fauxrougee/smartscanner-sourceWeb vulnerability scanner built with C++17 and Qt 6, featuring a GUI, CLI, configurable crawling, and JSON reports. Reconstructed for educational purposes.
A web vulnerability scanner built with C++17 and Qt 6, featuring graphical and command-line interfaces.
This repository contains a reconstruction of SmartScanner 3.0.0 for educational purposes. It combines a web crawling engine, vulnerability detection modules, and JSON reporting.
robots.txt and sitemap handling, configurable crawl depth and scope.The modules executed depend on the configuration and the resources discovered during the scan.
| Component | Version / details |
|---|
| CMake | 3.21 or later |
| Compiler | C++17-compatible |
| Qt | 6.2 or later |
| Qt modules | Core, Gui, Widgets, Network, WebChannel, WebEngineWidgets, Xml |
| Ninja | Required by the included Windows build scripts |
The instructions below target Windows, using the Visual Studio C++ build tools and a compatible Qt MSVC kit. The GUI entry point uses the Windows API directly (windows.h), so building the full project on Linux or macOS requires modifications.
Qt GUI dependencies are also required when configuring the project for the CLI, as both executables share the same library.
Open a PowerShell terminal with the Visual Studio build environment configured, then navigate to the repository root. Adjust the Qt path to match your installation.
.\build.ps1 -QtPath "C:\Qt\6.8.3\msvc2022_64" -BuildType Release
.\deploy.ps1 -QtPath "C:\Qt\6.8.3\msvc2022_64"
The first script builds the project with Ninja. The second copies available Qt libraries, plugins, and WebEngine resources into the build directory.
cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release -DCMAKE_PREFIX_PATH="C:\Qt\6.8.3\msvc2022_64"
cmake --build build --parallel
.\deploy.ps1 -QtPath "C:\Qt\6.8.3\msvc2022_64"
The build produces two executables:
build/sms.exe: command-line interface.build/gui.exe: graphical interface.The assets directory is automatically copied alongside the executables during the build. Keep it with them, as it is needed to load the default configuration.
.\build\gui.exe
The following examples use a local test application at http://localhost:8080.
# Display help and version information
.\build\sms.exe --help
.\build\sms.exe --version
# Scan a target and save a JSON report
.\build\sms.exe -u http://localhost:8080 -o report.json
# Scan multiple targets
.\build\sms.exe -u http://localhost:8080 -u http://localhost:8081
# Load a file containing one URL per line
.\build\sms.exe -f targets.txt -o report.json
# Limit crawl depth
.\build\sms.exe -u http://localhost:8080 --crawl-depth 2
# Use HTTP Basic authentication
.\build\sms.exe -u http://localhost:8080 --auth-basic "username:password"
# Use an HTTP proxy
.\build\sms.exe -u http://localhost:8080 --proxy http://localhost:8082
# Select a test module
.\build\sms.exe -u http://localhost:8080 -t httpheaders@o=owasp,others
| Option | Description |
|---|---|
-u, --url <URL> | Add a target; can be repeated |
-f, --file <FILE> | Read targets from a file |
-c, --config <FILE> | Load a JSON configuration |
-o, --output <FILE> | Save the JSON report |
-d, --crawl-depth <DEPTH> | Set crawl depth: 0 disables crawling, 1 fetches only input URLs, and 2 or higher follows links |
--no-discovery | Equivalent to --crawl-depth 0 |
--no-follow | Equivalent to --crawl-depth 1 |
-s, --scope <REGEX> | Define the scope using a regular expression |
-t, --test <TESTS> | Select modules; can be repeated |
--auth-basic <user:pass> | Set HTTP Basic credentials |
--proxy <URL> | Configure a proxy with an explicit port |
--proxy-auth <user:pass> | Set proxy credentials |
--user-agent <STRING> | Set a custom User-Agent |
--exit-on <LEVEL> | Stop the scan at the informational, low, medium, or high severity threshold |
The CLI accepts proxies using the http:// and socks:// schemes. The socks5:// scheme mentioned in its current help text is rejected by the parser.
With --exit-on, the scan stops when an issue meets or exceeds the requested severity. However, the current implementation returns exit code 1 only if a finding exactly matches the requested severity.
The assets/default-scan-config.json file provides the default configuration: enabled modules, HTTP timeouts, parallel requests, crawling, exclusions, authentication, and form parameters.
To create your own configuration:
Copy-Item assets/default-scan-config.json scan-config.json
# Edit scan-config.json, then start the scan
.\build\sms.exe -c scan-config.json -u http://localhost:8080 -o report.json
Module identifiers accepted by --test are listed under tests.scripts in this file. The --test option replaces the module selection from the configuration.
Findings appear in the console as the scan progresses. The --output option writes a JSON report at the end of the scan, containing:
The destination directory must already exist. An existing report file is overwritten.
Smoke tests (*_smoke.cpp) can be enabled with BUILD_TESTS:
cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release -DCMAKE_PREFIX_PATH="C:\Qt\6.8.3\msvc2022_64" -DBUILD_TESTS=ON
cmake --build build --parallel
ctest --test-dir build --output-on-failure
The current CTest configuration runs all tests without arguments. Some tests, including sms_cli_smoke, issuedb_smoke, and httpheader_smoke, require an argument and must be run separately with the appropriate paths. Running the full CTest suite may therefore report failures caused by this configuration.
For example, run the CLI test with:
.\build\sms_cli_smoke.exe .\build\sms.exe
GUI tests require an environment capable of initializing Qt and WebEngine.
SmartScanner-Source/
├── CMakeLists.txt # Shared library, executables, and tests
├── src/ # Engine, crawler, detectors, CLI, and GUI
├── tests/ # Smoke tests
├── assets/ # Configuration, definitions, and scan resources
├── gui_assets/ # Embedded web interface: HTML, CSS, and JavaScript
├── sms_resources.qrc # CLI Qt resources
├── gui_resources.qrc # GUI Qt resources
├── build.bat # Windows build script
├── build.ps1 # PowerShell build script
└── deploy.ps1 # Copies Qt dependencies for Windows
The original documentation describes this project as proprietary, reconstructed for educational purposes (“Proprietary — Reconstructed for educational purposes”). No separate LICENSE file is included in this repository.