> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/Gowtham-Darkseid/AutoPentestX/llms.txt
> Use this file to discover all available pages before exploring further.

# Vulnerability Scanner Module

> Web vulnerability scanning with Nikto and SQL injection testing with SQLMap

## Overview

The Vulnerability Scanner module (`modules/vuln_scanner.py`) integrates two powerful tools for web security testing:

* **Nikto**: Web server vulnerability scanner
* **SQLMap**: Automated SQL injection detection and exploitation tool

## VulnerabilityScanner Class

Defined at `vuln_scanner.py:13`, this class orchestrates web vulnerability detection.

### Initialization

```python vuln_scanner.py:14-24 theme={null}
class VulnerabilityScanner:
    def __init__(self, target, ports_data):
        """Initialize vulnerability scanner"""
        self.target = target
        self.ports_data = ports_data
        self.web_ports = []
        self.vulnerabilities = []
        self.web_vulns = []
        self.sql_vulns = []
        
        self.identify_web_services()
```

<ParamField path="target" type="string" required>
  Target IP address or domain
</ParamField>

<ParamField path="ports_data" type="list" required>
  List of open ports from Scanner module
</ParamField>

## Web Service Detection

### identify\_web\_services()

Automatically detects HTTP/HTTPS services from port scan results.

```python vuln_scanner.py:26-43 theme={null}
def identify_web_services(self):
    """Identify HTTP/HTTPS services from port scan"""
    common_web_ports = [80, 443, 8080, 8443, 8000, 8888, 3000, 5000]
    web_services = ['http', 'https', 'ssl/http', 'http-proxy', 'http-alt']
    
    for port in self.ports_data:
        service = port.get('service', '').lower()
        port_num = port.get('port')
        
        if any(web_svc in service for web_svc in web_services) or port_num in common_web_ports:
            protocol = 'https' if port_num == 443 or 'https' in service else 'http'
            self.web_ports.append({
                'port': port_num,
                'protocol': protocol,
                'url': f"{protocol}://{self.target}:{port_num}"
            })
```

**Detected Services:**

* Standard ports: 80 (HTTP), 443 (HTTPS)
* Alternative ports: 8080, 8443, 8000, 8888, 3000, 5000
* Service names: http, https, ssl/http, http-proxy, http-alt

## Nikto Integration

### scan\_with\_nikto()

Runs Nikto web vulnerability scanner against detected web services.

```python vuln_scanner.py:45-79 theme={null}
def scan_with_nikto(self, url):
    """Run Nikto web vulnerability scanner"""
    cmd = [
        'nikto',
        '-h', url,
        '-Format', 'json',
        '-output', f'logs/nikto_{self.target}_{timestamp}.json',
        '-Tuning', '123456789',  # All tests
        '-timeout', '10'
    ]
    
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
    vulns = self.parse_nikto_output(result.stdout)
    return vulns
```

**Nikto Parameters:**

<ParamField path="-h" type="string">
  Target URL to scan
</ParamField>

<ParamField path="-Format" type="string">
  Output format (json for automated parsing)
</ParamField>

<ParamField path="-Tuning" type="string">
  Test categories: 1-9 enables all vulnerability checks
</ParamField>

<ParamField path="-timeout" type="number">
  Request timeout in seconds (default: 10)
</ParamField>

### Nikto Vulnerability Categories

| Tuning | Category                      |
| ------ | ----------------------------- |
| 1      | Interesting files/directories |
| 2      | Misconfiguration              |
| 3      | Information disclosure        |
| 4      | Injection (XSS/Script/HTML)   |
| 5      | Remote file retrieval         |
| 6      | Denial of service             |
| 7      | Remote file inclusion         |
| 8      | Command execution             |
| 9      | SQL injection                 |

## SQLMap Integration

### scan\_sql\_injection()

Scans for SQL injection vulnerabilities using SQLMap.

```python vuln_scanner.py:129-165 theme={null}
def scan_sql_injection(self, url):
    """Scan for SQL injection vulnerabilities using SQLMap"""
    cmd = [
        'sqlmap',
        '-u', url,
        '--batch',
        '--crawl=2',
        '--level=1',
        '--risk=1',
        '--random-agent',
        '--timeout=30',
        '--retries=2',
        '--threads=5'
    ]
    
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=180)
    return self.parse_sqlmap_output(result.stdout)
```

**SQLMap Parameters:**

<ParamField path="--batch" type="flag">
  Never ask for user input, use default behavior
</ParamField>

<ParamField path="--crawl" type="number">
  Crawl depth for finding injection points (default: 2)
</ParamField>

<ParamField path="--level" type="number">
  Level of tests to perform (1-5, default: 1)
</ParamField>

<ParamField path="--risk" type="number">
  Risk of tests (1-3, default: 1 for safe testing)
</ParamField>

<ParamField path="--threads" type="number">
  Number of concurrent HTTP requests (default: 5)
</ParamField>

### SQL Injection Types Detected

<Tabs>
  <Tab title="Boolean-based">
    Uses boolean logic to infer database content through true/false responses.

