WebSec-Audit
Professional Web Security Audit Framework — modular, extensible, Bash-native
Legal Notice
This tool is intended exclusively for authorised security assessments. Only run it against systems you own or have explicit written permission to test. Unauthorised use is illegal. The author assumes no liability for misuse.
What is WebSec-Audit?¶
WebSec-Audit is a Bash framework that automates comprehensive web application security audits. It integrates 15+ independent modules — from passive reconnaissance to active exploitation — and produces professional findings reports in three formats.
Designed to run on Debian, Ubuntu and Kali Linux with zero mandatory dependencies beyond curl and nmap.
Feature highlights¶
-
Modular architecture
Enable or disable any of the 15+ modules with a single
--skip-<module>flag. -
Three scan modes
Normal, Aggressive and Stealth — adapt the scan depth to each engagement.
-
Rich reports
Interactive HTML dashboard, structured JSON and plain-text log — generated automatically.
-
Broad coverage
Recon · Port scan · SSL/TLS · Headers · SQLi · XSS · SSRF · CORS · CMS · Takeover · Nuclei
-
Proxy support
Route all traffic through Burp Suite or any HTTP proxy with
--proxy. -
Tool-agnostic
Graceful fallback when optional tools are absent. Core scan works with only
curl+nmap.
Modules at a glance¶
Quick start¶
git clone https://github.com/davidalvarezp/websec-audit.git
cd websec-audit
chmod +x install.sh websec-audit.sh
sudo ./install.sh
./websec-audit.sh -t https://target.com
See Installation and Quick Start for details.
Author¶
Built by davidalvarezp.