Web_eXploit 🛡️

A comprehensive web application penetration testing scanner designed for security professionals and ethical hackers to identify vulnerabilities, test security controls, and validate web application security posture.

⚠️ Legal Disclaimer: This tool is for authorized security testing only. Unauthorized access to computer systems is illegal.

Overview

Web_eXploit is a powerful penetration testing framework that combines multiple scanning and exploitation techniques to provide thorough web application security assessment. It offers both quick scans for rapid testing and comprehensive penetration tests for in-depth vulnerability analysis.

Features

🚀 Quick Scan

• Rapid security assessment combining basic and OWASP Top 10 tests
• Perfect for quick vulnerability checks
• Generates immediate results

🎯 Full Penetration Test

• Comprehensive testing across all modules
• In-depth vulnerability analysis
• Complete security assessment

📍 Reconnaissance & Enumeration

• Port Scanning: Detect open ports and services
• DNS Enumeration: Gather DNS information and resolve domains
• Web Server Fingerprinting: Identify server software and versions
• SSL/TLS Analysis: Analyze certificate and encryption configuration
• Network Range Scanning: Scan multiple hosts in a network range
• Subdomain Discovery: Find subdomains of target domains

🔍 Vulnerability Scanning

• OWASP Top 10 Testing: Test for Top 10 web vulnerabilities
• Advanced XSS Testing: Multiple XSS detection methods
  • Reflected XSS
  • Stored XSS
  • DOM-based XSS
  • Blind XSS
• Advanced Authentication Testing: Test authentication mechanisms
• SQL Injection: Detect and validate SQLi vulnerabilities
• File Inclusion: Test LFI/RFI vulnerabilities
• Security Headers: Analyze HTTP security headers
• Encryption Testing: Verify encryption implementation
• Component Vulnerabilities: Scan for known vulnerable components

💣 Exploitation & Brute Force

• Automated Exploitation: Multi-port exploitation attempts
• Login Brute Force: Credential brute forcing with wordlists
• OTP Brute Force: One-time password cracking
• Service-specific Exploitation: Target-specific exploit execution

📊 Reports & Validation

• Full Report Generation: Comprehensive vulnerability reports
• Validation Reports: Accuracy verification of findings
• Vulnerability Validator: Confirm discovered vulnerabilities
• Results Summary: View current scan results

⚙️ Tools & Configuration

• Wordlist Management: Customize and manage wordlists
• Payload Cleaning: Prepare and validate payloads
• Custom Test Workflows: Create tailored testing scenarios

Installation

Prerequisites

• Python 3.8+
• pip (Python package manager)
• Internet connection for network scanning
• Administrative/root privileges for advanced scanning features (optional)

Setup

1. Clone the repository:

   git clone https://github.com/Rsaimukesh/Web_eXploit.git
   cd Web_eXploit

2. Install dependencies:

   pip install -r requirements.txt

   If requirements.txt is not available, install key dependencies:

   pip install requests beautifulsoup4 dnspython selenium pycryptodome

3. Run the tool:

   python main.py

Usage

Basic Usage

python main.py

The tool will prompt you to:

1. Enter target URL: Provide the target website (e.g., https://example.com)
2. Set flag format (optional): Specify regex pattern for flag extraction (e.g., flag\{.*?\})
3. Choose scanning mode: Select from the interactive menu

Menu Navigation

The main menu provides 8 categories:

🛡️ WEB_EXPLOIT - PENETRATION TESTING SCANNER
├── 1. 🚀 Quick Scan
├── 2. 🎯 Full Penetration Test
├── 3. 📍 Reconnaissance & Enumeration
├── 4. 🔍 Vulnerability Scanning
├── 5. 💣 Exploitation & Brute Force
├── 6. 📊 Reports & Validation
├── 7. ⚙️  Tools & Configuration
└── 8. ℹ️  View Current Results

Navigation Tips:

• Enter the number to select a menu option
• Enter 0 at any submenu to go back
• Enter 0 at the main menu to exit

Common Workflows

Quick Security Check

1. Run the tool: python main.py
2. Select Quick Scan (option 1)
3. View results in View Current Results (option 8)
4. Generate report from Reports & Validation (option 6)

Comprehensive Penetration Test

1. Run the tool: python main.py
2. Select Full Penetration Test (option 2)
3. Monitor progress and wait for completion
4. Generate detailed report from Reports & Validation

Targeted Testing

1. Navigate to Vulnerability Scanning (option 4)
2. Choose specific vulnerability type (XSS, SQLi, etc.)
3. Review findings in real-time
4. Validate critical findings with Vulnerability Validator

