Abstract

Manual penetration testing needs specialist skills that most student developers and small teams simply don\'t have time to build, and the commercial DAST products that automate this work — Burp Suite Professional, Acunetix, Nessus — are priced for enterprise budgets rather than a college project or a solo developer\'s side application. Mature open-source alternatives such as OWASP ZAP close the cost gap but not the usability one: getting useful output still means learning how to configure a scan policy, spider a target, and read through a long list of raw findings. This paper describes VulnScanner Pro, a self-hosted assessment tool that tries to sit in the gap between those two extremes. It runs eight checks against a target URL — SQL injection, cross-site scripting, HTTP security-header analysis, SSL/TLS configuration, CSRF protection, WHOIS, IP geolocation, and Nmap-based port scanning — behind a FastAPI backend and a Next.js dashboard, storing every scan in SQLite so past results can be revisited later. A rule-based scoring function turns the combined module output into one 0–100 risk number and a CRITICAL/HIGH/MEDIUM/LOW label, and a matching recommendation engine looks up remediation text and reference links for whatever was found Active scanning of a system that you don’t own can be a legal problem as much as a technical one. So the API by default won’t start a scan of a system unless you explicitly pass in a consent flag and some text justification for why you are scanning the system. In a case study on a web application owned by the second author, the authors ran the full eight-module automated security assessment. It took about a minute to run the assessment and it reported a risk score of 20 out of 100 or LOW. The six checks for missing HTTP security headers were the only issues found. The checks for SSL/TLS, SQL injection, Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF) all reported that they found no issues. Only the two expected web ports (80 and 443) were open on the web application. The risk breakdown for the web application is shown below along with four recommendations for fixing the six missing HTTP security headers. Each of the recommendations are linked to authoritative external references for additional information on how to fix each of the issues found..

Introduction

Modern web applications are often developed and released quickly, causing security reviews to be overlooked. Although professional security testing through code reviews and penetration tests provides the most accurate results, it requires skilled experts and can be expensive for students, individual developers, and small teams. Existing commercial Dynamic Application Security Testing (DAST) tools such as Burp Suite Professional, Acunetix, and Nessus are costly, while open-source tools like OWASP ZAP, though powerful, require advanced security knowledge for configuration and interpretation.

VulnScanner Pro aims to bridge this gap by providing a lightweight, affordable, self-hosted first-pass security scanner. It allows developers to enter a URL, perform automated vulnerability checks, and receive a simple risk score with prioritized, human-readable findings instead of complex technical reports.

Problem Definition:

The project addresses several challenges:

• Lack of affordable self-hosted scanners covering common OWASP-based vulnerabilities.
• Difficulty interpreting raw security scan outputs.
• Absence of built-in authorization checks before scanning targets.
• Need for quick, prioritized vulnerability information rather than lengthy unranked reports.

Objectives:

The main goals of VulnScanner Pro are:

1. Develop eight security assessment modules covering:
   • SQL Injection
   • Cross-Site Scripting (XSS)
   • HTTP security headers
   • SSL/TLS configuration
   • CSRF protection
   • WHOIS lookup
   • IP geolocation
   • Nmap-based port scanning
2. Create a rule-based scoring system that converts scan results into:
   • A 0–100 risk score
   • Severity levels: Critical, High, Medium, and Low
3. Add an explicit consent mechanism to ensure scans are performed only with authorization.
4. Use FastAPI background tasks to execute long scans without blocking user requests.
5. Store scan history and results using SQLite.
6. Provide a Next.js dashboard displaying:
   • Vulnerability details
   • Category-based risk scores
   • Human-readable findings
   • Exportable PDF reports

Literature Review Summary:

The system is based on established web security practices and research.

• The OWASP Top 10 highlights major web security risks, including injection attacks, cryptographic failures, access-control issues, and security misconfigurations. These findings motivate the inclusion of SQL injection, XSS, HTTP header analysis, and TLS checks in VulnScanner Pro.
• Research evaluating automated vulnerability scanners shows that detection accuracy varies depending on vulnerability type, meaning scanners must combine multiple assessment methods.
• OWASP ZAP is recognized as a leading open-source DAST solution, but it requires security expertise. VulnScanner Pro adopts the same ethical principle of authorized testing by enforcing consent at the system level.
• FastAPI was selected because its asynchronous capabilities and background-task support allow long-running scans to execute without keeping users waiting.
• Nmap is used for network discovery and port scanning, with fallback scanning methods when Nmap is unavailable.

