Web Penetration Testing Toolkit

Hey, I'm Jagan Jijo — yes, the person who built this instead of studying properly for CEH. 👋 I am a MSc Cybersecurity graduate currently working as a backend software engineer, who thought building this would help me understand this tools better than using sgpt🏃

This is a Python / FastAPI web app that gives you a browser-based interface for reconnaissance, vulnerability discovery, and stress-testing. Everything streams live to the UI via Server-Sent Events (SSE) — no page reloads, no waiting, just results flying in real time.

"But why not Django?" Oh I know Django. I know Django. But let's be honest — Django for a security toolkit with live streaming is like bringing a whole kitchen to make instant noodles. Flask? Cute little framework, bless its heart, but I'm not writing a callback pyramid in 2026. FastAPI gives you async out of the box, automatic OpenAPI docs, Pydantic validation, and it's genuinely fun to write. It just makes sense here. (not because I use fastapi everyday for the last two years lol:)

And the frontend? Pure vanilla JS + CSS custom properties. No React, no 47 npm packages, no node_modules folder that weighs more than my laptop. Just clean, fast, no-build-step HTML that actually loads instantly. Sometimes boring is beautiful. 🤷

⚠️ Disclaimer: Use for educational purposes only. Use at your own risk. I do not stand responsible for what you do with this tool. Do not use against systems or mailboxes you do not own or have explicit written permission to test.

• Tech Stack
• Project Structure
• Setup & Usage
• Features Overview
• Tools & Endpoints
  • 1. Dashboard / Security Tests
  • 2. Advanced Google Dorking
  • 3. Sherlock — Username OSINT
  • 4. WHOIS Lookup
  • 5. DNS Intelligence
  • 6. File Analysis
  • 7. hping3 Flood Test
  • 8. Mail Bomber
  • 9. Web Server Vulnerability Scanner
• License

web-pen-testing/
├── python/
│   ├── main.py                          # FastAPI app entry point
│   ├── core/
│   │   ├── logging_config.py
│   │   ├── templates.py
│   │   └── url_utils.py
│   ├── routes/
│   │   ├── api.py                       # All JSON + SSE API endpoints
│   │   ├── pages.py                     # HTML page routes
│   │   └── dashboard.py
│   └── services/
│       ├── advanced_google_dorking.py
│       ├── architecture_version.py
│       ├── banner_grabbing.py
│       ├── dns_lookup.py
│       ├── file_analysis.py
│       ├── footprinting.py
│       ├── google_dorking.py
│       ├── idor_test.py
│       ├── mail_bomber.py
│       ├── metadata_analysis.py
│       ├── port_scanner.py
│       ├── recon_ng_runner.py
│       ├── security_tests.py
│       ├── sherlock_service.py
│       ├── site_report.py
│       ├── webserver_vuln_scanner.py    # Nginx/Apache CVE scanner
│       └── whois_lookup.py
├── frontend/
│   ├── static/
│   │   └── styles.css                   # Shared dark-theme CSS
│   └── templates/
│       ├── index.html
│       ├── advanced_dorking.html
│       ├── dns_lookup.html
│       ├── file_analysis.html
│       ├── hping3.html
│       ├── mail_bomber.html
│       ├── sherlock.html
│       ├── whois.html
│       └── webserver_vuln_scanner.html
├── start.sh
├── vercel.json
├── requirements.txt
└── readme.md

# Debian / Ubuntu / Kali
sudo apt install hping3 nikto nmap

# Optional: nginxpwner (advanced Nginx scanning)
git clone https://github.com/stark0de/nginxpwner /opt/nginxpwner

# Optional: apache-vulnerability-testing
git clone https://github.com/mrmtwoj/apache-vulnerability-testing /opt/apache-vulnerability-testing

# Optional: ApacheTomcatScanner
pip install ApacheTomcatScanner

# 1. Clone
git clone https://github.com/jagan-jijo/web-pen-testing
cd web-pen-testing

# 2. Virtual environment
python3 -m venv myenv
source myenv/bin/activate        # Windows: myenv\Scripts\activate

# 3. Install dependencies
pip install -r requirements.txt

# 4. Launch  (pre-caches sudo for hping3)
chmod +x start.sh && ./start.sh

# Or directly:
uvicorn python.main:app --host 127.0.0.1 --port 8000 --reload

# 5. Open http://127.0.0.1:8000

URL: GET / API: POST /api/run_test

Runs a suite of checks against any target URL — all stream live in parallel:

A Site Report panel generates a full dossier (IPs, ASN, trackers, SPF/DKIM, subdomains).

