/web

RAPTOR web application security scanner

The /web command is currently in alpha and should be considered a stub. It is not yet fully implemented and should not be relied upon for production security testing.

Overview

The /web command performs security scanning on web applications to detect OWASP Top 10 vulnerabilities. It’s an alias for /raptor-web and provides automated web application security testing.

Syntax

python3 raptor.py web --url <url> [options]

Parameters

url · string · required

Full URL of the web application to scan (e.g., https://example.com)

auth-token · string

Authentication token for authenticated scanning (e.g., Bearer token)

crawl-depth · integer

Maximum depth for web crawler (default: 3)

max-pages · integer

Maximum number of pages to scan

What It Does

1. Crawls the target web application
2. Identifies injection points and attack surfaces
3. Tests for OWASP Top 10 vulnerabilities
4. Generates detailed vulnerability reports
5. Provides remediation guidance

Examples

Basic Web Scan

python3 raptor.py web --url https://example.com

Scans a public web application.

Authenticated Scan

python3 raptor.py web --url https://example.com --auth-token "Bearer xyz123"

Scans with authentication credentials.

Limited Scope Scan

python3 raptor.py web --url https://example.com --crawl-depth 2 --max-pages 50

Limits scan scope for faster results.

Vulnerability Types Detected

• Injection: SQL injection, command injection, LDAP injection
• Broken Authentication: Session management issues
• Sensitive Data Exposure: Unencrypted data transmission
• XML External Entities (XXE): XML parsing vulnerabilities
• Broken Access Control: Authorization bypass
• Security Misconfiguration: Server misconfigurations
• Cross-Site Scripting (XSS): Reflected, stored, DOM-based
• Insecure Deserialization: Object injection
• Using Components with Known Vulnerabilities: Outdated libraries
• Insufficient Logging & Monitoring: Security logging gaps

Output Structure

out/web_scan_<timestamp>/
├── findings.json         # Vulnerability findings
├── crawl-map.json       # Site structure
├── report.html          # Interactive report
└── recommendations.md   # Fix guidance

Use Cases

• Web application security auditing
• OWASP Top 10 compliance testing
• Pre-production security validation
• Bug bounty reconnaissance

Ethical Usage

Only scan applications you own or have explicit written permission to test.

Unauthorized security testing is illegal and unethical. Always:

• Obtain written authorization
• Respect scope limitations
• Follow responsible disclosure practices
• Comply with applicable laws and regulations

Related Commands

/scan

Static analysis for source code

/validate

Validate exploitability of findings

/exploit

Generate exploit PoCs

/patch

Generate security patches

Notes

• This command is currently in alpha development
• Results are saved to out/web_scan_<timestamp>/
• For defensive security research and authorized testing only
• Always follow responsible disclosure practices