- **admin_panel_scanner.py** (Admin Panel & Dashboard Scanner): admin_panel_scanner.py — Admin Panel & Exposed Dashboard Scanner ================================================================ Probes a targeted wordlist of admin, monitoring, and developer dashboards that are often left exposed. More targeted than the generic directory scanner.
- **ai_remediation_scanner.py** (AI Remediation Generator): ai_remediation_scanner.py — AI-Powered Remediation Generator ============================================================= Post-processes all accumulated scan findings and generates: 1. Prioritized remediation plan (by CVSS score + exploitability) 2. Contextual, stack-aware fix guidance (detects PHP/Node/Python/Java) 3. Estimated fix effort (hours) per vulnerability 4. Executive risk summary 5. Code snippet examples for common fixes  This scanner should run LAST in the pipeline (it reads other scanners' findings from the shared in-memory log). In pipeline runs it reads from BaseScanner.all_vulns injected via the orchestrator. In standalone mode it reads the JSON report.  Optionally uses OpenAI API if OPENAI_API_KEY is set in environment.
- **api_scanner.py** (API & GraphQL Introspection Scanner): API & GraphQL Introspection Scanner
- **attack_surface_scanner.py** (Attack Surface Mapper): attack_surface_scanner.py — Attack Surface Mapper ================================================== Enumerates and maps the full attack surface of a web application: - All discovered endpoints / routes - Query parameters and form fields across all pages - External domains and third-party scripts - API endpoints (REST / GraphQL hints) - Admin / sensitive paths - File upload endpoints - Technology stack identified - Email addresses / internal references exposed
- **auth_scanner.py** (Authentication Security Scanner): auth_scanner.py — Authentication Security Scanner ================================================== Audits the authentication surface of a web application: - Login form detection & HTTPS enforcement - Default / weak credential testing (safe probes only) - Brute-force protection (account lockout detection) - Multi-Factor Authentication presence hints - Password policy exposure via error messages - Username enumeration via timing / response differences - Auth bypass via HTTP verb tampering
- **blind_xss_scanner.py** (Blind XSS (Out-of-Band) Scanner): Blind XSS (Out-of-Band) Scanner
- **broken_link_scanner.py** (Broken Link Hijacking Scanner): broken_link_scanner.py — Broken Link Hijacking Scanner
- **business_logic_scanner.py** (Business Logic Vulnerability Scanner): business_logic_scanner.py — Business Logic Vulnerability Scanner ================================================================ Advanced business logic flaw detection module.  This scanner: 1. Tests for coupon abuse and discount manipulation 2. Detects privilege escalation through business logic 3. Tests for payment bypass and price manipulation 4. Checks for workflow bypass vulnerabilities 5. Tests for parameter tampering in business processes 6. Detects race conditions in business transactions
- **bypass_403_scanner.py** (403/401 Bypass Scanner): bypass_403_scanner.py — 403/401 Bypass Scanner ================================================ Attempts to bypass access-denied responses using URL encoding tricks, path normalization, header manipulation, and method switching.
- **cache_control_scanner.py** (Browser Cache Control Scanner): cache_control_scanner.py — Browser Cache Control Scanner
- **cache_poisoning_scanner.py** (Web Cache Poisoning Scanner): cache_poisoning_scanner.py — Web Cache Poisoning Scanner ========================================================= Tests whether unkeyed HTTP headers (X-Forwarded-Host, X-Original-URL, X-Rewrite-URL) are reflected in the response, enabling CDN/reverse-proxy cache poisoning.
- **cert_transparency_scanner.py** (Certificate Transparency Scanner): cert_transparency_scanner.py — Certificate Transparency Scanner
- **clickjacking_scanner.py** (Clickjacking Vulnerability Scanner): clickjacking_scanner.py — Clickjacking Vulnerability Scanner ============================================================= Detects clickjacking vulnerabilities through multiple vectors: - X-Frame-Options header (DENY / SAMEORIGIN / ALLOWFROM) - CSP frame-ancestors directive - JavaScript framebusting code detection - Attempts to verify if the page can actually be framed - Scores the overall clickjacking protection level
- **cloud_scanner.py** (Cloud Storage Enumerator (S3/Azure/GCP)): Cloud Storage Enumerator (S3/Azure/GCP)
- **cms_scanner.py** (CMS Security Scanner): cms_scanner.py — CMS Detection & Vulnerability Scanner ======================================================= Detects popular CMS platforms (WordPress, Drupal, Joomla) and checks for exposed admin panels, sensitive endpoints (xmlrpc.php), and known fingerprints.
