WebAnalyzer

The open-source reconnaissance dashboard

Run 16 recon & security modules against a domain from one interface — then turn the results into a shareable report.

WebAnalyzer bridges passive OSINT enumeration and active vulnerability assessment, wraps it in a real dashboard, and gives you an executive report at the end. Built for penetration testers, bug bounty hunters, and security researchers.

🖥️ Live Dashboard · ⚡ API & Docs · 📝 Deep-dive Article

Why WebAnalyzer?

Most reconnaissance tooling is a pile of separate CLIs you glue together yourself. WebAnalyzer takes the opposite approach:

• 🎛️ One interface, many tools. WHOIS, DNS, subdomains, WAF fingerprinting, SSL/TLS, CloudFlare origin unmasking, port scanning, content & secret scanning, API testing — selectable per scan, from a CLI or a web dashboard.
• 📊 A dashboard, not just logs. A React command center visualizes scores, findings, network maps, threat intel and attack paths in real time — with results persisted to MySQL so nothing is lost between sessions.
• 📄 Reports you can hand over. Every scan can be exported as JSON, CSV, or a styled executive HTML/PDF security report with remediation advice.
• 🛡️ Built to survive real targets. User-agent rotation, adaptive rate-limit backoff, proxy hooks and WAF-aware pacing keep scans running against protected infrastructure.

WebAnalyzer doesn't try to out-scan nuclei or amass — it gives you a cohesive interface and reporting layer on top of proven reconnaissance techniques.

Quick start

🐳 Docker Compose (recommended — everything in one command)

Spins up the MySQL database, FastAPI backend, and React dashboard together, with all system dependencies (Python, Go, Node, Nmap, Subfinder) baked in.

git clone https://github.com/frkndncr/WebAnalyzer.git
cd WebAnalyzer
docker compose up -d --build

• Dashboard: http://localhost:8080
• API docs: http://localhost:8000/docs

📦 pip (CLI only)

pip install webanalyzer-security
webanalyzer

⚡ Manual (developer mode)

git clone https://github.com/frkndncr/WebAnalyzer.git
cd WebAnalyzer
pip install -r requirements.txt

# Backend
uvicorn api:app --host 0.0.0.0 --port 8000 --reload

# Frontend (in a second terminal)
cd dashboard && npm install && npm run dev   # http://localhost:5173

The database is optional for single scans (results also persist to logs/<domain>/results.json). To enable durable storage, set DB_HOST, DB_NAME, DB_USER, DB_PASSWORD — the schema auto-initializes on first connect.

Hosting a public instance? Set DEMO_MODE=true to rate-limit scan requests per client and refuse internal/private/reserved targets (SSRF protection). It's off by default so self-hosted users can scan their own infrastructure. See .env.example.

In demo mode the intrusive modules (Nmap, active content testing, subdomain-takeover and origin probing) only run on domains whose owner has proven control by publishing a DNS TXT record (_webanalyzer.<domain>, shown by the dashboard or GET /api/verify/<domain>). Passive modules (WHOIS, DNS, headers, certificates, archive lookups, ...) stay open to everyone, so a public instance can't be used to port-scan or attack third parties.

What it does

Analysis modules

Plus an Attack Path Planner that chains findings into a logical exploit roadmap. See docs/Modules.md for details.

Command line and CI

pip install webanalyzer-security

webanalyzer scan example.com                      # standard preset
webanalyzer scan example.com --passive -f sarif -o out.sarif --fail-on high
webanalyzer scan -l domains.txt -f jsonl | jq .   # one JSON object per domain
webanalyzer modules                               # list the modules

Output as text, json, jsonl, SARIF (GitHub Code Scanning) or markdown; exit code 1 when a finding reaches --fail-on, so a scan can gate a pipeline. There is also a GitHub Action:

- uses: frkndncr/WebAnalyzer@v3
  with:
    target: example.com
    upload-sarif: "true"     # findings appear in the repository's Security tab
    fail-on: high

See docs/CI.md for every option, exit codes and other CI systems.

Bulk processing

For large jobs (100s–50K+ domains), WebAnalyzer ships a MySQL-backed queue with worker pools, retries and checkpoint recovery:

python domains-check.py --input domains.json --output validated.json   # pre-validate
python bulk_scan.py --load validated.json --job-name "Security Audit"   # create a job
python bulk_scan.py --job-id 1 --workers 10                             # run it
python bulk_scan.py --stats 1                                           # monitor

Highlighted capabilities

• Origin IP unmasking — historical DNS records, subdomain leakage, and SSL SAN validation to find the real IP behind CloudFlare.
• Secrets & JS analysis — Shannon-entropy secret hunting with a 40+ pattern registry, plus taint tracking of location.search/.hash → innerHTML/eval DOM-XSS flows.
• Heuristic API detection — distinguishes real JSON/XML endpoints from HTML-in-404 noise via headers, server stack and response structure.
• Evasion — session/user-agent rotation, adaptive HTTP 429 backoff, and WAF-aware pacing. See docs/Features.md.

Architecture

graph LR
    subgraph Interfaces
      CLI[CLI - main.py]
      UI[React Dashboard]
    end
    API[FastAPI backend - api.py]
    ENG[Module engine + bulk processor]
    DB[(MySQL)]
    MODS[16 analysis modules]

    CLI --> ENG
    UI --> API --> ENG --> MODS
    ENG --> DB
    API --> DB

• Backend: Python 3.8+, FastAPI, a module execution framework, and an optional MySQL layer with connection pooling. Bulk mode processes 1K–50K+ domains via a job queue with retry and checkpoint recovery.
• Frontend: React 19 + Vite, a central API client, live polling, and hand-built SVG visualizations.
• Storage: MySQL is the durable source of truth; local JSON is a fallback cache.

Full details in docs/Architecture.md.

⚖️ Legal & ethical use

WebAnalyzer includes modules capable of active security testing (vulnerability scanning, origin unmasking, authentication-bypass checks).

Only scan systems you own or are explicitly authorized to test.

Respect rate limits and terms of service, follow responsible disclosure, and comply with the laws in your jurisdiction. Unauthorized security testing may be illegal. The authors are not liable for misuse. The public demo is provided for evaluation only — do not use it to test systems you don't own.

Contributing

Contributions are welcome — issues, feature requests, and pull requests all help. See CONTRIBUTING.md and the issue templates. Good places to start: a new analysis module (one file - see Writing a module), dashboard improvements, or test coverage.

# Run the backend test suite
pip install pytest && pytest

# Lint the dashboard
cd dashboard && npm install && npm run lint

Documentation

• Architecture
• Features
• Modules
• Advanced Content Scanner deep-dive
• Changelog · Türkçe README

License & author

Released under the MIT License.

Built by Furkan Dinçer — LinkedIn · Instagram · hi@c4softwarestudio.com