summit-scanner 0.7.5

One scriptable CLI for web security testing: scanner, proxy, fuzzer, authorization testing, WAF analysis, link-hijack detection and recon.
Free where the equivalents are paid - by Pennacle Security.

We use Burp and ZAP every day. We also kept wanting three things they are not: a scanner we can script against in CI, findings that tell us how sure they are, and a codebase small enough to read in one sitting. Summit is that tool - v0.6, MIT, a single pip install summit-scanner away, built in the open.

Full documentation: pennacle-security.github.io/summit

Contents

1. At a glance
2. Quick start
3. Proof, not promises
4. Commands
5. Feature notes
6. Anti false positives and false negatives
7. Check catalog
8. How summit compares
9. Roadmap
10. Community and contributors
11. Contributing and security
12. Legal and license

At a glance

Capabilities that usually sit behind paid tooling, plus the scanning core:

Every finding carries a confidence label: confirmed (an observed fact) or potential (a heuristic). That distinction runs through the entire tool.

Quick start

pip install summit-scanner        # from PyPI
# or from a git checkout:
git clone https://github.com/pennacle-security/summit.git
cd summit
pip install -e .

Python 3.10+. Then watch it work against a deliberately vulnerable local target:

python examples/vuln_app.py        # terminal 1 - the target (127.0.0.1 only)
summit scan http://127.0.0.1:8765  # terminal 2 - the scan

A fuller pass on a real engagement looks like this:

summit recon target.com --json recon.json                 # subdomains -> hosts -> ports
summit scan https://target.com --depth 2 --rate 10        # crawl + all checks
summit scan --openapi api-spec.json                       # API: scan what the spec admits to
summit authorize https://target.com/admin?user=1 \
  --role 'admin=Cookie: session=abc' \
  --role 'user=Cookie: session=xyz'                       # BOLA/IDOR testing

Proof, not promises

Every claim on this page is reproduced by examples/evidence.py - it runs the demo target live, measures each feature, and prints PASS/FAIL with the real numbers. CI executes it on every push; a claim that stops holding fails the build.

[PASS] full scan: 16 seeded check families detected, zero false positives
       53 findings in 22.9s (344 requests), missing=none, control link flagged=no, 19 finding(s) carry confidence=confirmed
[PASS] resource takeover fingerprint detected on the target's own 404
       Possible AWS S3 resource takeover | AWS S3: 'nosuchbucket'
[PASS] host header injection: marker domain echoed back by the app
       Host: summit-host-probe.example -> reflected (reset-link poisoning surface)
[PASS] CORS reflects an arbitrary origin with credentials allowed
       ACAO: https://summit-cors-probe.example; ACAC: true
[PASS] WAF bypass: naive filter blocks, tampered payload lands decoded
       raw payload -> HTTP 403 (blocked); URL-encoded once -> HTTP 200, payload reflected decoded: True
[PASS] CAPTCHA challenge detected (reported, not solved)
       /login -> reCAPTCHA via marker 'recaptcha/api.js'
[PASS] rate limiting: --rate 5 paces 12 requests to ~2.2s; unlimited runs free
       12 requests at rate 5 -> 2.20s (theoretical floor: 2.2s); 12 requests unlimited -> 0.02s
[PASS] concurrency on a latency-bearing target: 8 workers vs serial
       40 requests x 25ms latency: serial 1.33s -> parallel 0.18s (7.3x speedup)
[PASS] smart prioritizer ranks known-injectable parameters first
       probing starts with: [('query', 'search?query=laptop'), ('id', 'user?id=1'), ('url', 'example.com')]
[PASS] toolkit decodes JWT header/payload and states the signature is unverified
       signature NOT verified - decoding only
[PASS] update check compares versions numerically (0.3 < 0.10)
       is_outdated('0.3.0', '0.10.0') -> True; is_outdated('1.0.0', '0.9.9') -> False
[PASS] broken access control: admin panel served identically to a low-privilege role
       verdict=broken; finding=Broken access control (BOLA/IDOR candidate)
[PASS] hidden parameter mining finds the undocumented debug parameter, zero noise
       1 finding(s): ['debug'] (all confirmed reflections)
[PASS] openapi-driven scan: spec alone leads the engine to seeded SQLi and XSS
       2 spec target(s) scanned -> 10 findings, sqli-error=yes, xss-reflection=yes
[PASS] OS command injection: marker executed and echoed by the server
       semicolon: exec marker x2, control marker x1 | CWE-78
[PASS] server-side template injection: {{7*7}} came back as 49
       Jinja2/Twig: {{7*7}} -> 49 | CWE-1336
[PASS] CRLF injection: X-Summit-CRLF header materialized in the response
       X-Summit-CRLF: injected | CWE-113
[PASS] sensitive file exposure: /.env confirmed by content signature
       content signature: 'APP_KEY=' | CWE-538
[PASS] CVE detection: Apache/2.4.49 banner maps to known CVEs
       detect_cves('Apache/2.4.49') -> ['CVE-2021-41773', 'CVE-2021-42013']

evidence summary: 19/19 claims verified

A visual of a real scan against the demo target:

Reproduce everything yourself:

python examples/vuln_app.py    # terminal 1 - the target
summit scan http://127.0.0.1:8765
python examples/evidence.py    # re-verify every claim above

The demo seeds a healthy outbound link (https://example.com) as a negative control - it must never be reported, and CI asserts that alongside the seeded detections. Found something wrong anyway? Report it.

