.\n"
+        else:
+            result += "⚠️ Website does not use HTTPS.\n"
+
+        # 3. Security header checks
+        result += "\n🔐 Security Header Checks:\n"
+        for header in SECURITY_HEADERS:
+            if header in headers:
+                result += f"✅ {header}: Present\n"
+            else:
+                result += f"❌ {header}: Missing\n"
+
+        # 4. Cookie security
+        cookies = response.cookies
+        for cookie in cookies:
+            if not cookie.secure:
+                result += f"\n⚠️ Cookie `{cookie.name}` is not marked as Secure."
+            if "httponly" not in cookie._rest:
+                result += f"\n⚠️ Cookie `{cookie.name}` is not marked as HttpOnly."
+
+        return result.strip()
+
+    except requests.exceptions.RequestException as e:
+        return f"❌ Error: {str(e)}"
+
+iface = gr.Interface(
+    fn=scan_website,
+    inputs=gr.Textbox(label="Enter Website URL", placeholder="e.g. https://example.com"),
+    outputs=gr.Markdown(label="Vulnerability Report"),
+    title="🛡️ Website Vulnerability Scanner (Basic)",
+    description="Scans for basic web security issues like missing headers, insecure cookies, and exposed technologies."
+)
+
+if __name__ == "__main__":
+    iface.launch()