You can deploy this model and start earning money today!

Maiks71/
aegis-security-scanner

Name: aegis-security-scanner
Availability: InStock

apache-2.0

Views

No views yet

Aegis Security Scanner

Aegis Security Scanner is a Python-based web security reconnaissance and vulnerability-candidate analysis tool designed for authorized security testing and controlled lab environments.

It helps security researchers discover application structure, endpoints, parameters, HTTP methods, and common security indicators from a single target.

⚠️ IMPORTANT: Use Aegis only against applications that you own or have explicit permission to test.

Features

Reconnaissance

Target URL analysis
Same-scope endpoint discovery
Web crawling
Parameter discovery
JavaScript endpoint discovery
API-style endpoint identification
HTTP service discovery
DNS resolution
HTTP method metadata inspection

Security Analysis

Aegis can identify potential security candidates and configuration issues such as:

IDOR candidates
SSRF candidates
Open-redirect candidates
Missing security headers
CORS configuration indicators
Cookie security issues
Server-header disclosure
Information-disclosure indicators
API endpoints
PUT/DELETE method advertisements

Reporting

The scanner can generate structured security reports containing:

Target information
Discovered endpoints
Parameters
Subdomains
HTTP services
HTTP request history
Security findings
Severity
Priority
Scanner limitations

Architecture

Aegis follows a simple security-analysis workflow:

Target
   │
   ▼
Reconnaissance
   │
   ├── Subdomains
   ├── DNS
   └── HTTP Services
   │
   ▼
Crawling
   │
   ├── Pages
   ├── Endpoints
   ├── Forms
   └── JavaScript
   │
   ▼
Parameter Analysis
   │
   ├── ID-like parameters
   ├── URL-like parameters
   └── Redirect-like parameters
   │
   ▼
Security Analysis
   │
   ├── Headers
   ├── CORS
   ├── Cookies
   ├── HTTP methods
   └── Information disclosure
   │
   ▼
Findings
   │
   ▼
JSON / HTML Report

Requirements

Python 3.9 or newer
Internet connection for authorized web targets
Permission to test the target application

Install the Python dependencies:

pip install -r requirements.txt

Installation

Clone the repository:

git clone https://github.com/YOUR_USERNAME/aegis-security-scanner.git

Enter the project directory:

cd aegis-security-scanner

Install dependencies:

pip install -r requirements.txt

Usage

Run the scanner:

python3 main.py

Enter an authorized target when prompted.

Example:

https://your-own-lab.example

The scanner will then perform its supported reconnaissance and security analysis.

Reports

Depending on the scanner version, reports may be generated as:

aegis_report.json

or:

aegis_report.html

These files contain the discovered information and security findings.

Generated reports are intentionally excluded from Git using .gitignore.

Understanding Findings

Aegis distinguishes between a security indicator and a confirmed vulnerability.

For example:

SSRF_CANDIDATE

means that a parameter appears to accept a server-side URL or URL-like value.

It does NOT automatically mean that the application is vulnerable.

Similarly:

IDOR_CANDIDATE

means that an object/reference-style parameter was discovered and may require authorization-aware verification.

Manual validation is required before treating a candidate as a confirmed vulnerability.

Severity

Aegis uses the following severity levels:

INFO
LOW
MEDIUM
HIGH
CRITICAL

Severity is an automated assessment and should be reviewed by a security professional before being used in a formal report.

Security Scope

Aegis is designed for:

Personal applications
Local development environments
CTF/lab environments
Authorized penetration testing
Security research with permission
Educational security testing

Do not scan systems that you do not own or do not have permission to test.

Responsible Use

The author does not encourage unauthorized scanning, exploitation, service disruption, credential attacks, or privacy violations.

Always obtain permission before testing an application.

Limitations

Aegis is an analysis and reconnaissance tool.

A detected candidate is not proof of a vulnerability.

Examples:

IDOR_CANDIDATE
SSRF_CANDIDATE
OPEN_REDIRECT_CANDIDATE

require controlled verification.

Security headers and configuration findings may also require application-specific review.

Roadmap

Planned improvements may include:

Improved crawling
Better API discovery
Scope management
Request/response history
Finding deduplication
Improved reporting
Authentication-aware testing in controlled environments
Better JavaScript analysis
Dashboard improvements
Export formats
Plugin architecture

Disclaimer

This project is intended for authorized security testing and educational purposes only.

You are responsible for ensuring that you have permission to test any target used with this software.

License

This project is released under the MIT License.

See LICENSE for details.

Maiks71/aegis-security-scanner