🦀 CrabGuard

Enterprise web security scanner. Burp Suite + OWASP ZAP — without the $400/year license.

pip install crabguard
crabguard scan https://your-site.com

Scans for OWASP Top 10 vulnerabilities and generates a beautiful, branded security report in seconds.

What it checks

Quick Start

# Install
pip install crabguard

# Passive scan (free, no account needed)
crabguard scan https://example.com

# Full active scan (Pro — requires API key)
crabguard scan https://example.com --mode full --api-key YOUR_KEY --consent

# Save as PDF
crabguard scan https://example.com --format pdf --api-key YOUR_KEY

# Route through Burp Suite / OWASP ZAP
crabguard scan https://example.com --proxy http://127.0.0.1:8080

# JSON output for CI/CD
crabguard scan https://example.com --format json --quiet
echo $?  # exit 1 if critical/high findings, 0 if clean

Python API

from crabguard import CrabGuardScanner, CrabGuardConfig, ScanMode

# Free passive scan
scanner = CrabGuardScanner("https://example.com", verbose=True)
report  = scanner.scan()
scanner.save_report(report, "report.html")

# Pro active scan
config  = CrabGuardConfig(api_key="YOUR_KEY", active_consent=True)
scanner = CrabGuardScanner("https://example.com", mode=ScanMode.FULL, config=config)
report  = scanner.scan()
scanner.save_report(report, "report.html")
scanner.save_report(report, "report.pdf", fmt="pdf")

# Access findings programmatically
for finding in report.all_findings:
    print(f"[{finding.severity.value.upper()}] {finding.title}")
    if finding.remediation:
        print(f"  Fix: {finding.remediation}")

CI/CD Integration (GitHub Actions)

- name: Security scan
  run: |
    pip install crabguard
    crabguard scan ${{ env.STAGING_URL }} --format json --quiet
  # Fails the build automatically if critical/high findings are found

Report Sample

CrabGuard generates a full HTML or PDF report with:

• Overall security score (0–100)
• Per-category scores and OWASP Top 10 mapping
• Detailed findings with remediation steps and code snippets
• CrabGuard branded watermark (white-label available on Pro)

Pricing

Get your API key at ashishjsharda.github.io/crabguard

⚠️ Responsible Use

Active scanning sends real payloads to the target server. Only scan systems you own or have explicit written permission to test. Unauthorized scanning may be illegal under the CFAA and similar laws. Always pass --consent to confirm you have permission.

License

MIT — free to use, modify, and distribute. See [LICENSE](LI