AKCA

Advanced Web Security Scanner

Discover endpoints. Test web applications. Inspect the evidence.

Installation · Usage · Workflow · Profiles · Coverage · Reports · Support · Features · Changelog

AKCA is an open-source, evidence-oriented Dynamic Application Security Testing (DAST) scanner written in Go. It combines HTTP and browser-assisted crawling, JavaScript analysis, API imports, adaptive active testing, passive inspection, and replayable evidence in one command-line workflow.

Why AKCA

Many scanners crawl an application and then send a broad payload set to every discovered endpoint. That strategy can create unnecessary traffic, trigger defensive systems, and produce weak signals that require substantial manual triage. AKCA takes a more contextual approach: it first learns about the target, models the discovered attack surface, and then selects tests according to the technology stack, parameters, authentication state, WAF behavior, and available verification capabilities.

AKCA is designed to:

• Discover hidden routes, JavaScript-loaded endpoints, undocumented parameters, API operations, and access-controlled paths before active testing.
• Fingerprint technology and WAF behavior, then calibrate request pacing and safe payload transformations to the observed target.
• Allocate work across endpoint, method, parameter, and module combinations instead of blindly applying every payload everywhere.
• Pause and recover from rate limiting or host-level blocking, within configured scan and time limits.
• Replay promising signals with baselines, negative controls, state checks, identity comparisons, or OAST callbacks before promoting them to findings.
• Preserve request, response, payload, confidence, and proof-policy context so results can be investigated rather than accepted on faith.

The goal is not to exhaust or overwhelm the target. It is to find real weaknesses with deliberate requests and useful evidence.

AKCA does not claim feature or detection parity with mature commercial platforms such as Acunetix, Invicti/Netsparker, or Burp Suite Professional. Those products are built by experienced teams over many years. AKCA is independently maintained by one developer in available personal time, inspired by established security tools and shaped by original ideas and community feedback. The current priority is a simple, useful, and transparent scanner. A graphical interface is planned when the engine is sufficiently stable and dependable.

_{AKCA v0.2.8 scan session with live engine status, resource telemetry, and confirmed findings.}

Installation

Go install

Requires Go 1.25 or newer.

go install github.com/akha-security/akca/engine/cmd/akca@latest
akca --version

@latest installs the newest tagged release, not an untagged commit on main. To test the current development branch, use @main. If an older binary still runs, compare command -v akca with go env GOBIN (or $(go env GOPATH)/bin) and refresh the shell command cache with hash -r. akca --version prints the embedded release build commit/date when available.

export PATH="$(go env GOPATH)/bin:$PATH"

$env:Path += ";$(go env GOPATH)\bin"

Prebuilt binaries

Download your build from GitHub Releases. Releases include SHA256SUMS.txt and GitHub build-provenance attestations. Verify a downloaded binary with gh attestation verify <binary> -R akha-security/akca.

On Linux or macOS, make the downloaded file executable. For Linux x64:

chmod +x akca-linux-amd64
./akca-linux-amd64 --help

On Windows, rename the download to akca.exe and run .\akca.exe --help in PowerShell. The examples below assume akca is available on your PATH.

Browser-backed checks require Chrome, Chromium, or Edge.

Usage

Use AKCA only on systems you own or have permission to test. Replace the example URL with your authorized target.

Start a scan

akca -u https://example.com

The default profile is full. To save an HTML report:

akca -u https://example.com -f html -o report.html

Choose specific checks

Run SQL injection, XSS, and server-side injection checks, including SSTI:

akca -u https://example.com -m sql,xss,rce

Run passive checks:

akca -u https://example.com -m passive

Passive scans still send requests for discovery and inspection.

Use an authenticated session

Supply a session cookie:

akca -u https://example.com -c "session=YOUR_SESSION_COOKIE"

Or an authorization header:

akca -u https://example.com -H "Authorization: Bearer YOUR_TOKEN"

Some authorization checks require additional identities or state configuration beyond a single session.

Import an API definition

akca -u https://api.example.com --api-spec ./openapi.yaml -m api

Discovery supports OpenAPI/Swagger, RAML, Postman, HAR, GraphQL, WSDL, protobuf, and AsyncAPI inputs, including supported ZIP bundles. Testing coverage depends on the imported protocol and operation.

Inspect traffic through a proxy

akca -u https://example.com -p http://127.0.0.1:8080

Run akca --help for all available options.

Use akca -h for concise everyday help, or akca --help for the complete option reference. Scan targets must be supplied explicitly with -u or --url.

Scan profiles

Select a profile with -m, or combine several with commas.