- **command_injection_scanner.py** (OS Command Injection Scanner): command_injection_scanner.py — OS Command Injection Scanner ============================================================ Expert-grade active detection (GAP-005 fix): 1. GET query parameter injection (reflection-based) 2. POST form parameter injection 3. HTTP header injection (User-Agent, Referer, X-Forwarded-For) 4. Blind timing-based detection (sleep 5 — no output needed) 5. Windows + Linux payloads 6. OOB DNS/HTTP callback marker (for future Interactsh integration)
- **compliance_scanner.py** (Security Compliance & Standards Scanner): compliance_scanner.py — Security Compliance & Standards Checker ================================================================ Audits the target against major compliance frameworks: - OWASP Top 10 (2021) - PCI-DSS v4.0 (relevant subset) - GDPR / Privacy - HIPAA (technical safeguards subset) - SOC 2 Type II (relevant technical controls)  Generates a compliance score and per-framework gap report. Note: This is an automated scan — manual verification is required for full compliance certification.
- **cookie_scanner.py** (Cookie Security Auditor): cookie_scanner.py — Cookie Security Flags Auditor ================================================== Performs a deep audit of all Set-Cookie headers across the site: - Secure flag (absent on HTTPS) - HttpOnly flag (missing XSS protection) - SameSite attribute (None / Lax / Strict / absent) - __Host- / __Secure- prefix compliance - Excessive cookie lifetime (> 1 year) - Sensitive names without protection - Cookie scoping (Domain= too broad) - Path= attribute
- **cors_scanner.py** (CORS Misconfiguration Scanner): cors_scanner.py — Tests for CORS (Cross-Origin Resource Sharing) misconfigurations. No external dependencies required.
- **crlf_scanner.py** (CRLF Injection Scanner): crlf_scanner.py — CRLF Injection / HTTP Response Splitting ============================================================ Expert-grade rewrite (GAP-007 fix): 1. Path-based injection (original + 5 new payloads) 2. Query parameter injection 3. Unicode/double-encoded CRLF bypass variants 4. Cookie injection via Location header chain 5. Response splitting (Set-Cookie + HTTP/1.1 200 OK injection) 6. Redirect parameter injection (common real-world vector)
- **csp_scanner.py** (Content Security Policy (CSP) Auditor): csp_scanner.py — Content Security Policy (CSP) Deep Auditor ============================================================ Parses and analyses the Content-Security-Policy (and CSP-Report-Only) header: - Detects missing CSP entirely - Flags unsafe-inline / unsafe-eval in script-src - Flags wildcard (*) sources - Detects missing critical directives - Identifies CSP bypass vectors (data:, blob:, http: schemes) - Checks for report-uri / report-to configuration - Scores overall CSP strength
- **csrf_scanner.py** (CSRF Vulnerability Scanner): csrf_scanner.py — Cross-Site Request Forgery (CSRF) Scanner ============================================================ Detects CSRF vulnerabilities by: 1. Discovering all HTML forms via crawler 2. Checking for CSRF tokens in form fields and custom request headers 3. Verifying SameSite cookie attributes 4. Submitting forms without CSRF tokens to see if the server rejects them 5. Checking Content-Type validation on state-changing endpoints  OWASP Top 10: A01:2021 — CVSS 8.8
- **csti_scanner.py** (Client-Side Template Injection (CSTI) Scanner): csti_scanner.py — Client-Side Template Injection (CSTI) Scanner =============================================================== Distinct from SSTI (server-side). CSTI targets AngularJS/Vue sandbox escapes that execute entirely in the browser — the server never sees the payload. Detects AngularJS ng-app scope, Vue template markers, and reflected template expression delimiters in the response.
- **custom_website_scanner.py** (Custom Website Analysis): custom_website_scanner.py — Custom website analysis using Requests + BeautifulSoup. Performs deep HTML analysis, form detection, link extraction, and content analysis.
