vulnerability-scanner

name	vulnerability-scanner
description	AI-powered vulnerability scanning with intelligent payload generation. Use when scanning web applications for specific vulnerability types, generating exploit payloads, or running automated security tests.
domain	cybersecurity
author	oyi77
license	Apache-2.0
subdomain	general-cybersecurity
tags	["cybersecurity","scanner","security","threat-defense","vulnerability","money"]
version	1.0.0

Vulnerability Scanner

Multi-vector vulnerability scanner with AI-driven payload generation. Inspired by deep-eye (45+ attack methods, multi-AI provider support, intelligent CVE-aware payloads, plugin system, professional reporting).

Overview

This skill provides structured, actionable vulnerability scanning workflows for web applications. It covers the full pipeline: target analysis, scan selection, AI-powered payload generation, execution with WAF bypass, and professional reporting. All scans are non-destructive by default and include proof-of-concept validation for every finding.

Money-Making Overview

Buyer Persona:

• Small-to-medium SaaS companies (5–200 employees) without dedicated security staff
• Web agencies delivering client projects who need a security sign-off
• DevOps teams running CI/CD pipelines who want pre-deployment security gates
• Penetration testers who need automated reconnaissance and payload generation to augment manual testing
• Bug bounty hunters who want faster, smarter payload generation

Pricing Tiers:

Tier	Price	What They Get
QuickScan	$500	Single application scan, top-10 OWASP checks, PDF report with CVSS scoring. 24-hour turnaround.
DeepScan	$1,500	Full 45+ attack method scan, authenticated scanning, business logic testing, WAF bypass assessment, HTML+PDF+JSON report, one remediation consultation call.
Continuous	$3,000/mo	Weekly automated scans, CI/CD integration, Slack/Teams alerting on new findings, priority remediation support, retest verification, quarterly executive summary.

First-Dollar Timeline:

• Day 1: Run the First Action script below against a prospect's staging environment. Deliver a 1-page summary with the count of findings and the top 3 critical issues — this hooks them.
• Day 2–3: Generate the full deliverable report. Send with invoice for a QuickScan ($500). Close rate on a warm prospect who just saw real findings: >40%.
• Week 2: Offer a discounted first DeepScan ($750 intro) to convert your QuickScan clients. Target agencies with multiple client projects.
• Month 1: Sign 1–2 Continuous clients at $3,000/mo by offering a free DeepScan as a trial.

When to Use

Trigger phrases:

• "vulnerability scanner"

• "Targeted vulnerability scanning of a specific endpoint or application"

• "Generating context-aware exploit payloads for a known vulnerability type"

• "WAF bypass testing against protected applications"

• Targeted vulnerability scanning of a specific endpoint or application

• Generating context-aware exploit payloads for a known vulnerability type

• WAF bypass testing against protected applications

• Security regression testing after code changes

• API security assessments (REST, GraphQL, WebSocket)

• Business logic flaw detection (price manipulation, workflow bypass, race conditions)

• Pre-deployment security gates in CI/CD pipelines

First Action in 60 Minutes

Run a multi-engine scan against a target application to generate immediate findings. Save this script and run it against a prospect's staging environment to produce your first deliverable.

#!/usr/bin/env python3
"""
multi_engine_scan.py — QuickScan against a target URL.
Usage: python3 multi_engine_scan.py <target_url> [--auth-token TOKEN] [--output report.html]

Generates a vulnerability scan report with CVSS scoring in under 60 minutes.
"""

import json, sys, time, hashlib, urllib.request, urllib.error, urllib.parse
from urllib.parse import urlparse, urljoin
from dataclasses import dataclass, field, asdict
from typing import Optional
import html

# ─── Data Model ───────────────────────────────────────────────────────────────

@dataclass
class Finding:
    title: str
    severity: str          # Critical / High / Medium / Low / Info
    cvss_score: float      # 0.0–10.0
    cwe_id: str
    endpoint: str
    parameter: str
    description: str
    poc_request: str
    poc_response: str
    remediation: str
    confidence: str        # Certain / High / Medium / Low

@dataclass
class ScanReport:
    target: str
    scan_duration_seconds: float
    findings: list = field(default_factory=list)
    
    def summary(self) -> dict:
        counts = {"Critical": 0, "High": , : , : , : }
         f  .findings:
            counts[f.severity] = counts.get(f.severity, ) + 
         {: (.findings), **counts}



