⚔️ OWASP Military Grade Penetration Testing Framework

Asynchronous | Modular | AI-Ready Security Scanner

Features • Installation • Usage • Scanners

---

📋 Overview

A Military Grade Python-based penetration testing framework targeting OWASP Top 10 (2021) vulnerabilities. Built with asynchronous architecture for 10x faster scanning compared to traditional tools.

⚠️ Disclaimer: This tool is for authorized security testing only. Unauthorized use is illegal.

---

🚀 Features

Feature	Description
Async Warfare Engine	aiohttp + asyncio based - 100+ concurrent connections
Stealth Mode	Randomized User-Agents, Jitter delays, WAF bypass
Interactive TUI	Rich interface with banners, panels, and tables
Modular Scanners	Plug-and-play scanner modules
Heavy Payload Support	External .txt payload files - unlimited ammo
Professional Reports	HTML + JSON output for clients
IP Address Support	Network reconnaissance + Web scanning

---

📦 Installation

Prerequisites

• Python 3.8 or higher
• pip (Python package manager)

Quick Install

1. Clone the repository

git clone https://github.com/YOUR_USERNAME/owasp-scanner.git

cd owasp-scanner

2. Install dependencies

pip install -r requirements.txt

3. Create payload directories

mkdir -p payloads reports

4. Run the tool

python main.py

Linux Quick Setup (Optional)

Make executable

chmod +x main.py

Add alias (add to ~/.bashrc)

alias scan='python3 /path/to/owasp-scanner/main.py'

Now run from anywhere

scan

---

🎮 Usage

Interactive Mode (Recommended)

python main.py

Follow the on-screen menu:

1. Enter target URL or IP address
2. Select scanner module(s)
3. View results in real-time
4. Check reports/ folder for HTML/JSON reports

Command Line Arguments

Quick scan with specific module

python main.py --target https://example.com --scanner a03

Full scan (all modules)

python main.py --target 192.168.1.1 --all

Custom config

python main.py --target https://site.com --config config.yaml

---

🔍 Scanner Modules

Code	Module	OWASP	Description
1	Access Control	A01	Admin panels, hidden directories, backup files
2	IDOR Scanner	A01	Insecure Direct Object Reference testing
3	Injection	A03	SQL Injection, XSS, Command Injection
4	Misconfiguration	A05	Server info, sensitive files, debug modes
5	Auth Failures	A07	Weak passwords, session issues
6	SSRF	A10	Server-Side Request Forgery

---

📁 File Structure

owasp-scanner/
├── main.py                 # Entry point
├── requirements.txt        # Dependencies
├── config.yaml            # Configuration
│
├── core/
│   ├── engine.py          # Async HTTP engine
│   ├── base_scanner.py    # Parent scanner class
│   ├── reporter.py        # Report generator
│   └── tui.py             # Terminal interface
│
├── scanners/
│   ├── a00_port_scanner.py
│   ├── a01_access_control.py
│   ├── a01_idor.py
│   ├── a03_injection.py
│   ├── a05_misconfiguration.py
│   ├── a07_auth_failures.py
│   └── a10_ssrf.py
│
├── payloads/              # Create this folder
│   ├── sqli.txt          # SQL Injection payloads
│   ├── xss.txt           # XSS payloads
│   ├── admin_paths.txt   # Admin panel paths
│   ├── backup_files.txt  # Sensitive files
│   ├── idor_params.txt   # IDOR parameters
│   ├── idor_values.txt   # IDOR test values
│   └── ssrf_urls.txt     # SSRF test URLs
│
└── reports/              # Auto-generated
    ├── report.html
    └── report.json

---

📋 Payload Files Setup

Create payloads/ folder and add these files:

Required Payload Files

File	Purpose	Min Lines
sqli.txt	SQL Injection payloads	50+
xss.txt	Cross-Site Scripting	50+
admin_paths.txt	Admin panel paths	100+
backup_files.txt	Sensitive/backup files	100+
ssrf_urls.txt	SSRF test URLs	20+

Example Payloads

sqli.txt:

' OR 1=1--
' UNION SELECT 1,2,3--
' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT DATABASE())))--

ssrf_urls.txt:

http://169.254.169.254/latest/meta-data/
http://metadata.google.internal/computeMetadata/v1/
http://localhost:22

---

⚙️ Configuration

Edit config.yaml to customize:

# config.yaml
scanner:
  timeout: 10
  max_concurrent: 50
  user_agent: random
  jitter_min: 0.5
  jitter_max: 2.0

reports:
  output_dir: reports
  formats:
    - html
    - json

stealth:
  random_delay: true
  rotate_user_agent: true

---

📊 Sample Output

╔══════════════════════════════════════════════════════════════╗
║         OWASP MILITARY GRADE PENETRATION FRAMEWORK           ║
║                      Version 2024.3                          ║
╚══════════════════════════════════════════════════════════════╝

[*] Target: https://example.com
[*] Scanner: A03 - Injection Scanner
[*] Payloads Loaded: 150

┌──────────────────────────────────────────────────────────────┐
│ SCANNING PROGRESS                                            │
├──────────────────────────────────────────────────────────────┤
│ ████████████████████████████████████████ 100% 150/150        │
└──────────────────────────────────────────────────────────────┘

┌──────────┬────────────────────────────────────────────────────┐
│ Severity │ HIGH - SQL Injection Detected                      │
├──────────┼────────────────────────────────────────────────────┤
│ URL      │ https://example.com/product?id=1                   │
│ Payload  │ ' OR 1=1--                                         │
│ Evidence │ MySQL syntax error in response                     │
└──────────┴────────────────────────────────────────────────────┘

[✓] Scan Complete
[✓] Report saved: reports/report_2024-01-15.html

---

🔧 Troubleshooting

Common Issues

Problem	Solution
ModuleNotFoundError	Run pip install -r requirements.txt
Permission denied	Use chmod +x main.py or run with sudo
Connection timeout	Increase timeout in config.yaml
No payloads found	Create files in payloads/ folder

---

📜 Requirements

aiohttp>=3.8.0
rich>=13.0.0
pyyaml>=6.0
colorama>=0.4.6

Install all:

pip install aiohttp rich pyyaml colorama

---

🤝 Contributing

1. Fork the repository
2. Create feature branch (git checkout -b feature/new-scanner)
3. Commit changes (git commit -m 'Add new scanner')
4. Push to branch (git push origin feature/new-scanner)
5. Open Pull Request

---

📜 License

This project is licensed under the MIT License - see LICENSE file.

---

⚠️ Legal Disclaimer

This tool is provided for educational purposes and authorized security testing only.

• Always obtain written permission before testing
• Unauthorized access to computer systems is illegal
• The authors assume no liability for misuse

---

Built with ❤️ for Security Researchers

⬆ Back to Top