- **cve_scanner.py** (Known Exploits & CVE Signature Scanner): Known Exploits & CVE Signature Scanner
- **dependency_scanner.py** (Dependency Vulnerability Scanner): dependency_scanner.py — JavaScript / Backend Dependency Vulnerability Scanner ============================================================================== Detects outdated and vulnerable client-side libraries by: 1. Parsing package.json / composer.json / requirements.txt if exposed 2. Fingerprinting loaded JS libraries from HTML source (jQuery, React, etc.) 3. Comparing detected versions against a built-in known-vulnerable version database 4. Detecting missing Subresource Integrity (SRI) on external scripts
- **deserialization_scanner.py** (Insecure Deserialization Scanner): deserialization_scanner.py — Insecure Deserialization Scanner ============================================================== Expert-grade rewrite (GAP-006 fix): 1. Scans Set-Cookie headers (original) 2. Scans POST/PUT request bodies for serialized content 3. Scans custom headers (X-Java-Serialized-Object, X-Serialized-Object) 4. Extended signatures: .NET ViewState, Ruby Marshal, Node ND_FUNC 5. Active probe: sends crafted Java serialized header and checks error signals 6. Fixes false-positive-prone PHP "O:" pattern (now length-validates)
- **directory_scanner.py** (Sensitive Directory & File Scanner): directory_scanner.py — Checks for exposure of sensitive files and directories. Tests a curated list of paths commonly left exposed on misconfigured web servers. No external dependencies required.
- **dns_rebinding_scanner.py** (DNS Rebinding Scanner): dns_rebinding_scanner.py — DNS Rebinding Scanner ================================================= Expert-grade rewrite (GAP-011 fix): 1. Real TTL check via low-level DNS query (struct-based) + socket fallback 2. Multiple resolution comparison with jitter guard (avoids CDN false positives) 3. Host header validation check (actual defense verification) 4. Private IP detection on resolved addresses 5. CORS + DNS rebinding chain check
- **dns_security_scanner.py** (DNS Security Analyzer): dns_security_scanner.py — DNS security analysis using DNSPython. Performs comprehensive DNS security checks including zone transfer, DNSSEC, and record analysis.
- **dom_xss_scanner.py** (DOM XSS Static Analysis Scanner): dom_xss_scanner.py — DOM XSS Static Analysis Scanner ===================================================== Fetches JavaScript files and performs static sink/source analysis to detect DOM-based XSS patterns that are never visible to the server.
- **email_security_scanner.py** (Email Security Scanner): email_security_scanner.py — Email Security (SPF/DKIM/DMARC) Scanner
- **exif_scanner.py** (EXIF Metadata Leak Scanner): exif_scanner.py — EXIF Metadata Leak Scanner
- **file_upload_scanner.py** (Insecure File Upload Scanner): file_upload_scanner.py — Advanced Insecure File Upload Scanner =============================================================== Comprehensive file upload security testing: 1. Discovers all file upload endpoints on the page 2. MIME type bypass — sends PHP shell disguised as image 3. Double extension bypass — shell.php.jpg 4. SVG XSS — <svg onload=alert(1)> 5. Polyglot JPEG+PHP — valid JPEG header prepended to PHP code 6. Null byte bypass — shell.php%00.jpg 7. Zip Slip — zip containing ../../../path traversal entry 8. ImageTragick (CVE-2016-3714) — MVG/MSL push delegate injection 9. Path traversal via filename — Content-Disposition: filename="../shell.php"
- **fuzzer_scanner.py** (XSS & SQL Injection Fuzzer): fuzzer_scanner.py — Active XSS & SQL Injection Fuzzer ===================================================== Senior Security Engineer-grade injection testing module.  This scanner: 1. Crawls the target page recursively using WebCrawler. 2. Injects curated SQLi and XSS payloads into every discovered input vector. 3. Analyses HTTP responses for database error signatures (MySQL, PostgreSQL, MSSQL, Oracle, SQLite) and reflected XSS payload markers. 4. Performs boolean-based blind SQL injection checks. 5. Reports each confirmed injection point with severity, CVSS, evidence, and remediation guidance.