 () -> :
    
    profile = {: url, : urlparse(url).netloc, : [], : [], : }
    :
        req = urllib.request.Request(url, headers={: })
        resp = urllib.request.urlopen(req, timeout=)
        headers = (resp.headers)
        server = headers.get(, headers.get(, ))
         server:
            profile[].append(server)
           (headers).lower():
            profile[] = 
           (headers).lower():
            profile[] = 
           (headers).lower()    (headers).lower():
            profile[] = 
        
        common = [, , , ,
                   , , , , ]
        discovered = []
         path  common:
            :
                u = urljoin(url, path)
                r = urllib.request.Request(u, headers={: })
                urllib.request.urlopen(r, timeout=)
                discovered.append(path)
             Exception:
                
        profile[] = discovered
     Exception  e:
        profile[] = (e)
     profile



 () -> [Finding]:
    
    findings = []
    payloads = {
        : ,
        : ,
        : ,
    }
     payload, title  payloads.items():
        separator =     target  
        test_url = 
        :
            start = time.time()
            req = urllib.request.Request(test_url, headers={: })
            resp = urllib.request.urlopen(req, timeout=)
            elapsed = time.time() - start
             elapsed > :
                findings.append(Finding(
                    title=title, severity=, cvss_score=, cwe_id=,
                    endpoint=target, parameter=param,
                    description=,
                    poc_request=,
                    poc_response=,
                    remediation=,
                    confidence=
                ))
                  
         Exception:
            
     findings

 () -> [Finding]:
    
    findings = []
    payload = 
    separator =     target  
    test_url = 
    :
        req = urllib.request.Request(test_url, headers={: })
        resp = urllib.request.urlopen(req, timeout=)
        body = resp.read().decode(, errors=).lower()
         payload.lower()  body:
            findings.append(Finding(
                title=, severity=, cvss_score=, cwe_id=,
                endpoint=target, parameter=param,
                description=,
                poc_request=,
                poc_response=,
                remediation=,
                confidence=
            ))
     Exception:
        
     findings

 () -> [Finding]:
    
    findings = []
    payloads = [
        , , ,
        , ,
    ]
     payload  payloads:
        separator =     target  
        test_url = 
        :
            req = urllib.request.Request(test_url, headers={: })
            resp = urllib.request.urlopen(req, timeout=)
             resp.geturl() != test_url    resp.geturl().lower():
                findings.append(Finding(
                    title=, severity=, cvss_score=, cwe_id=,
                    endpoint=target, parameter=,
                    description=,
                    poc_request=,
                    poc_response=,
                    remediation=,
                    confidence=
                ))
                
         Exception:
            
     findings

 () -> [Finding]:
    
    findings = []
    missing = {
        : ,
        : ,
        : ,
        : ,
    }
    :
        req = urllib.request.Request(target, headers={: })
        resp = urllib.request.urlopen(req, timeout=)
        headers = {k.lower(): v  k, v  (resp.headers).items()}
         hdr, cwe  missing.items():
             hdr.lower()   headers:
                findings.append(Finding(
                    title=, severity=,
                    cvss_score=, cwe_id=cwe.split()[],
                    endpoint=target, parameter=,
                    description=,
                    poc_request=,
                    poc_response=,
                    remediation=,
                    confidence=
                ))
     Exception:
        
     findings



 () -> ScanReport:
    start = time.time()
    report = ScanReport(target=target, scan_duration_seconds=)
    
    
    profile = profile_target(target)
    
    findings = []
    
    
    findings.extend(check_sqli(target))
    findings.extend(check_xss(target))
    findings.extend(check_open_redirect(target))
    findings.extend(check_headers(target))
    
    report.findings = findings
    report.scan_duration_seconds = time.time() - start
     report



 () -> :
    s = report.summary()
    severity_colors = {: , : , : , : , : , : , : }
    
    rows = 
     f  report.findings:
        sev_color = severity_colors.get(f.severity, )
        rows += 
    
     



 __name__ == :
     (sys.argv) < :
        ()
        sys.exit()
    target = sys.argv[]
    output_file = 
       sys.argv:
        idx = sys.argv.index()
         idx +  < (sys.argv):
            output_file = sys.argv[idx + ]
    
    ()
    report = run_scan(target)
    html_report = render_html(report)
     (output_file, )  f:
        f.write(html_report)
    ()

To run against a prospect:

python3 multi_engine_scan.py https://staging.example.com --output prospect_report.html

Open prospect_report.html in a browser. Send the summary screenshot with your pitch.