URL: GET /advanced_dorking

Generates targeted dork queries for the domain:

• filetype:pdf/xls/sql site:<domain> — sensitive file exposure
• inurl:admin/login/config — admin panel discovery
• intitle:"index of" — exposed directory listings
• inurl:backup | inurl:dump | inurl:db — backup file discovery
• Concurrent port scan runs alongside dork queries

URL: GET /sherlock API: POST /api/sherlock

Searches hundreds of social platforms (Twitter/X, Instagram, GitHub, Reddit, TikTok, LinkedIn…) for a given username. Results stream live as each site is probed.

• Optional NSFW-site inclusion toggle
• Per-site configurable timeout (5–120 s)
• Claimed / Available / Unknown / WAF result categories with direct profile links

URL: GET /whois Library: python-whois

Full WHOIS record: registrar, registration & expiry dates, nameservers, abuse contacts, raw text.

URL: GET /dns_lookup Library: dnspython

Supports all DNS record types: A, AAAA, MX, NS, TXT, CNAME, SOA, PTR, SRV, CAA

• Custom nameserver support (e.g. 8.8.8.8, 1.1.1.1)
• SPF policy parser and DMARC/DKIM display
• Subdomain enumeration via Sublist3r + DNS brute-force

URL: GET /file_analysis API: POST /api/file_analysis (multipart)

Files are written to temp_uploads/, analysed, then immediately deleted.

URL: GET /hping3 Binary: sudo apt install hping3

SYN/TCP flood stress test with live SSE packet counter output.

Protocol presets: HTTP (80), HTTPS (443), SSH (22), FTP (21), MySQL (3306), custom port.

Only use against systems you own or have explicit written permission to test.

URL: GET /mail_bomber

Sends bulk email via SMTP for deliverability and mailbox stress testing.

• Gmail SMTP (port 587 / STARTTLS) or any custom SMTP server
• Count: 1–500 emails · Delay: 0–60 s between sends
• Live SSE stream — Sent / Failed / Attempted counters update per email
• Optional sender display name for anonymous From header
• Built-in App Password guide and Gmail rate-limits reference

Gmail daily limits:

For educational and authorised testing only. Unsolicited bulk email violates Google TOS, CAN-SPAM (USA), GDPR (EU), and equivalent laws worldwide.

URL: GET /webserver_vuln_scanner
API: POST /api/webserver_scan/start · GET /api/webserver_scan/stream/{id}

Detects Nginx, Apache, or Tomcat then runs targeted CVE checks with live streaming.

1. Reads the Server: HTTP response header
2. Falls back to nmap -sV service fingerprinting if the header is hidden

Nginx (7 CVEs — versions 1.0–1.20):

• CVE-2013-2028 — Stack buffer overflow in chunked encoding → RCE · CRITICAL
• CVE-2021-23017 — Off-by-one resolver heap corruption → RCE possible · HIGH
• CVE-2019-9511 / 9513 — HTTP/2 DoS attacks · HIGH
• CVE-2017-7529 — Range header integer overflow (memory disclosure) · MEDIUM
• • more…

Apache (18+ CVEs — versions 2.2.x – 2.4.50):

• CVE-2021-41773 — Path traversal + RCE via mod_cgi (Apache 2.4.49) · CRITICAL
• CVE-2021-42013 — Double-encoded bypass, RCE (Apache 2.4.50) · CRITICAL
• CVE-2020-11984 — mod_proxy_uwsgi buffer overflow · CRITICAL
• CVE-2019-0211 — Local privilege escalation www-data → root · HIGH
• CVE-2017-9798 — Optionsbleed heap memory leak · HIGH
• • 13 more…

Every CVE card shows a direct 🔥 ExploitDB CVE link + a full keyword search link.

• Nginx: stub_status exposure, alias path traversal, merge_slashes bypass, CVE-2017-7529 Range probe
• Apache: CVE-2021-41773/42013 live path traversal confirmation, mod_status/mod_info, Optionsbleed OPTIONS probe, directory listing
• All servers: Missing security headers (HSTS, CSP, X-Frame-Options…), tech disclosure headers, .git/HEAD exposure, .env leak, phpinfo.php, backup archives, robots.txt analysis

All tools are optional — the scanner works without them and shows install instructions in the UI. Any CVE found by a tool surfaces as an ExploitDB chip link in the results panel.

MIT License

Built as part of CEH training — intended solely for educational purposes and authorised penetration testing in lab environments.

Made by Jagan Jijo
GitHub: github.com/jagan-jijo