0xdevrel/easyscanPython-based web security scanner that analyzes HTTP headers, SSL/TLS, DNS records, and common misconfigurations to generate a scored security report with actionable recommendations.
EasyScan is a Python script that analyzes the security of a given website by inspecting its HTTP headers, DNS records, and other configurations. The script generates a security report with a score, grade, and recommendations for addressing potential vulnerabilities.
The script covers the following test cases:
Referrer-Policy header and meta tag./admin, /wp-admin, /phpmyadmin, /cpanel)./images/uploads/filesSet-Cookie headers for Secure, HttpOnly, SameSite attributes and __Secure-/__Host- prefixes.Server, X-Powered-By, X-AspNet-Version headers.Access-Control-Allow-Origin settings and wildcard + credentials conflicts.Content-Type header.robots.txt for potentially sensitive disallowed paths.OPTIONS requests to detect dangerous verbs (TRACE, DELETE, PUT, CONNECT)..git/config, .env, .htaccess, backup.sql, wp-config.php.bak, and more.<script> and <link> tags for missing integrity attributes.http:// resource URLs loaded on HTTPS pages.X-Frame-Options and CSP frame-ancestors for clickjacking protection.Host header is reflected in redirects or response body.url, next, redirect, return, etc.) for open redirect vulnerabilities.EasyScan requires Python 3.6+ and the following libraries:
requestsbeautifulsoup4dnspythoncertifiYou can install these dependencies using the provided requirements.txt file:
pip install -r requirements.txt
To use the EasyScan script, follow these steps:
easyscan.py.pip install -r requirements.txt
python3 easyscan.py [url]
| Flag | Description |
|---|---|
url | Positional argument. The URL to scan (e.g. example.com or https://example.com). |
--json | Output results as JSON to stdout. |
--output FILE / -o FILE | Save the report to a specific file. |
--timeout SECS / -t SECS | Set the request timeout in seconds (default: 10). |
--verbose / -v | Enable debug-level logging output. |
Basic scan:
python3 easyscan.py example.com
Scan with JSON output saved to a file:
python3 easyscan.py example.com --json --output report.json
Scan with a longer timeout and verbose logging:
python3 easyscan.py https://example.com --timeout 20 --verbose
Use the --json flag to get structured JSON output, which is useful for integration with other tools:
python3 easyscan.py example.com --json
The JSON report includes a score object with the aggregate score (0-100), a letter grade (A-F), severity counts, and all findings.
================================================================================================================================================================
SECURITY REPORT
================================================================================================================================================================
Header Status Severity Recommendation
================================================================================================================================================================
[CRI] SSL/TLS Missing Critical The site is not using HTTPS. Implement SSL/TLS to encrypt data in transit.
[HI] Clickjacking No Protection High Set 'X-Frame-Options: DENY' or CSP 'frame-ancestors' directive to prevent clickjacking.
[HI] Public Admin Page (/admin) Accessible High Restrict access to /admin to specific IP addresses and/or enable authentication.
[MED] Content-Security-Policy Missing Medium Implement a Content Security Policy (CSP) to prevent XSS and code injection attacks.
[MED] Strict-Transport-Security Missing Medium Implement Strict Transport Security (HSTS) to enforce secure connections.
[MED] Permissions-Policy Missing Medium Set a 'Permissions-Policy' header to restrict browser features (camera, microphone, geolocation).
[LOW] SPF Record Missing Low Add an SPF record to your domain's DNS settings to help prevent email spoofing.
[INF] Meta Referrer Missing Low Add a 'referrer' META tag with 'no-referrer' to prevent leaking referrer information.
============================================================
SECURITY SCORE: 55/100 (Grade: C)
============================================================
Total Issues : 8
Critical : 1
High : 2
Medium : 4
Low : 1
Info : 0
============================================================
Keep in mind that the script may not cover all possible security scenarios, and it's recommended to perform a thorough security assessment for your website.
EasyScan is also available at https://easyscan.onrender.com/
If you have any questions or need a full security audit, please reach out on Twitter @0xdevrel.