PyVscan
A modular, command-line web application scanner. It crawls a target site, maps its forms and URL parameters, checks for three of the most common OWASP Top 10 flaws, and compiles the findings into a clean executive dashboard.
The problem
Manual web application security checks are slow and often out of reach for small businesses, which is why so many are breached through basic, well-known flaws. PyVscan shows how a lightweight, automated internal scanner can give a business low-cost visibility into its own attack surface, and hand developers a prioritised, plain-English fix list instead of a wall of raw logs.
What it does
- Crawls a site's pages, forms and input fields to a set depth, and strictly refuses to follow links off the target domain.
- Checks form fields and URL parameters for SQL-injection error signatures across common databases.
- Checks for reflected cross-site scripting by confirming whether input comes back unescaped.
- Flags state-changing forms that have no anti-CSRF token.
- Supports scanning behind a login by passing an active session.
- Produces a single self-contained HTML report with severity counts and, per finding, the impact and a plain-English fix.
Non-destructive by design
Every check detects and proves a flaw exists; none of them attempt real exploitation, data extraction or destructive requests. The tool is for authorised security assessments only.