webAppSec/main.py at main · ClaudiasLibrary/webAppSec · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
from config import TARGET_URL, OUTPUT_REPORT
from utils import scrape_forms, test_sql_injection, test_xss, check_security_headers


def generate_report(vulnerabilities):
    with open(OUTPUT_REPORT, 'w') as file:
        file.write("<html><head><title>Security Scan Report</title></head><body>")
        file.write("<h1>Security Scan Report</h1>")
        file.write("<h2>Vulnerabilities Detected</h2>")
        for vuln in vulnerabilities:
            file.write(f"<p>{vuln}</p>")
        file.write("</body></html>")


def run_security_audit():
    print(f"Starting security audit for {TARGET_URL}...")

    # Scraping forms
    print("Scraping forms and input fields...")
    forms = scrape_forms(TARGET_URL)
    vulnerabilities = []

    # Check for SQL injection vulnerabilities
    for form in forms:
        for param in form["input_fields"]:
            print(f"Testing for SQL Injection vulnerability on parameter: {param}...")
            vuln, result = test_sql_injection(TARGET_URL, param)
            if vuln:
                vulnerabilities.append(f"SQL Injection vulnerability detected on {param}. Result: {result}")

    # Check for XSS vulnerabilities
    for form in forms:
        for param in form["input_fields"]:
            print(f"Testing for XSS vulnerability on parameter: {param}...")
            vuln, result = test_xss(TARGET_URL, param)
            if vuln:
                vulnerabilities.append(f"XSS vulnerability detected on {param}. Result: {result}")

    # Check for security headers
    print("Checking for missing security headers...")
    missing_headers = check_security_headers(TARGET_URL)
    if missing_headers:
        vulnerabilities.append(f"Missing security headers: {', '.join(missing_headers)}")

    # Generate report
    generate_report(vulnerabilities)
    print(f"Security audit completed. Report generated: {OUTPUT_REPORT}")


if __name__ == "__main__":
    run_security_audit()