Security Scanning Agents & Components¶

This page describes the specialized scanning agents that perform vulnerability detection.

Agent Overview¶

WebSecScan uses modular, composable agents that each perform a focused set of deterministic security checks:

┌─────────────────────────────────────────┐
│         Agent Coordinator               │
│    (Orchestrates multi-agent scans)     │
└────────────┬────────────────────────────┘
             │
    ┌────────┴────────┬──────────────────┐
    ↓                 ↓                   ↓
┌─────────┐     ┌──────────┐      ┌─────────┐
│ Static  │     │ Dynamic  │      │ Library │
│Analysis │     │ Testing  │      │ Scanner │
│  Agent  │     │  Agent   │      │  Agent  │
└─────────┘     └──────────┘      └─────────┘

Each agent: - ✅ Executes independently - ✅ Produces structured findings - ✅ Enforces safety constraints - ✅ Logs detailed debug info

Static Analysis Agent¶

Purpose¶

Analyze source code and markup without executing it to identify dangerous patterns and security misconfigurations.

Components¶

JavaScript/TypeScript Analyzer¶

Detects:

Example:

// ❌ Detected as CRITICAL
eval(userInput);

// ❌ Detected as HIGH
element.innerHTML = userData;

// ❌ Detected as MEDIUM
document.cookie = "session=abc123";  // Missing Secure/HttpOnly

Output: List of vulnerabilities with line numbers and evidence snippets.

HTML & Template Analyzer¶

Detects:

Dependency Analyzer¶

Detects:

Checks against: - National Vulnerability Database (NVD) - CVE feeds - Package advisory databases

Dynamic Testing Agent¶

Purpose¶

Safe, non-destructive runtime testing against a permitted target URL.

Components¶

URL Crawler¶

Discovers endpoints by: 1. HTML link extraction (<a href>) 2. JavaScript parsing (API endpoint patterns) 3. Sitemap.xml parsing 4. AJAX/fetch call detection

Safety defaults: - Max depth: 2 levels - Max pages: 50 - Rate limit: 1 second between requests - Respects robots.txt - Timeout: 10 seconds per request

See Crawler Design for full details.

XSS Tester¶

Tests 12 attack contexts: 1. Reflected in HTML body 2. In HTML attributes 3. In JavaScript strings 4. In event handlers 5. In URL fragments 6. In JSON responses 7. In DOM properties 8. In CSS contexts 9. In template literals 10. In SVG elements 11. In iframe src 12. In script tag content

Payloads: Safe, detection-only (no execution):

// Example payload (safe)
'"><svg onload=alert(1)>

Output: Identifies vulnerable endpoints and injection points.

SQL Injection Tester¶

Tests error-based injection with 7 safe payloads:

' OR '1'='1
' OR 1=1--
' OR '1'='1' /*
' UNION SELECT NULL--
' AND 1=0 UNION SELECT NULL--
'; DROP TABLE users--
' OR SLEEP(5)--

Detection: Monitors for database error messages in responses (MySQL, PostgreSQL, MSSQL, Oracle, SQLite).

Output: Identifies injectable parameters.

Path Traversal Tester¶

Tests 8 payloads targeting Unix/Windows file systems:

../../../etc/passwd
..\\..\\..\\windows\\win.ini
....//....//....//etc/passwd
%2e%2e%2f%2e%2e%2fetc%2fpasswd

Detection: Looks for file content patterns (magic bytes, known file contents).

Output: Identifies vulnerable parameters.

CSRF Tester¶

Checks: 1. Presence of CSRF tokens (8+ patterns) 2. Token entropy and uniqueness 3. SameSite cookie attributes 4. State-changing method analysis (POST vs GET)

Output: CSRF protection gaps.

Authentication Scanner¶

Tests: 1. Session cookie security (Secure, HttpOnly, SameSite) 2. Unauthenticated access to protected endpoints 3. Invalid token handling (malformed, expired) 4. Parameter manipulation (ID-based access control)

Output: Authentication/authorization flaws.

Security Header Tester¶

Checks for: - Content-Security-Policy (CSP) - Strict-Transport-Security (HSTS) - X-Frame-Options - X-Content-Type-Options - X-XSS-Protection - Permissions-Policy - Referrer-Policy - Expect-CT

Output: Missing or misconfigured security headers.

Library Scanner Agent¶

Purpose¶

Identify known vulnerable dependency versions and outdated packages.

Behavior¶

1. Parse manifest files:
2. package.json (Node.js/JavaScript)
3. requirements.txt (Python)
4. pom.xml (Java)
5. Gemfile (Ruby)

6. etc.

7. Check version against vulnerability feeds:

8. NVD (National Vulnerability Database)
9. CVE feeds

10. Package-specific advisories

11. Produce findings:

12. Vulnerable version number
13. CVE identifier
14. Severity (CVSS score)
15. Remediation (upgrade version)
16. Link to advisory

Output¶

Structured vulnerability objects with: - Package name and version - OWASP 2025 category (A03:2025 - Supply Chain) - Severity and CVSS score - Remediation guidance

Agent Configuration & Safety¶

Configuration Options¶

Safety Constraints¶

All agents enforce:

✅ Deterministic behavior — Same input → same output
✅ No randomness — Reproducible scans
✅ No brute force — No credential guessing
✅ No DoS — Rate limited, timeouts enforced
✅ No data extraction — Read-only operations
✅ No exploit chaining — Single-test isolation
✅ Explicit authorization — User consent required
✅ Auditable logic — Rule-based, not ML

Outputs & Integration¶

Finding Structure¶

Each vulnerability includes:

{
  id: "WSS-XSS-001",              // Unique ID
  owaspId: "A03:2025",            // OWASP 2025 category
  owaspCategory: "Injection",     // Human-readable
  severity: "HIGH",               // CRITICAL | HIGH | MEDIUM | LOW
  confidence: "HIGH",             // HIGH | MEDIUM | LOW
  title: "Reflected XSS",
  description: "User input reflected in response without escaping",
  evidence: "<img src=x onerror=alert(1)>",  // Code snippet
  location: "GET /search?q=",     // Where it was found
  remediation: "Use textContent instead of innerHTML; sanitize with DOMPurify",
  references: [
    "https://owasp.org/...",
    "https://cheatsheetseries.owasp.org/..."
  ]
}

Integration¶

Findings from all agents are: 1. Normalized to common format 2. Deduplicated (same vuln from multiple agents = 1 finding) 3. Classified using OWASP 2025 mapping 4. Scored for risk level 5. Stored in database 6. Returned to user

Next Steps¶

• Static Analysis Rules — Detailed static checks
• Dynamic Testing — Detailed dynamic tests
• Crawler Design — URL discovery configuration
• OWASP 2025 — Vulnerability categories

Resources¶