Commands

Shared flags on scanning commands: --workers, --rate (requests/second ceiling), --retries (with Retry-After support), --timeout, --delay.

Feature notes

Authorization testing. Requests each URL as a privileged and a low-privilege role, then compares. Verdicts: enforced (roles differ), broken (identical response for the low-privilege role - critical, confirmed), partial (same status, different body - potential). Measured on the demo: the admin panel serves salaries to both roles, caught as confirmed.

Hidden parameter mining. Servers read parameters the HTML never mentions - debug switches, feature flags, internal overrides. ~70 candidate names are probed with unique markers; reflection findings are confirmed, status/size shifts are potential. Measured: the demo's undocumented debug switch found as confirmed, the other candidates silent - zero noise.

OpenAPI-driven scanning. Every documented endpoint becomes a target, with path params filled from examples and defaults - no crawling, no guessing. Measured: the spec alone leads the engine to the seeded SQLi and XSS. JSON and YAML specs are read natively.

WAF detection and bypass. Tight vendor signatures for Cloudflare, AWS WAF, Akamai, Imperva, ModSecurity, Sucuri, F5 and Wordfence. When a filter blocks standard payloads, tamper variants (single/double URL-encoding, comment splitting, case alternation) are tried - and a bypass is reported only when the original payload lands decoded in the response. Measured: raw payload -> HTTP 403; encoded once -> HTTP 200, decoded.

OS command injection, SSTI, CRLF, sensitive files. New in v0.6, each with a hard confirmation rule: OS command injection uses an exec marker plus a control probe (a server that merely reflects input shows both markers; a server that executes shows the exec marker more often - measured x2 vs x1), SSTI requires {{7*7}} to come back as 49, CRLF requires our injected header to materialize, and sensitive files (.env, .git/config, backups) require a content signature - never just a 200. Every finding is tagged with its CWE automatically (CWE-78, CWE-1336, CWE-113, CWE-538), and version banners are matched against an offline CVE database (spoofable banners stay potential).

CAPTCHA: detect, do not solve. reCAPTCHA, hCaptcha, Cloudflare Turnstile and challenge pages are detected and reported. Solving them automatically is out of scope by design - that line does not move.

Broken-link hijacking. Every outbound link is health-checked: dead domains (DNS verified twice), parked domains (tight fingerprints), broken links (404/410), unreachable hosts, and private-target links - recorded but never fetched, so a hostile page cannot weaponize your scanner as an SSRF probe.

Resource takeover fingerprints. A 404 answered with a provider's unclaimed-resource page (AWS S3, GitHub Pages, Heroku, Azure, Shopify, Fastly, Pantheon, Tumblr, Surge, Bitbucket) is a takeover setup. Fingerprint-only: no DNS tricks, no active claiming, ever.

Recon orchestration. subfinder -> httpx -> nmap, whichever are installed, with defensive parsing: passive-DNS noise capped, per-tool timeouts degrade into notes, and a crashed nmap is reported as failed - never as "no open ports".

Rate limiting and prioritization. --rate is a thread-safe requests/second ceiling (measured: 12 requests paced to 2.20s at rate 5; 0.02s unlimited). A transparent scoring model orders high-signal parameters first - deterministic and auditable, deliberately not a "neural network" claim.

Toolkit and updates. JWT decode with an honest "signature NOT verified" note, base64/URL/hex both directions, numeric version comparison against GitHub releases (0.3 < 0.10), self-update from a git checkout.

Anti false positives and false negatives

False positives waste your triage time. False negatives get clients breached. Summit engineers against both, and the evidence runner proves it:

Check catalog

How summit compares

We are not trying to replace either of them. Summit is the small tool you drop into a pipeline or onto a VPS box, and the codebase you can actually read line by line.

Roadmap

• TLS interception in the proxy (generated CA)
• POST form and JSON body injection points
• Authenticated scanning (cookies, headers)
• CNAME-level subdomain takeover (DNS resolution + service verification)
• Plugin API for custom checks
• Request interception UI

Community and contributors

A repository that helps people back grows through word-of-mouth:

• Questions -> Q&A discussion - beginner questions welcome, answered gladly
• Ideas & roadmap votes -> Ideas
• Show what you scanned -> Show and tell
• Your first contribution -> good first issues come with step-by-step instructions
• First issues and PRs get a personal review and a spot below; the welcome bot says hello too

If summit saved you time on an engagement, a star helps the next person find it.

SakarPaisen 💻

mrvi0 💻

Contributing and security

PRs welcome - the contributing guide covers the process, and adding a scan check is roughly thirty lines if you follow the pattern. examples/vuln_app.py gives you a live target to test against.

Security issues go through private disclosure only. Details in the security policy.

Legal and license

Summit is built for authorized security testing: your own systems, or systems you have written permission to test. We are not responsible for misuse. Licensed under MIT.