WebSec-Audit

Professional web security audit framework — modular, extensible and production-ready.

Legal notice: This tool is designed exclusively for testing systems you own or have explicit written authorisation to test. Unauthorised use against third-party systems is illegal.

What is WebSec-Audit?

WebSec-Audit is a modular Bash FrameWork that automates comprehensive, professional web security audits against any authorised target. It is designed to run on Debian, Ubuntu and Kali Linux, and covers most of the attack surface a pentester or security analyst needs to evaluate in a web application.

I built it as a personal project during my Cybersecurity Specialization degree, with the goal of having my own modular tool that can be easily adapted to different engagements.

The result is a framework of over 2,500 lines of Bash integrating more than 15 independent modules, a structured findings engine and a report generator in three formats.

Modules

Scan modes

The script supports three modes:

Normal (default): balanced coverage and speed.

./websec-audit.sh -t https://target.com

Aggressive (--aggressive): deeper scan, more noise. nmap with -A -O --script=vuln, sqlmap level 5 with tamper scripts, full crawl, dalfox with deep DOM XSS.

./websec-audit.sh -t https://target.com --aggressive -T 20

Stealth (--stealth): slower, lower detection footprint. nmap -T2 -f, sqlmap with delays and safe-freq.

./websec-audit.sh -t https://target.com --stealth

Modular control

Any module can be disabled independently:

./websec-audit.sh -t https://target.com --skip-nikto --skip-sqli --skip-cms

This lets you tailor the scan to the scope of each engagement, reduce total runtime or avoid tools that generate too much noise in sensitive environments.

Proxy support

All traffic can be routed through Burp Suite or any other HTTP proxy:

./websec-audit.sh -t https://target.com --proxy http://127.0.0.1:8080

Reports

On completion, the script generates three report formats under results_<domain>_<timestamp>/reports/:

Interactive HTML dashboard

The most visual format. Includes:

• Summary panel with counters per severity (CRITICAL / HIGH / MEDIUM / LOW / INFO)
• Visual risk bar
• Findings table with live severity filter and full-text search
• Evidence and remediation recommendation per finding
• Scan metadata: target, IP, duration, mode, modules executed

Structured JSON

Fully structured format with a metadata envelope, summary and findings array. Ideal for integrating with other tools or automated pipelines.

{
  "metadata": { "target": "https://target.com", "duration_secs": 342 },
  "summary":  { "total": 18, "critical": 2, "high": 5 },
  "findings": [
    {
      "severity": "CRITICAL",
      "module": "RECON",
      "title": "DNS Zone Transfer (AXFR) permitted",
      "evidence": "...",
      "recommendation": "Restrict AXFR to authorised secondary name servers only."
    }
  ]
}

Plain-text log

Full timestamped log for archiving or inclusion in formal audit reports.

Output structure

results_target_20260323_120000/
├── logs/
│   ├── audit_20260323_120000.log
│   └── findings.jsonl
├── recon/          (WHOIS, DNS, subdomains, WhatWeb, WAF, Dorks)
├── portscan/       (nmap .txt .xml .gnmap)
├── ssl/            (testssl.json, sslscan.txt)
├── headers/        (response headers)
├── dirs/           (gobuster, sensitive paths found)
├── vulns/          (sqlmap, xss, nuclei)
├── cms/            (wpscan, droopescan)
├── misc/           (cors, open_redirect, ssrf, subtakeover)
└── reports/
    ├── report_*.html
    ├── report_*.json
    └── report_*.txt

Installation

Automatic install (recommended)

git clone https://github.com/davidalvarezp/websec-audit.git
cd websec-audit
chmod +x install.sh websec-audit.sh
sudo ./install.sh

The install.sh script detects the system, installs all required APT packages and downloads pre-compiled Go binaries (gobuster, subfinder, ffuf, dalfox, subjack, nuclei, amass) for the correct architecture.

Required dependencies

Only curl and nmap are strictly required. All other tools are optional and expand the coverage of each module.

Usage examples

# Standard scan
./websec-audit.sh -t https://target.com

# Aggressive scan with 20 threads, JSON output only
./websec-audit.sh -t https://target.com --aggressive -T 20 --format json -o /tmp/audit

# Stealth scan through Burp Suite
./websec-audit.sh -t https://target.com --stealth --proxy http://127.0.0.1:8080

# Fast scan skipping slow modules
./websec-audit.sh -t https://target.com --skip-nikto --skip-sqli -v

# Full port scan in aggressive mode
./websec-audit.sh -t https://target.com --ports full --depth 5 --aggressive

Design decisions

A few choices worth explaining:

Why Bash? Bash is universally available on every Linux distribution used in security work, requires no runtime dependencies, and integrates natively with the tool ecosystem (nmap, sqlmap, gobuster, etc.). A Python wrapper would add flexibility but also a dependency layer that breaks in constrained environments.

Why modular? Every engagement has a different scope. Being able to disable individual modules with a single flag means the same tool works for a quick header audit, a full black-box assessment, or anything in between.

Why three report formats? HTML is for humans reviewing findings interactively. JSON is for programmatic processing, integration with ticketing systems or feeding into a SIEM. TXT is for formal audit deliverables that need to be plaintext.

Why JSONL for findings? Each finding is written as a single JSON line to findings.jsonl as it is discovered. This means a partial run (interrupted by Ctrl-C) still produces a valid, processable findings file.

Repository

The project is published on GitHub under the MIT licence. It includes full documentation, an automatic installer, CI with ShellCheck, issue and PR templates, and a CHANGELOG.

🔗 github.com/davidalvarezp/websec-audit

Contributions are welcome. If you find a bug or have an idea for a new module, open an issue or a pull request following the guide in CONTRIBUTING.md.

Last update: March 2026