White-Hat Pentest Helper

A legitimate, safety-focused web application for performing authorized security scans on your own web applications.

Screenshots

Real-time scan results with live console, severity filtering, and proof-of-concept generation

Features

• Advanced Injection Detection:
  • Randomized token-based XSS detection (zero false positives)
  • Boolean-based blind SQL injection detection
  • Server-Side Template Injection (SSTI) detection
  • Command injection detection with unique tokens
• Security Headers Analysis: Identifies missing or misconfigured HTTP security headers
• Dependency Scanning: Checks for exposed dependency files
• Real-time Progress: Live console showing detailed scan progress
• Interactive Filtering: Click severity badges to filter findings
• Proof of Concept (POC): Each finding includes a curl command to reproduce the vulnerability
• OWASP Top 10 Mapping: All findings mapped to relevant OWASP categories

Tech Stack

• Backend: Python, FastAPI
• Frontend: React, Vite, Tailwind CSS

Getting Started

Prerequisites

• Python 3.8+
• Node.js 16+

Installation

1. Clone the repository (if applicable).
2. Backend Setup:

   cd backend
   python -m venv venv
   # Windows
   ..\venv\Scripts\activate
   # Linux/Mac
   # source ../venv/bin/activate
   pip install -r requirements.txt

3. Frontend Setup:

   cd frontend
   npm install

Running the Application

1. Start the Backend: From the root directory (with venv activated):

   uvicorn app.main:app --reload --port 8000 --app-dir backend

   The API will be available at http://localhost:8000.

2. Start the Frontend: From the frontend directory:

   npm run dev

   The UI will be available at http://localhost:5173.

Usage

1. Open the frontend URL in your browser.
2. Enter the Target URL you wish to scan (e.g., http://localhost:8000 to scan the API itself, or any other site you own).
3. Check the "I am authorized..." box.
4. Click Start Scan.
5. View the results on the dashboard.

Disclaimer

Use this tool ONLY on systems you own or are explicitly authorized to test. Misuse of security tools may be illegal. The authors are not responsible for any misuse.

License

This project is licensed under the MIT License - see the LICENSE file for details.