Stapler

Industrial-grade, from-scratch network / web / server vulnerability scanning and exploit framework for Python. Cross-platform (Windows + Linux auto-detect), with a shared engine exposed through both a CLI and a web dashboard.

Use only on systems and networks you are authorized to test.

Install

pip install stapler-scanner

Quick start

stapler selftest                 # verify modules load
stapler scan 192.168.1.0/24     # full automated scan (network+web+server+exploits)
stapler scan https://host/      # web-app focused scan
stapler exploit --list          # list exploit modules
stapler update                  # pull latest CVEs from CISA KEV + NVD
stapler report --format html    # render the last scan
stapler serve                   # launch the web dashboard

Architecture

• stapler.core — platform detection, config, DB, scheduler, orchestrator, updater.
• stapler.modules.network — host discovery, port scan, service/version, OS fingerprint.
• stapler.modules.web — headers, tech detection, dir brute, SSL/TLS, OWASP checks.
• stapler.modules.server — SSH audit, software versions, misconfig.
• stapler.modules.exploits — RCE tier, Windows 10 tier, and signature-based CVEs (auto-loaded from exploits_db.json, refreshed by stapler update).
• stapler.web — Flask REST API + dashboard.
• stapler.reporting — JSON / HTML / CSV / Markdown reports with CVSS-style scoring.

Safety

Detection runs by default. Active exploitation is gated behind --exploit --yes and prints an authorized-use warning before any payload is sent.

License

MIT