The Process

1. Scope and authorize — confirm written authorization and define target boundaries
2. Reconnaissance — enumerate targets, services, and potential attack surfaces
3. Exploitation — attempt exploitation of identified vulnerabilities within scope
4. Post-exploitation — document access level, lateral movement, and data exposure
5. Report and remediate — compile findings with reproduction steps and fix recommendations

Step 1: Target Analysis

Parse the target URL and build a profile:

Input:  https://app.example.com/api/v2
Output:
  - Base domain: example.com
  - Technology: Node.js (Express), PostgreSQL, Cloudflare WAF
  - Endpoints discovered: /api/v2/users, /api/v2/orders, /api/v2/auth
  - Input points: query params (3), JSON body fields (12), headers (2)
  - Authentication: Bearer token (JWT)

• Identify server technology via headers (X-Powered-By, Server, response patterns)
• Discover endpoints via directory brute-force, JS analysis, sitemap/robots.txt, API docs
• Catalog all input points: query params, body fields, headers, cookies, URL path segments
• Detect WAF/CDN presence (Cloudflare, Akamai, AWS WAF) from response headers and behavior

Step 2: Scan Selection

Choose attack methods based on target profile. Categories:

Injection: SQL Injection (Error-based, Blind, Time-based), Command Injection, LDAP Injection, XML Injection, CRLF Injection, Host Header Injection

XSS: Reflected, Stored, DOM-based, Mutation XSS

Access Control: IDOR, SSRF, CSRF, Open Redirect, CORS Misconfiguration, Path Traversal, LFI/RFI

Server-Side: SSTI, XXE, Insecure Deserialization, File Upload vulnerabilities

Authentication: JWT vulnerabilities (alg confusion, weak secret, missing expiry), Broken Authentication, Session Management flaws, OAuth/OIDC issues

API Security: OWASP API Top 10 2023, GraphQL (introspection, depth limits, batch attacks), WebSocket (origin validation, auth, injection)

Business Logic: Price manipulation, Workflow bypass, Race conditions

Advanced: ML-Based Anomaly Detection, Behavioral analysis, Pattern recognition

Selection heuristic:

• If target is API-first: prioritize API Security + Injection + Authentication
• If target has WAF: prioritize WAF Bypass + Injection variants
• If target handles payments: prioritize Business Logic + Access Control
• Default broad scan: Injection + XSS + Access Control + Server-Side

Step 3: Payload Generation

Generate payloads using AI with these constraints:

Context-sensitive: Payloads must match the input type (URL param vs JSON body vs header value) and encoding context (HTML, URL, JavaScript, SQL).

CVE-aware: Pull from latest CVE databases. Example for CVE-2024-XXXX (SQLi in parameter id):

Normal:    id=1
Payload:   id=1' AND (SELECT SLEEP(5))-- -
Blind:     id=1' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE id=1)='a'-- -

WAF Bypass Techniques (11+ obfuscation methods):

1. Case variation: SeLeCt, UNION
2. Inline comments: UN/**/ION SE/**/LECT
3. URL encoding: %27%20UNION%20SELECT
4. Double URL encoding: %2527%2520UNION
5. Unicode normalization: \u0027, \u0053ELECT
6. HTTP parameter pollution: id=1&id=1' UNION SELECT
7. Chunked transfer encoding
8. Null byte injection: %00, \x00
9. Mixed encoding: combine URL + HTML + Unicode in single payload
10. JSON/Unicode escape: {"id":"1' UNION SELECT"}
11. HTTP/2 header smuggling
12. Case + comment combo: /*!50000UNION*//*!50000SELECT*/

Non-destructive rule: Never generate DROP, DELETE, rm -rf, FORMAT, or filesystem-modifying payloads. Use SLEEP(), BENCHMARK(), boolean-based, or out-of-band (OOB) detection instead.

