eldarshiraliyev/BugScanner

What it is

BugScanner (eldarshiraliyev/BugScanner, MIT license, README describes v2.1.1 but the version command prints "BugScanner v2.1") is a Python 3.11+ CLI and web scanner for bug bounty and pentest work. It is built on asyncio and httpx, with an optional React and FastAPI dashboard. Its roadmap lists Playwright DOM analysis, multi-role IDOR diffing, a plugin system and a PyPI release as not yet built.

How it works

The false-positive filter is the main design claim. The README says it removes about 80% of noise, with no method or benchmark given. Its five rules are:

• Content check: a "file" that returns HTML (<!DOCTYPE html>, <div id="root">) is rejected.
• SPA detection: the scanner requests the base URL and a random path (/__bs_probe_abc123), then compares status, body size and SHA-256. If they match, route-based findings are filtered.
• Admin panels: reported only with a strong login signal (<input type="password">, wp-login.php, phpmyadmin), or 3 or more weak signals such as "username" or "sign in".
• Confirmation: a finding needs a payload or curl PoC, an evidence string of at least 10 characters, and successful active re-validation (XSS, time-based SQLi, CORS, redirects, disclosure). Otherwise it is "Suspicious" and dropped from the final report.
• Downgrading: the HTML report's breakdown also lists a "downgraded" category.

Other mechanics the page states:

• Time-based SQLi uses a 3-request double-check against network latency.
• The rate limiter halves RPS on 429, pauses 30 seconds on 503, and raises RPS 20% after 20 successes.
• WAF detection covers nine vendors and applies per-WAF evasion (RPS reduction, User-Agent rotation, bypass headers).
• Full port scans run in chunks, with memory of about 80 MB against 800 MB unchunked.
• The JWT module tries alg: none, 20+ weak secrets and RS256-to-HS256 confusion.
• The IDOR module tries DELETE, PUT and PATCH, and the page says it verifies with a real DELETE.

Preconditions / Affected

• Python 3.11+ and Git. Nuclei (for the 9000+ templates) and Node.js 20+ are optional.
• Business logic checks are opt-in (--business-logic) and recommended only for authenticated scans.
• Use is limited to systems you own or have written permission to test.

What to do

git clone https://github.com/eldarshiraliyev/BugScanner.git
cd BugScanner
python -m venv venv && source venv/bin/activate
python -m pip install -r requirements.txt
python cli.py version

Authenticated scan through Burp with business logic checks:

python cli.py scan https://target.com \
  --cookie "session=abc123" \
  --proxy http://127.0.0.1:8080 \
  --business-logic

WAF-protected target:

python cli.py scan https://target.com --rps 3 --no-subdomains --ports common

Other commands:

python cli.py scan https://target.com --format sarif
python cli.py diff reports/old.json reports/new.json
python app.py   # dashboard on http://localhost:8000
docker-compose up -d

For Docker, set BUGSCANNER_API_KEY in a .env file.

Caveats

• settings.yaml ships with verify_ssl: false, so TLS certificates are not checked by default.
• The IDOR module's real-DELETE verification sends destructive requests to the target. Check scope and the rules of engagement before running it, including on authenticated scans.
• --no-fp-validation turns off the verification step for faster scans, which brings back the noise the filter is meant to remove.
• The "~80%" figure is the author's claim and is not supported by any published data.
• The test suite is 35 tests. The listed files cover models, rate limiter, HTTP client, validator and SPA IDOR, so the individual vulnerability modules appear to have little direct test coverage.
• The default output.default_format includes SARIF, and the default user_agent identifies the tool as BugScanner/2.1.