System Architecture and Methodology

VulnScanner Pro follows a three-tier architecture:

1. Presentation Layer

Built with Next.js, this provides a dashboard where users can:

• Submit target URLs
• Confirm authorization consent
• Enable optional checks such as WHOIS and Nmap scans
• View scan progress and results

2. Application Layer

Built using FastAPI, this layer:

• Validates URLs and consent information
• Creates scan jobs
• Runs vulnerability modules
• Calculates risk scores
• Provides APIs for scan history and results

3. Data Layer

Uses SQLite to store:

• Scan information
• Consent records
• Scan status
• Complete vulnerability reports

The scanning process runs asynchronously. After submitting a scan request, the system immediately returns a scan ID while the actual security assessment runs in the background.

Assessment Modules

VulnScanner Pro includes eight modules:

Vulnerability Detection Approach:

SQL Injection:

• Injects predefined SQL payloads into URL parameters.
• Searches responses for database error patterns from systems such as MySQL, PostgreSQL, SQLite, and Oracle.
• Assigns risk based on detected weaknesses.

Cross-Site Scripting (XSS):

• Tests multiple XSS payloads.
• Checks whether injected scripts appear in responses.
• Examines protective measures such as Content Security Policy (CSP).

HTTP Security Headers:

The scanner checks important headers including:

• Strict Transport Security (HSTS)
• Content Security Policy (CSP)
• X-Frame-Options
• X-Content-Type-Options
• Referrer Policy
• Permissions Policy
• X-XSS-Protection

It also detects information leakage through headers such as Server and X-Powered-By.

SSL/TLS Assessment:

The module evaluates:

• Certificate validity
• Expiration dates
• Certificate issuer
• Self-signed certificates
• Encryption protocols
• Cipher strength

CSRF Protection:

The scanner analyzes:

• HTML forms
• Anti-CSRF tokens
• SameSite cookie attributes
• Clickjacking protections

Conclusion

What this project shows, more than anything, is that you don\'t need a trained model or a heavyweight DAST platform to get a useful first read on a web application\'s security posture. A handful of well-understood checks — reflected SQL injection and XSS testing, header analysis, TLS inspection, CSRF form checking, and port scanning — combined through a simple weighted-scoring rule, already produce a result that tells an operator where to look first. The consent gate, the background-task execution model, and the SQLite-backed history are what turn that into something a student or a small team could actually run against their own project rather than a one-off script.

References

[1] OWASP Foundation, \"OWASP Top 10:2021,\" 2021. [Online]. Available: https://owasp.org/Top10/2021/ [2] OWASP Foundation, \"A03:2021 – Injection,\" OWASP Top Ten, 2021. [Online]. Available: https://owasp.org/Top10/2021/ [3] Zed Attack Proxy (ZAP) by Checkmarx, \"ZAP – The World\'s Most Widely Used Web App Scanner,\" GitHub Repository, 2024. [Online]. Available: https://github.com/zaproxy/zaproxy [4] R. T. Fielding, \"Architectural Styles and the Design of Network-based Software Architectures,\" Ph.D. dissertation, Univ. of California, Irvine, 2000. [5] FastAPI, \"FastAPI Documentation,\" 2024. [Online]. Available: https://fastapi.tiangolo.com [6] G. Lyon, \"Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning,\" Insecure.Com LLC, 2009. [Online]. Available: https://nmap.org/book/ [7] J. Fonseca, M. Vieira, and H. Madeira, \"Testing and Comparing Web Vulnerability Scanning Tools for SQL Injection and XSS Attacks,\" in Proc. 13th IEEE Pacific Rim Int\'l Symp. Dependable Computing (PRDC), Melbourne, Australia, 2007, pp. 365–372. [8] MDN Web Docs, \"HTTP Security Headers,\" Mozilla Developer Network, 2024. [9] Ministry of Electronics and Information Technology, Government of India, \"Digital Personal Data Protection Act, 2023,\" Gazette of India, 2023.

Copyright

Copyright © 2026 Athili Laxmi Lavanya, Mycharla Madhavkumar, Doma Gangadhar. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.