- **git_exposure_scanner.py** (Git / VCS Exposure Scanner): git_exposure_scanner.py — Git Repository Exposure Scanner ========================================================== Checks for publicly accessible .git directories and version control artifacts that could expose source code, commit history, credentials, and configuration.  Checks: - .git/HEAD, .git/config, .git/COMMIT_EDITMSG, .git/index - .gitignore, .gitmodules, .gitattributes - Common VCS metadata files (SVN, Mercurial) - Source code backup files - CI/CD configuration leaks
- **graphql_scanner.py** (GraphQL Security Scanner): graphql_scanner.py — GraphQL Security Scanner ============================================== Advanced GraphQL vulnerability detection module.  This scanner: 1. Identifies GraphQL endpoints 2. Performs introspection to discover schema 3. Tests for GraphQL-specific vulnerabilities 4. Detects information disclosure via introspection 5. Tests for query depth limiting and DoS vulnerabilities 6. Checks for authorization bypass in GraphQL queries
- **headers_scanner.py** (HTTP Security Headers Scanner): Checks HTTP response headers for the presence / correct configuration of security-critical headers.  Performs a real HTTP request against the target.
- **host_header_scanner.py** (Host Header Injection Scanner): host_header_scanner.py — Host Header Injection Scanner ======================================================= Tests for Host and X-Forwarded-Host header injection, checking if the injected arbitrary domain is reflected in redirects (Location) or internal link generation (password reset poisoning).
- **http_method_tampering_scanner.py** (HTTP Method Tampering Scanner): http_method_tampering_scanner.py — HTTP Method Tampering Scanner ================================================================= Tests all HTTP methods (TRACE, PUT, DELETE, PATCH, OPTIONS, CONNECT) on discovered endpoints. TRACE enables XST, PUT can write files.
- **http_pollution_scanner.py** (HTTP Parameter Pollution Scanner): http_pollution_scanner.py — HTTP Parameter Pollution Scanner
- **idor_scanner.py** (Insecure Direct Object Reference (IDOR) Scanner): idor_scanner.py — Insecure Direct Object Reference (IDOR) Scanner ================================================================== Advanced IDOR detection module that tests for access control vulnerabilities.  This scanner: 1. Identifies endpoints with ID parameters (user IDs, order IDs, etc.) 2. Tests for horizontal privilege escalation (accessing other users' data) 3. Tests for vertical privilege escalation (admin functions) 4. Detects predictable ID patterns and enumeration vulnerabilities 5. Tests for ID manipulation in URLs, headers, and cookies
- **jwt_scanner.py** (JWT Security Scanner): jwt_scanner.py — JWT (JSON Web Token) Security Scanner ====================================================== Advanced JWT security analysis module that tests for JWT vulnerabilities.  This scanner: 1. Extracts JWT tokens from responses and headers 2. Tests for weak signing algorithms (none, HS256 with public key) 3. Checks for token expiration and timing issues 4. Tests for algorithm confusion attacks 5. Validates token structure and claims security 6. Detects sensitive data exposure in tokens
- **ldap_scanner.py** (LDAP Injection Scanner): ldap_scanner.py — LDAP Injection Scanner ========================================= Tests query parameters for LDAP filter injection including wildcard bypass and boolean blind injection targeting enterprise SSO/Active Directory apps.
- **lfi_scanner.py** (Local File Inclusion (LFI) Scanner): lfi_scanner.py — Local File Inclusion (LFI) Scanner ===================================================== Distinct from path_traversal_scanner: LFI focuses on parameters that include/execute local server files (PHP include, Python file read, etc.) rather than pure directory traversal in file paths.  Techniques: - Classic traversal strings (/etc/passwd, win.ini) - PHP filter wrappers (php://filter/convert.base64-encode) - Log poisoning indicators (proc/self/environ) - Null-byte injection (%00) bypass - Double-encoding and UTF-8 tricks - Truncation techniques
- **mass_assignment_scanner.py** (Mass Assignment Scanner): mass_assignment_scanner.py — Mass Assignment / Parameter Pollution Scanner =========================================================================== Expert-grade rewrite (GAP-008 fix): 1. Uses unique probe VALUES (not just key names) to confirm acceptance 2. Properly passes auth_headers via _make_request() for authenticated endpoints 3. Tests GET, POST, PUT, PATCH methods 4. Tests JSON body AND form-encoded body 5. Checks response for reflected probe VALUE (not key name — GAP-008 fix) 6. Tests privilege escalation fields: role, isAdmin, plan, verified, price
- **mfa_bypass_scanner.py** (MFA Bypass Scanner): mfa_bypass_scanner.py — Multi-Factor Authentication Bypass Scanner =================================================================== Expert-grade rewrite (GAP-019 fix): 1. OTP brute-force feasibility (rate limiting check — tries 10 OTPs) 2. OTP validity window detection (how long does an OTP remain valid) 3. OTP reuse after consumption (submit same code twice) 4. Backup code entropy check (common patterns) 5. MFA skip via parameter manipulation (mfa_required=false) 6. Recovery flow bypass (does resetting password bypass MFA) 7. Response-based MFA state detection
- **nikto_scanner.py** (Nikto Web Vulnerability Scanner): Integration wrapper for Nikto scanner. Attempts to run the official perl-based Nikto scanner via subprocess if available. Otherwise, runs a high-fidelity Python-based CGI, backup, and admin panel scanner as fallback heuristics.
