w-digital-scanner/w13scanPassive and active web vulnerability scanner with plugin-based detection for XSS, SQL injection, command injection, and sensitive file disclosure. Supports proxy mode and automated crawling integration.
W13scan is an open-source web vulnerability discovery tool based on Python3. It supports active and passive scanning modes and can run on Windows, Linux, and Mac.
HTML template source code: w13scan-report
Please comply with local laws before using W13Scan. W13Scan is provided for educational purposes only.
Compared to other professional scanning tools, w13scan also has its own unique advantages.
Security professionals may not trust any program; the only thing that can somewhat earn trust is open source code.
Security is built on trust, and trust requires openness and transparency. The core code of w13scan is completely open source, and anyone can inspect its code security.
It can easily adapt to some tricky and highly specialized environments. You can supplement its functionality according to the w13scan development documentation and customize required modules.
w13scan has tested multiple scanning platforms. Below are the test reports:
| Platform Name | Scan Results | Scan Mode |
|---|---|---|
| WVS PHP Vulnweb | View | crawlergo + w13scan automatic scanning |
| WVS AJAX Vulnweb | View | Passive scanning |
| demo.aisec.cn | View | Passive scanning |
usage: w13scan [options]
optional arguments:
-h, --help show this help message and exit
-v, --version Show program's version number and exit
--debug Show programs's exception
--level {1,2,3,4,5} different level use different payload: 0-5 (default 2)
Proxy:
Passive Agent Mode Options
-s SERVER_ADDR, --server-addr SERVER_ADDR
server addr format:(ip:port)
Target:
options has to be provided to define the target(s)
-u URL, --url URL Target URL (e.g. "http://www.site.com/vuln.php?id=1")
-f URL_FILE, --file URL_FILE
Scan multiple targets given in a textual file
Request:
Network request options
--proxy PROXY Use a proxy to connect to the target URL
eg:[email protected]:8080 or [email protected]:1080
--timeout TIMEOUT Seconds to wait before timeout connection (default 30)
--retry RETRY Time out retrials times.
Output:
output
--html When selected, the output will be output to the output
directory by default, or you can specify
--json JSON The json file is generated by default in the output
directory, you can change the path
Optimization:
Optimization options
-t THREADS, --threads THREADS
Max number of concurrent network requests (default 31)
--disable DISABLE [DISABLE ...]
Disable some plugins (e.g. --disable xss sqli_error
webpack)
--able ABLE [ABLE ...]
Enable some moudle (e.g. --enable xss webpack)
Installing w13scan requires Python 3.6 or above.
git clone https://github.com/w-digital-scanner/w13scan.git
cd w13scan # 进入git目录
pip3 install -r requirements.txt
cd W13SCAN # 进入源码目录
python3 w13scan.py -h
python3 w13scan.py -s 127.0.0.1:7778 --html # 端口可省略，默认为7778,开启--html即实时生成html报告
If you want w13scan passive mode to support HTTPS, start w13scan first, then visit http://w13scan.ca in your browser to download and trust the certificate.
-u Input a URL for scanning
--file Read URLs from a file for scanning
w13scan performs parameter analysis on URLs and scans using plugins, but does not perform crawling.
In the directory crawlergo_example, spider.py demonstrates how to integrate with the crawlergo crawler.
Modify the settings related to the reverse connection platform in config.py. You can modify it similarly as follows:
# REVERSE
USE_REVERSE = True # 使用反连平台将False改为True
REVERSE_HTTP_IP = "127.0.0.1" # 回连http IP地址，需要改为服务器ip，不能改为0.0.0.0，因为程序无法识别
REVERSE_HTTP_PORT = 9999 # 回连http端口
REVERSE_DNS = "dnslog.w13scan.hacking8.com" # 修改为自己的域名，并将域名dns修改为本机IP
REVERSE_RMI_IP = "127.0.0.1" # Java RMI 回连IP,需要改为服务器ip，不能改为0.0.0.0，因为程序无法识别
REVERSE_RMI_PORT = 10002 # Java RMI 回连端口
REVERSE_SLEEP = 5 # 反连后延时检测时间，单位是(秒)
Then start the reverse connection platform first:
python3 reverse.py
Then start w13scan.
w13scan is open source, and we hope security researchers will integrate w13scan into their own scanners.
Please refer to the Development Documentation