Modern, Blazingly Fast Web Security Posture & Sensitive Exposure Audit Tool
Key Features • Installation • Quick Start • DevSecOps & CI/CD • Reports • Contributing
_ _____ ____ ___ ____ ____ ____ _ _ _
/ \ | ____/ ___|_ _/ ___|/ ___| / ___| / \ | \ | |
/ _ \ | _|| | _ | |\___ \\___ \| | / _ \ | \| |
/ ___ \| |__| |_| || | ___) |___) | |___ / ___ \| |\ |
/_/ \_\_____\____|___|____/|____/ \____//_/ \_\_| \_|
Modern Web Security Posture & Exposure Audit Tool v1.0.0
AegisScan is a modern, lightweight, and asynchronous cybersecurity auditing tool engineered for developers, sysadmins, DevOps engineers, and bug bounty hunters.
Modern applications frequently suffer from missing defense-in-depth security headers, exposed .env or .git repositories, weak cookie configurations, unmanaged TLS expirations, and missing anti-spoofing email records (SPF/DMARC). AegisScan audits all these attack vectors in seconds, computing an executive Security Grade (A+ to F) and generating actionable remediation guides.
| Capability | Description |
|---|---|
| ⚡ Asynchronous Core | Concurrently checks headers, SSL/TLS, DNS records, and exposures in parallel (< 3 seconds total runtime). |
| 🛡️ OWASP Secure Headers | Evaluates CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy with remediation guidance. |
| 🍪 Cookie Flag Inspector | Audits session tokens for missing Secure, HttpOnly, and SameSite flags, plus cookie prefixes (__Host-, __Secure-). |
| 🔍 Sensitive Exposure Hunter | Scans for exposed .env, .git/HEAD, AWS credentials, Dockerfiles, database backups (.sql, .sqlite3), and debug endpoints (phpinfo, Spring Actuators) with smart signature verification to eliminate false positives. |
| 🔒 SSL/TLS Health Analysis | Inspects certificate expiration, issuer, legacy protocols (TLS 1.0/1.1), and self-signed certificate alerts. |
| 📧 DNS & Email Defense | Validates SPF (v=spf1), DMARC (p=reject/p=quarantine/p=none), and MX records to prevent domain spoofing and spear-phishing. |
| 🌐 CORS Misconfiguration | Detects dangerous origin reflection and credential exposure (CWE-942). |
| 📊 Multi-Format Reporting | Gorgeous terminal output (via Rich), structured JSON for pipelines, and interactive standalone HTML dashboards. |
| 🚦 DevSecOps Gatekeeper | Native --fail-on <severity> flag to automatically fail CI/CD build pipelines if security vulnerabilities are found. |
pip install git+https://github.com/RobsHs/AegisScan.git# Clone the repository
git clone https://github.com/RobsHs/AegisScan.git
cd AegisScan
# Install in editable mode
pip install -e .Scan a target website or API:
aegisscan https://example.comGenerate an executive dark-mode HTML report and machine-readable JSON:
aegisscan https://example.com -o security-report.html -j security-report.jsonBlock builds if any HIGH or CRITICAL issues exist:
aegisscan https://staging.mycompany.com --fail-on highFor internal host testing where DNS records or exposure checks are not applicable:
aegisscan https://10.0.0.15:8443 --skip-dnsAegisScan generates standalone, interactive, dark-themed HTML security reports requiring zero external dependencies:
- Security Posture Grade & Metric Cards (Score / 100, Critical, High, Med, Low)
- Filterable & Searchable Vulnerability Cards with impact descriptions and copyable remediation code
- Interactive Checklists for HTTP Security Headers and Exposed Paths
- Print & Share Ready for executive briefings or audit documentation
aegisscan https://target.com -o report.html
# Open in your browser:
start report.html # Windows
open report.html # macOS
xdg-open report.html # LinuxIntegrate AegisScan into your GitHub Actions workflow to catch security regressions before deploying to production:
# .github/workflows/security-scan.yml
name: Web Security Audit
on:
push:
branches: [main]
schedule:
- cron: "0 0 * * 1" # Weekly scan
jobs:
audit:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.11"
- name: Install AegisScan
run: pip install git+https://github.com/RobsHs/AegisScan.git
- name: Run AegisScan Security Gate
run: |
aegisscan https://staging.example.com \
--output-html report.html \
--output-json report.json \
--fail-on high
- name: Upload Security Report Artifact
if: always()
uses: actions/upload-artifact@v4
with:
name: aegisscan-report
path: report.htmlusage: aegisscan [-h] [-u TARGET_FLAG] [-o FILE] [-j FILE]
[--fail-on {critical,high,medium,low}] [--timeout TIMEOUT]
[--concurrency CONCURRENCY] [--skip-exposure] [--skip-dns]
[-q] [-v]
[target]
AegisScan - Modern Web Security Posture & Sensitive Exposure Audit Tool
positional arguments:
target Target URL or domain to audit (e.g. https://example.com)
options:
-h, --help Show this help message and exit
-u, --url TARGET_FLAG Target URL (alternative to positional argument)
-o, --output-html FILE
Path to save modern interactive HTML security report
-j, --output-json FILE
Path to export raw structured JSON findings for CI/CD
--fail-on {critical,high,medium,low}
Fail with exit code 1 if findings meet or exceed severity
--timeout TIMEOUT Request timeout in seconds (default: 8.0)
--concurrency CONCURRENCY
Max concurrent asynchronous exposure checks (default: 10)
--skip-exposure Skip sensitive file and directory exposure scanning
--skip-dns Skip DNS, SPF, and DMARC inspection
-q, --quiet Suppress terminal UI dashboard output
-v, --version Show program's version number and exit
To run the automated test suite locally:
python -m unittest discover -s tests -vAll 13 unit tests test models, header audits, cookie security, exposure signature verification, and report generators.
Contributions are warmly welcomed! Please read our Contributing Guide and Code of Conduct.
- Fork the repo (
https://github.com/RobsHs/AegisScan/fork) - Create your feature branch (
git checkout -b feat/amazing-feature) - Commit your changes (
git commit -m "feat: add Subdomain Takeover checker") - Push to the branch (
git push origin feat/amazing-feature) - Open a Pull Request
Distributed under the MIT License. See LICENSE for more information.
Disclaimer: AegisScan is developed for authorized defense, security auditing, and educational research. Always obtain authorization before scanning networks or web assets you do not own.
Crafted with dedication by RobsHs • Open Source Cybersecurity Community
⭐ If you find AegisScan useful, please consider giving it a star on GitHub! ⭐