- **nmap_scanner.py** (Nmap Port & Service Scanner): nmap_scanner.py — Real Nmap port/service scanner using subprocess + XML parsing. Requires: nmap binary in PATH (https://nmap.org/download.html)
- **nosql_scanner.py** (NoSQL Injection Scanner): nosql_scanner.py — NoSQL Injection Scanner =========================================== Tests query parameters for MongoDB operator injection ($gt, $ne, $regex, $where) and JSON body injection patterns.
- **nuclei_scanner.py** (ProjectDiscovery Nuclei (Advanced Template Scanner)): ProjectDiscovery Nuclei (Advanced Template Scanner)
- **oauth_scanner.py** (OAuth / OIDC Security Scanner): oauth_scanner.py — OAuth / OpenID Connect Security Scanner ============================================================ Audits OAuth and OIDC implementations for common misconfigurations: - Missing state parameter (CSRF) - Open redirect_uri (token theft) - Missing PKCE for public clients - Token leakage in URL fragments - Discovery of .well-known endpoints
- **open_redirect_scanner.py** (Open Redirect Scanner): open_redirect_scanner.py — Open Redirect Vulnerability Scanner ============================================================== Tests URL parameters and form actions for unvalidated redirects. OWASP: CWE-601 / A01:2021 Broken Access Control
- **password_reset_scanner.py** (Insecure Password Reset Scanner): password_reset_scanner.py — Insecure Password Reset Scanner
- **path_traversal_scanner.py** (Path Traversal Scanner): Scans for Path Traversal / Directory Traversal vulnerabilities. Uses recursive web crawling to find all pages, forms, and URL parameters, then fuzzes them with traversal payloads.
- **postmessage_scanner.py** (PostMessage Security Scanner): postmessage_scanner.py — PostMessage Security Scanner ====================================================== Analyzes inline and external JavaScript for insecure postMessage handlers: - addEventListener('message', ...) with no origin check - Handlers that pass event.data directly to eval/innerHTML/document.write - Missing origin validation allowing cross-origin data theft
- **prototype_pollution_scanner.py** (Prototype Pollution Scanner): prototype_pollution_scanner.py — JavaScript Prototype Pollution Scanner ======================================================================== Expert-grade rewrite (GAP-009 fix): 1. Query string pollution (original) 2. JSON body pollution (primary real-world vector — Express/Lodash/qs) 3. Form-encoded body pollution 4. Nested object pollution (__proto__ inside nested keys) 5. constructor.prototype via all vectors 6. Server-side detection via probe value reflection + 500 error analysis
- **race_condition_scanner.py** (Race Condition (TOCTOU) Scanner): race_condition_scanner.py — Race Condition (TOCTOU) Scanner =========================================================== Advanced race condition detection module that tests for Time-of-Check to Time-of-Use vulnerabilities.  This scanner: 1. Identifies endpoints susceptible to race conditions 2. Tests for concurrent request vulnerabilities 3. Detects double-spending and privilege escalation via race conditions 4. Tests for file upload race conditions 5. Checks for timing-based vulnerabilities in critical operations
- **rate_limiting_scanner.py** (API Rate Limiting Scanner): rate_limiting_scanner.py — API Rate Limiting Scanner ==================================================== Advanced API rate limiting and abuse detection module.  This scanner: 1. Tests for missing rate limiting on API endpoints 2. Detects rate limiting bypass techniques 3. Tests for endpoint-specific rate limits 4. Checks for DoS vulnerability via unlimited requests 5. Tests for authentication-independent rate limiting 6. Detects IP-based vs user-based rate limiting
- **redos_scanner.py** (ReDoS Scanner): redos_scanner.py — ReDoS (Regular Expression Denial of Service) Scanner ======================================================================== Expert-grade rewrite (GAP-014 fix): 1. Timing-based active confirmation (catastrophic backtracking strings) 2. Response-time delta analysis vs baseline 3. Multiple backtracking pattern types (quadratic, exponential, polynomial) 4. Tests GET params, POST form fields, and JSON body 5. Static pattern detection in JS source (original behavior)
- **request_smuggling_scanner.py** (HTTP Request Smuggling Scanner): HTTP Request Smuggling Scanner
- **robots_scanner.py** (Robots.txt & Sitemap Scanner): robots_scanner.py — Analyses robots.txt and sitemap.xml for security-relevant disclosures. No external dependencies required.