Project Structure

Web_eXploit/
├── main.py                      # Entry point
├── MENU_STRUCTURE.md            # Menu documentation
├── README.md                    # This file
├── requirements.txt             # Python dependencies
└── webscanner/
    ├── __init__.py
    ├── scanner.py              # Main scanning orchestrator
    ├── reconnaissance.py        # Information gathering
    ├── exploitation.py          # Exploitation module
    ├── brute_force.py          # Brute force attacks
    ├── injection_tests.py       # Injection vulnerabilities
    ├── advanced_tests.py        # Advanced security tests
    ├── access_control.py        # Access control testing
    ├── crypto_failures.py       # Cryptography testing
    ├── web_security.py          # Web security features
    ├── vulnerability_validator.py # Validation module
    ├── component_scanner.py     # Component vulnerability scanning
    ├── utils.py                 # Utility functions
    ├── menu.py                  # Interactive menu system
    └── wordlists/              # Payload and wordlist files
        ├── common_passwords.txt
        ├── sqli_payloads.txt
        ├── xss_payloads.txt
        ├── directories.txt
        └── ... (other wordlists)

Key Modules

Module	Purpose
scanner.py	Orchestrates scanning workflow and coordinates modules
reconnaissance.py	Port scanning, DNS enumeration, fingerprinting
exploitation.py	Automated exploitation and payload delivery
brute_force.py	Credential brute forcing and OTP attacks
injection_tests.py	SQLi, SSRF, command injection, file inclusion
advanced_tests.py	File upload, XXE, deserialization vulnerabilities
web_security.py	CSRF, CORS, session management testing
crypto_failures.py	SSL/TLS, encryption, security headers analysis
vulnerability_validator.py	Validate and verify discovered vulnerabilities

Wordlists

The tool includes curated wordlists for:

• Common passwords and credentials
• SQL injection payloads
• XSS payloads
• Web directories and endpoints
• API endpoints
• Admin panels
• Subdomains
• Web shells
• LFI payloads

Located in: webscanner/wordlists/

Configuration

Custom Wordlists

1. Navigate to Tools & Configuration (option 7)
2. Select Wordlist Management
3. Add or modify wordlists in webscanner/wordlists/

Flag Format

Specify custom regex patterns to extract flags/sensitive data:

flag\{.*?\}          # Captures flag{...}
FLAG:.*?             # Captures FLAG:...
[A-Z0-9]{32}         # Captures MD5-like strings

Security & Ethics

⚠️ Important Legal Notice:

• This tool is designed for authorized security testing only
• Obtain proper authorization before testing any web application
• Unauthorized access to computer systems is illegal
• Use only on systems you own or have explicit permission to test
• Follow applicable laws and regulations in your jurisdiction

Supported Vulnerability Types

• ✅ SQL Injection (SQLi)
• ✅ Cross-Site Scripting (XSS) - Reflected, Stored, DOM, Blind
• ✅ Cross-Site Request Forgery (CSRF)
• ✅ Broken Authentication
• ✅ Sensitive Data Exposure
• ✅ XML External Entity (XXE)
• ✅ Broken Access Control
• ✅ Security Misconfiguration
• ✅ Insecure Deserialization
• ✅ Using Components with Known Vulnerabilities
• ✅ Insufficient Logging & Monitoring
• ✅ Server-Side Request Forgery (SSRF)
• ✅ File Inclusion (LFI/RFI)
• ✅ Command Injection
• ✅ File Upload Vulnerabilities
• ✅ CORS Misconfiguration
• ✅ SSL/TLS Issues

Troubleshooting

Connection Issues

# Test target connectivity
python -c "import requests; requests.get('https://target.com')"

Module Errors

• Ensure all dependencies are installed: pip install -r requirements.txt
• Check Python version: python --version (requires 3.8+)
• Verify internet connection for remote scanning

Slow Scans

• Reduce port range for faster scanning
• Use Quick Scan instead of Full Penetration Test
• Adjust thread counts in configuration

Performance Tips

1. For Large Networks: Use targeted port ranges instead of full scans
2. For Quick Results: Start with Quick Scan mode
3. For Comprehensive Testing: Run during off-peak hours
4. For Better Accuracy: Validate critical findings with Vulnerability Validator

Contributing

Contributions are welcome! To contribute:

1. Fork the repository
2. Create a feature branch (git checkout -b feature/AmazingFeature)
3. Commit your changes (git commit -m 'Add some AmazingFeature')
4. Push to the branch (git push origin feature/AmazingFeature)
5. Open a Pull Request

Please read CONTRIBUTING.md for detailed guidelines.

License

This project is licensed under the MIT License - see the LICENSE file for details.

Additional Terms: This tool is provided for educational and authorized security testing purposes only. Users must comply with all applicable laws and regulations.

Author

Rsaimukesh

• Repository: Web_eXploit
• GitHub: @Rsaimukesh

Contributors

We welcome contributions! See CONTRIBUTING.md for guidelines.

Support

For issues, questions, or feature requests:

• 🐛 Open an issue on GitHub
• 📖 Check MENU_STRUCTURE.md for detailed documentation
• 🔒 Review SECURITY.md for security policy
• 📝 See CONTRIBUTING.md for contribution guidelines

Related Projects

• OWASP Top 10
• Metasploit Framework
• Burp Suite
• OWASP ZAP

Disclaimer

This tool is provided as-is for educational and authorized penetration testing purposes only. Users are solely responsible for complying with all applicable laws and regulations. Unauthorized access to computer systems is illegal. Always obtain proper authorization before testing.

---

Happy Hunting! 🎯