    **Example:** `id=1 AND 1=1` (true) vs `id=1 AND 1=2` (false)
  </Tab>

  <Tab title="Time-based">
    Uses database sleep functions to confirm vulnerability through response delays.

    **Example:** `id=1 AND SLEEP(5)`
  </Tab>

  <Tab title="Error-based">
    Forces database errors to extract information from error messages.

    **Example:** `id=1' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT(...)))`
  </Tab>

  <Tab title="UNION-based">
    Uses UNION SQL operator to extract data from other tables.

    **Example:** `id=1 UNION SELECT username,password FROM users`
  </Tab>

  <Tab title="Stacked queries">
    Executes multiple SQL statements separated by semicolons.

    **Example:** `id=1; DROP TABLE users--`
  </Tab>
</Tabs>

## Vulnerability Severity

Vulnerabilities are classified into four severity levels:

<Tabs>
  <Tab title="CRITICAL">
    **CVSS 9.0-10.0**

    Remote code execution, SQL injection with data exfiltration, authentication bypass
  </Tab>

  <Tab title="HIGH">
    **CVSS 7.0-8.9**

    XSS with session hijacking, privilege escalation, file upload vulnerabilities
  </Tab>

  <Tab title="MEDIUM">
    **CVSS 4.0-6.9**

    Information disclosure, CSRF, insecure direct object references
  </Tab>

  <Tab title="LOW">
    **CVSS 0.1-3.9**

    Verbose error messages, outdated software, missing security headers
  </Tab>
</Tabs>

## Complete Workflow

```python vuln_scanner.py:200-230 theme={null}
def run_full_scan(self):
    """Execute complete vulnerability scanning workflow"""
    # 1. Identify web services
    if not self.web_ports:
        return {'vulnerabilities': [], 'web_vulnerabilities': [], 'sql_vulnerabilities': []}
    
    # 2. Scan each web service with Nikto
    for web_port in self.web_ports:
        nikto_vulns = self.scan_with_nikto(web_port['url'])
        self.web_vulns.extend(nikto_vulns)
    
    # 3. Test for SQL injection
    for web_port in self.web_ports:
        sql_vulns = self.scan_sql_injection(web_port['url'])
        self.sql_vulns.extend(sql_vulns)
    
    return {
        'vulnerabilities': self.vulnerabilities,
        'web_vulnerabilities': self.web_vulns,
        'sql_vulnerabilities': self.sql_vulns
    }
```

## Usage Example

```python theme={null}
from modules.vuln_scanner import VulnerabilityScanner
from modules.scanner import Scanner

# Get port scan results
scanner = Scanner("example.com")
scan_results = scanner.run_full_scan()

# Initialize vulnerability scanner
vuln_scanner = VulnerabilityScanner("example.com", scan_results['ports'])

# Run vulnerability scan
vulnerabilities = vuln_scanner.run_full_scan()

print(f"Web vulnerabilities: {len(vulnerabilities['web_vulnerabilities'])}")
print(f"SQL injection points: {len(vulnerabilities['sql_vulnerabilities'])}")
```

## Output Format

```json theme={null}
{
  "web_vulnerabilities": [
    {
      "type": "web",
      "url": "http://example.com:80",
      "severity": "MEDIUM",
      "description": "Server leaks inodes via ETags",
      "osvdb": "3233"
    }
  ],
  "sql_vulnerabilities": [
    {
      "type": "sql_injection",
      "url": "http://example.com/login.php?id=1",
      "parameter": "id",
      "injection_type": "boolean-based blind",
      "payload": "1 AND 1=1",
      "severity": "CRITICAL"
    }
  ]
}
```

## Skipping Web Scans

Use the `--skip-web` CLI flag to disable web vulnerability scanning:

```bash theme={null}
python3 main.py -t example.com --skip-web
```

<Note>
  Web vulnerability scanning can be time-intensive (10-30 minutes per service). Use `--skip-web` for faster reconnaissance-only scans.
</Note>

## Related Documentation

<CardGroup cols={2}>
  <Card title="Web Vulnerabilities Guide" icon="globe" href="/guides/web-vulnerabilities">
    Detailed guide to web vulnerability scanning
  </Card>

  <Card title="Configuration" icon="gear" href="/configuration/settings">
    Nikto and SQLMap timeout settings
  </Card>

  <Card title="CLI Options" icon="terminal" href="/commands/options">
    \--skip-web flag documentation
  </Card>

  <Card title="PDF Reports" icon="file-pdf" href="/output/pdf-reports">
    How web vulnerabilities appear in reports
  </Card>
</CardGroup>