- **saml_scanner.py** (SAML Security Scanner): saml_scanner.py — SAML Security Scanner ======================================== Audits SAML SSO implementations for: - XML Signature Wrapping (XSW) vulnerabilities - Exposed SAML metadata endpoints - Assertion replay risk (missing NotOnOrAfter) - NameID injection patterns - Cleartext SAML assertions (unencrypted)
- **second_order_scanner.py** (Second-Order Injection Scanner): second_order_scanner.py — Second-Order Injection Scanner
- **secrets_scanner.py** (Embedded Secrets & JS Analyzer): Embedded Secrets & JS Analyzer
- **service_worker_scanner.py** (Service Worker Security Scanner): service_worker_scanner.py — Service Worker Security Scanner
- **session_scanner.py** (Session Management Scanner): session_scanner.py — Session Management Security Scanner ========================================================= Audits session management behaviour: - Session ID in URL (CWE-598) - Session fixation vulnerability - Session token entropy analysis - Post-logout session invalidation - Concurrent session detection hints - Session cookie security flags (complements cookie_scanner) - Absolute session timeout
- **source_map_scanner.py** (Source Map Exposure Scanner): source_map_scanner.py — Source Map Exposure Scanner ==================================================== Expert-grade rewrite (GAP-015 fix): 1. Discovers .js.map files by checking common JS bundles 2. Downloads and parses map file content 3. Extracts and reports: server-side paths, internal package names, secret patterns (API keys, tokens, credentials), Git repo URLs 4. Reports severity based on content sensitivity 5. Checks /sourceMappingURL= comments in loaded JS files
- **sql_injection_scanner.py** (SQL Injection Scanner): SQL Injection Scanner
- **sri_scanner.py** (Subresource Integrity (SRI) Scanner): sri_scanner.py — Subresource Integrity (SRI) Scanner
- **sslyze_scanner.py** (SSLyze TLS/SSL Scanner): sslyze_scanner.py — Deep SSL/TLS analysis using the sslyze Python library. Requires: pip install sslyze
- **ssrf_scanner.py** (Advanced Server-Side Request Forgery (SSRF) Scanner): ssrf_scanner.py — Advanced Server-Side Request Forgery (SSRF) Scanner ====================================================================== Comprehensive SSRF detection module that tests for server-side request forgery.  This scanner: 1. Identifies URL parameters that may trigger server-side requests 2. Tests for internal network access (localhost, private IPs) 3. Detects cloud metadata service access (AWS, GCP, Azure) 4. Tests for blind SSRF using out-of-band techniques 5. Checks for common SSRF bypass techniques
- **ssti_scanner.py** (Server-Side Template Injection (SSTI) Scanner): ssti_scanner.py — Server-Side Template Injection (SSTI) Scanner =============================================================== Detects SSTI vulnerabilities by injecting engine-specific arithmetic/string probes into every URL parameter and HTML form field discovered via crawler.  Engines probed: Jinja2, Twig, Freemarker, Mako, Smarty, Pebble, Velocity. Severity: CRITICAL — SSTI often leads to full Remote Code Execution (RCE).
- **subdomain_scanner.py** (Subdomain Enumeration & Takeover Hunter): subdomain_scanner.py — Discovers subdomains via crt.sh and hunts for Takeovers.