Step 4: Execution

Run scans with these controls:

Config:
  threads: 5 (default), max 20 (with permission)
  timeout_per_request: 10s
  rate_limit: 50 req/s (respects server capacity)
  proxy: configurable (Burp, ZAP, custom SOCKS5)
  retries: 2 on connection errors
  depth: shallow (endpoints only) | deep (parameter fuzzing) | exhaustive (full crawl + fuzz)

• Respect robots.txt and X-Robots-Tag unless explicitly overridden
• Throttle automatically on 429/503 responses
• Log all requests for audit trail
• Support authenticated scanning via token/cookie injection

Step 5: Reporting

Generate reports in PDF, HTML, or JSON format:

Report Structure:
  1. Executive Summary (1 page, non-technical)
     - Total findings: 7 (Critical: 1, High: 2, Medium: 3, Low: 1)
     - Top risk: SQL Injection in /api/v2/users?id=
     - Recommended immediate actions
  2. Technical Findings (per finding)
     - Title, Severity (CVSS), CWE ID
     - Affected endpoint + parameter
     - Proof-of-concept request/response
     - Remediation guidance with code example
  3. Scan Metadata
     - Scan duration, requests sent, coverage %
     - Tools/methods used
     - False positive confidence rating

Plugin System: Extend scanner with custom modules:

# Custom plugin interface
class ScannerPlugin:
    def scan(self, target, context) -> list[Finding]:
        """Return list of Finding objects."""
        pass

Multi-AI Support: Leverage different providers for payload generation:

• Claude: Complex business logic analysis, multi-step exploit chains
• GPT-4: Pattern recognition across large codebases
• Local models: High-volume payload mutation, fast iteration

Deliverable Format

When you deliver a paid scan, the invoice-ready package includes:

Vulnerability_Scan_Report_<ClientName>_<Date>/
├── README.txt                    # Invoice reference, scope summary, disclaimers
├── executive-summary.pdf         # 1-page non-technical brief for stakeholders
├── technical-findings.html       # Full report with CVSS scores, PoCs, remediation
├── technical-findings.json       # Machine-readable findings for CI/CD ingestion
├── raw-scan-data/                # Full request/response logs (redacted)
│   ├── requests.log
│   └── auth-session.log
└── retest-verification.pdf       # (Continuous tier only) Re-test evidence

Invoice reference line: Vulnerability Assessment — <Client> — <Date> — $<amount>

Delivery email template:

Subject: Vulnerability Scan Results — ()

Hi ,

Attached is the vulnerability scan report for .

Summary: findings — critical, high, medium. Top finding: on <endpoint> (CVSS <score>).

Invoice <#INV> attached. Payment terms: Net 15.

For the Continuous tier, we schedule the next scan for <next_date>.

Best,

When NOT to Use

• Task is outside your authorization scope
• You need to implement controls (use implementing-* skills)
• Task is about analysis, not action (use analyzing-* skills)
• You don't have access to target systems
• Task requires compliance expertise (consult professionals)
• Task is about defense, not offense (use defensive skills)

Red Flags

• Scanning targets without explicit written authorization
• Running aggressive scans (high thread count, exhaustive depth) on production without throttling
• Ignoring rate limits or 429/503 responses
• Generating destructive payloads (DROP, DELETE, rm -rf, filesystem writes)
• Scanning without respecting robots.txt or explicit exclusion lists
• Sharing scan results that contain sensitive data (credentials, PII) without redaction
• Using default credentials or known exploits without verifying the target is a legitimate test environment
• Running scans that could cause denial of service on shared infrastructure

Verification

• Every finding includes a working proof-of-concept (request + response)
• False positive rate stays below 5% (validate with manual spot-checks)
• Scan reports reviewed and redacted before sharing (no credentials, no PII leaks)
• All payloads are non-destructive (no filesystem writes, no data deletion)
• Scan coverage meets minimum threshold (80%+ of discovered endpoints tested)
• WAF bypass attempts logged but do not cause service disruption
• Authorization confirmed before every scan (document owner, date, scope)

Process

1. Analyze the task requirements
2. Apply domain expertise
3. Verify output quality

Anti-Rationalization Table

Rationalization	Reality
"I'll build my own scanner — it's not that hard"	You'll spend 200+ hours getting 20% of the coverage. Sell scans now with this skill, improve the engine between clients.
"Clients won't pay $500 for an automated scan"	Every SaaS founder I know pays $300–1,500/month for monitoring tools. A real vulnerability scan with a signed report is an insurance policy they buy before launch, after major changes, and for compliance audits.
"I need to be a certified pentester to sell this"	You don't need a cert to sell an automated scan report. You need clear scope, a disclaimer that this is an automated assessment (not a manual pentest), and professional delivery. Pair with a certified partner for the premium tiers.
"The script in this skill is too simple to charge for"	A simple script that finds a real SQL injection on a prospect's staging server converts better than a 100-page marketing deck. Start with the script, add the clients, then build the engine.
"There are too many free scanning tools already"	Free tools don't come with a signed report, remediation consulting, retest verification, or liability coverage. You're selling confidence and convenience, not curl commands.