An automated web application penetration testing framework that crawls targets, detects vulnerabilities, applies CVSS 3.1 scoring, generates AI-written narratives, and produces professional PDF reports.
- Web Crawler — Recursively maps all endpoints and forms
- SQL Injection Scanner — Detects error-based SQLi in GET and POST parameters
- XSS Scanner — Detects reflected Cross-Site Scripting vulnerabilities
- CVSS 3.1 Scoring — Industry standard severity ratings for every finding
- AI Analysis — Local LLM generates professional pentest narrative automatically
- PDF Report — Professional client-ready report with cover page, findings, and remediation
Target URL | v [Phase 1] Crawler -----------> Maps all endpoints and forms | v [Phase 2] SQLi Scanner -------> Tests for SQL Injection | v [Phase 3] XSS Scanner --------> Tests for Cross-Site Scripting | v [Phase 4] CVSS Scoring -------> Assigns severity scores | v [Phase 5] AI Analysis --------> Writes executive summary | v [Phase 6] PDF Report ---------> Generates professional report
- Kali Linux (recommended) or any Linux distro
- Python 3.x
- Docker (for DVWA lab practice)
- Ollama (for AI analysis)
git clone https://github.com/ratan27612761-rgb/webaudit.git
cd webauditpip3 install requests beautifulsoup4 fpdf2 ollama --break-system-packagescurl -fsSL https://ollama.com/install.sh | shOpen Terminal 1 and run:
ollama serveOpen Terminal 2 and pull the model:
ollama pull llama3WebAudit has two modes:
DVWA is an intentionally vulnerable web app for safe practice.
docker pull vulnerables/web-dvwa
docker run -d -p 80:80 vulnerables/web-dvwaOpen browser at http://localhost:
- Click Setup / Reset Database
- Login with
admin/test
python3 main.pyUse scan.py to scan any website you have permission to test.
python3 scan.py -u http://target-website.compython3 scan.py -u http://target-website.com -d 3python3 scan.py -u http://target-website.com --no-aipython3 scan.py -u http://target-website.com --no-pdfpython3 scan.py -hpython3 scan.py --version| Command | Description |
|---|---|
python3 main.py |
Scan DVWA lab |
python3 scan.py -u URL |
Scan any target |
python3 scan.py -u URL -d 3 |
Scan with depth 3 |
python3 scan.py -u URL --no-ai |
Skip AI analysis |
python3 scan.py -u URL --no-pdf |
Skip PDF report |
python3 scan.py -h |
Show help |
python3 scan.py --version |
Show version |
Only scan websites you own or have written permission to test. Good practice targets (legal to scan):
http://testfire.net- IBM demo bank apphttp://demo.testfire.net- IBM demo apphttp://juice-shop.herokuapp.com- OWASP Juice Shophttp://localhost- Your own DVWA lab
Open Terminal 1:
ollama serveOpen Terminal 2:
cd webaudit
python3 scan.py -u http://testfire.netls reports/Open the PDF — it contains:
- Cover page with target and date
- Risk summary table
- AI-written executive summary
- Detailed findings with CVSS scores
- Remediation recommendations
██╗ ██╗███████╗██████╗ █████╗ ██╗ ██╗██████╗ ██╗████████╗ ██║ ██║██╔════╝██╔══██╗██╔══██╗██║ ██║██╔══██╗██║╚══██╔══╝ ██║ █╗ ██║█████╗ ██████╔╝███████║██║ ██║██║ ██║██║ ██║ ██║███╗██║██╔══╝ ██╔══██╗██╔══██║██║ ██║██║ ██║██║ ██║ ╚███╔███╔╝███████╗██████╔╝██║ ██║╚██████╔╝██████╔╝██║ ██║ ╚══╝╚══╝ ╚══════╝╚═════╝ ╚═╝ ╚═╝ ╚═════╝ ╚═════╝ ╚═╝ ╚═╝ WebAudit v1.0.0 - Intelligent Web Pentest Framework GitHub: https://github.com/ratan27612761-rgb/webaudit [Phase 1] Crawling target... [+] Found: http://testfire.net/index.jsp (200) [+] Found: http://testfire.net/login.jsp (200) --> Endpoints found : 15 --> Forms found : 4 [Phase 2] Testing for SQL Injection... [!!!] SQLi FOUND at http://testfire.net/login.jsp Payload : ' Evidence : you have an error in your sql syntax CVSS : 9.8 (CRITICAL) [Phase 3] Testing for XSS... [!!!] XSS FOUND at http://testfire.net/search.jsp Payload : <script>alert('XSS')</script> CVSS : 7.4 (HIGH) [Phase 5] AI Executive Summary... During the assessment of testfire.net, two critical vulnerabilities were identified... [Phase 6] PDF Report saved to: reports/webaudit_report_20260526.pdf
SCAN COMPLETE SQLi found : 1 XSS found : 1 Total vulns : 2 CRITICAL : 1 HIGH : 1
webaudit/ ├── main.py # DVWA lab scanner ├── scan.py # Universal scanner (any target) ├── modules/ │ ├── crawler.py # Web crawler │ ├── sqli.py # SQL injection scanner │ ├── xss.py # XSS scanner │ ├── cvss.py # CVSS scoring engine │ ├── ai_analysis.py # AI narrative generator │ └── pdf_report.py # PDF report generator ├── reports/ # Generated PDF reports └── README.md
| Vulnerability | Detection Method | CVSS Score |
|---|---|---|
| SQL Injection | Error-based signature matching | 9.8 CRITICAL |
| Reflected XSS | Payload reflection detection | 7.4 HIGH |
| Blind SQLi | Coming soon | - |
| CSRF | Coming soon | - |
| Command Injection | Coming soon | - |
To get the latest version:
cd webaudit
git pull origin main| Version | Changes |
|---|---|
| v1.0.0 | Initial release - Crawler, SQLi, XSS, CVSS, AI, PDF |
| Feature | WebAudit | Nikto | OWASP ZAP | Burp Suite |
|---|---|---|---|---|
| SQLi Detection | Yes | Yes | Yes | Yes |
| XSS Detection | Yes | Yes | Yes | Yes |
| CVSS Scoring | Yes | No | No | No |
| AI Narrative | Yes | No | No | No |
| PDF Report | Yes | No | Yes | Yes (paid) |
| Free | Yes | Yes | Yes | No |
| CLI Arguments | Yes | Yes | Yes | Yes |
This tool is for educational purposes and authorized penetration testing only. Only use WebAudit against systems you own or have explicit written permission to test. Unauthorized scanning is illegal and unethical. The author is not responsible for any misuse or damage caused by this tool.
| Technology | Purpose |
|---|---|
| Python 3 | Core language |
| requests | HTTP client |
| BeautifulSoup4 | HTML parsing |
| fpdf2 | PDF generation |
| Ollama + Llama3 | Local AI analysis |
| Docker + DVWA | Target lab environment |
Built by Ratan as a portfolio project for web application penetration testing.
MIT License - feel free to use, modify, and distribute.