- **subdomain_takeover_scanner.py** (Subdomain Takeover Scanner): subdomain_takeover_scanner.py — Subdomain Takeover Scanner =========================================================== Expert-grade rewrite (GAP-020 fix): 1. Full CNAME chain following (not just first-level) 2. Service-specific fingerprinting (GitHub Pages, Heroku, Azure, Netlify, etc.) 3. Domain availability heuristics for dangling CNAMEs 4. HTTP response fingerprinting for "unclaimed" service pages 5. A record check for abandoned IPs
- **swagger_scanner.py** (Swagger/OpenAPI Exposure Scanner): swagger_scanner.py — Swagger/OpenAPI Exposure Scanner ====================================================== Expert-grade rewrite (GAP-021 fix): 1. Discover Swagger/OpenAPI/GraphQL docs at common paths 2. Check if endpoints require authentication (unauthenticated access = critical) 3. Parse OpenAPI spec to find endpoints marked security:[] (no auth) 4. Flag deprecated API versions (/v1 alongside /v3) 5. Identify internal/admin endpoints in the spec 6. Check for sensitive info in API descriptions/examples
- **tech_scanner.py** (Technology Fingerprinting Scanner): tech_scanner.py — Technology fingerprinting via HTTP headers and HTML analysis. Identifies web server, framework, CMS, CDN, and analytics technologies. Checks identified versions against a built-in EOL (end-of-life) list. No external dependencies required.
- **tls_weakness_scanner.py** (TLS Weakness Scanner): tls_weakness_scanner.py — TLS Weakness Scanner (BEAST/POODLE/CRIME/Heartbleed)
- **waf_scanner.py** (WAF & CDN Detection): waf_scanner.py — Web Application Firewall (WAF) Detection module. Detects common WAFs via HTTP headers and response signatures.
- **web_cache_deception_scanner.py** (Web Cache Deception Scanner): web_cache_deception_scanner.py — Web Cache Deception Scanner ============================================================= Distinct from cache poisoning: tricks the cache into storing authenticated responses by appending fake static extensions to authenticated paths.
- **webrtc_leak_scanner.py** (WebRTC IP Leak Scanner): webrtc_leak_scanner.py — WebRTC IP Leak Scanner
- **websocket_scanner.py** (WebSocket Security Scanner): websocket_scanner.py — WebSocket Security Scanner ================================================ Advanced WebSocket vulnerability detection module.  This scanner: 1. Identifies WebSocket endpoints 2. Tests for WebSocket authentication bypass 3. Detects message injection vulnerabilities 4. Tests for cross-site WebSocket hijacking (CSWSH) 5. Checks for origin validation issues 6. Tests for denial of service via WebSocket
- **whatweb_scanner.py** (WhatWeb Technology Fingerprinting): whatweb_scanner.py — Technology fingerprinting using WhatWeb tool. Requires: whatweb binary in PATH (https://github.com/urbanadventurer/WhatWeb)
- **whois_scanner.py** (WHOIS / DNS Recon Scanner): whois_scanner.py — WHOIS / DNS reconnaissance module. Requires: pip install python-whois dnspython (dnspython optional)
- **xpath_scanner.py** (XPath Injection Scanner): xpath_scanner.py — XPath Injection Scanner ========================================== Expert-grade rewrite (GAP-010 fix): 1. Error-based detection (original) 2. Boolean-blind inference (true/false response comparison) 3. POST form parameter testing 4. JSON body XPath injection 5. Timing-based confirmation as fallback
- **xxe_scanner.py** (XML External Entity (XXE) Scanner): xxe_scanner.py — XML External Entity (XXE) Vulnerability Scanner ================================================================ Advanced XXE detection module that tests for XML parsing vulnerabilities.  This scanner: 1. Identifies XML endpoints and data submission points 2. Tests for classic XXE attacks (file reading, SSRF via XXE) 3. Detects blind XXE using out-of-band techniques 4. Tests various XML parser configurations and libraries 5. Checks for DTD and parameter entity injection
- **zap_scanner.py** (OWASP ZAP Web Scanner): zap_scanner.py — OWASP ZAP integration via REST API. Requires: pip install python-owasp-zap-v2.4 ZAP daemon running: zap.bat -daemon -port 8080 -config api.key=<ZAP_API_KEY>  Gracefully skips if ZAP daemon is not reachable.