Taipan – Web Application Security Scanner
Taipanis a an automated web application scanner which allows to identify web vulnerabilities in an automatic fashion. This project is the core engine of a broader project which include other components, like a web dashboard where you can manage your scan or download a PDF report and a scanner agent to run on specific host. Below are some screenshots of theTaipandashboard:
If you are interested in trying the full product, you can contact me at: aparata[AT]gmail.com
Release Download Taipan网站漏洞扫描器
Build Release Download
If you want to try the dev version of Taipan without to wait for an official release, you can download the build version. This version is built every time that a commit is done and the build process is not broken.
You can download it from theArtifacts Directory.
Using Taipan Taipan网站漏洞扫描器
Taipancan run on both Windows (natively) and Linux (with mono). To run it in Linux you have to installmono in version >= 4.8.0. You can track the implementation of the new features in the relatedKanban board.
Taipanallow to scan the given web site by specify different kind of profiles. Each profile enable or disable a specific scan feature, to show all the available profile just runTaipanwith the
Pause/Stop/Resume a scan
During a scan you can interact with it by set the scan in Pause or Stop it if necessary. In order to do so you have to press:
- P: pause the scan
- S: stop the scan
- R: resume a paused scan
The change is not immediate and you have to wait until all threads have reached the desider state.
Launch a Full scan
To launch a new scan you have to provide theurland theprofilewhich must be used. It is not necessary to specify the full profile name, a prefix is enough.
Taipan.exe -p Full -u http://127.0.0.1/
Below an example of execution:
Taipanis currently developed with using VisualStudio 2017 Community Edition and usespaketas packet manager. To build the source code you have to:
- clone the repository
- open the solution in VisualStudio and compile it
Taipanis composed of four main components:
Web Application fingerprinter
it inspects the given application in order to identify if it is a COTS application. If so, it extracts the identified version. This components is very important since it allows to identify vulnerable web applications.
Hidden Resource Discovery
this component scans the application in order to identify resources that are not directly navigable or that shouldn’t be accessed, like secret pages or test pages.
This component navigates the web site in order to provide to the other components a list of pages to analyze. It allows to mutate the request in order to find not so common pathes.
this component probes the web application and tries to identify possible vulnerabilities. It is composed of various AddOn in order to easily expand its Knowledge Base. It is also in charge for the identification of know vulnerabilities which are defined by the user.
See also the list ofcontributorswho participated in this project.
Taipan is licensed under theMIT license.