A Python desktop application for automated web vulnerability assessment, combining OWASP ZAP with supplementary security checks, live analysis, persistent scan history, and multi-format reporting.
The Web Application Vulnerability Scanner is a desktop security-testing application built with Python and PyQt6. It coordinates OWASP ZAP scans, performs supplementary black-box checks, displays findings through a live interface, and stores completed assessments for later analysis and reporting. Developed as the practical component of a Computer Science master's dissertation, it demonstrates application-security knowledge alongside API integration, concurrent processing, database design, data visualisation, and report generation.
Use only against applications that you own or have explicit permission to test.
| Feature | What it does |
|---|---|
| Automated DAST workflow | Runs OWASP ZAP spidering and active scanning from the desktop application |
| Extended assessment mode | Adds supplementary checks and targeted verification for selected web-security risks |
| Live analysis | Displays severity-ranked alerts, affected URLs, evidence, CWE references, remediation guidance, and assessment coverage |
| Security dashboard | Presents risk scores, severity totals, recurring findings, affected targets, and scan trends |
| Persistent history | Stores scan summaries and individual findings locally using SQLite |
| Reporting | Exports completed assessments as PDF, JSON, CSV, or Excel |
View Live Results and Reports
Findings are mapped to the assessment framework and displayed with severity, affected URLs, CWE references, evidence, and remediation guidance.
Completed assessments are stored locally and can be reviewed, reopened, filtered, or exported in multiple formats.
- The user configures an authorised target and selects a scan mode through the PyQt6 interface.
ZapScanWorkerruns the scan in a background Qt thread, keeping the application responsive.ZapClientcommunicates with OWASP ZAP to perform spidering and active security testing.- Extended mode runs additional Python-based checks and targeted verification.
- Findings are classified, displayed in Live Results, stored in SQLite, and made available for export.
| Mode | Behaviour |
|---|---|
| Standard ZAP Scan | Runs the configured ZAP spider and active scanner, then collects the resulting alerts |
| Extended OWASP Top 10 Scan | Adds supplementary checks and targeted verification to the ZAP scanning workflow |
Extended mode adds targeted checks covering injection, access control, exposed files, API security, authentication controls, security headers, and related web-application risks.
The project uses an assessment framework created for the dissertation brief. It covers eight categories aligned with OWASP Top 10:2021, including Broken Access Control, Injection, and Security Misconfiguration. It also includes two dissertation-specific extensions: Insecure APIs and AI/ML-Based Attacks.
These extensions are not presented as the official A09 and A10 categories. The matrix also distinguishes Checked, Partially checked, and Finding detected, avoiding the assumption that no automated alert proves an application is secure.
| Area | Technology |
|---|---|
| Language | Python 3.11+ |
| Desktop interface | PyQt6 |
| DAST engine | OWASP ZAP API |
| Local persistence | SQLite |
| Charts | Matplotlib and Plotly |
| PDF generation | ReportLab |
| Spreadsheet output | CSV and OpenPyXL |
| Version control | Git and GitHub |
View setup instructions
- Python 3.11 or later
- OWASP ZAP installed locally
- An application that you are authorised to test
Clone the repository and create a virtual environment:
git clone https://github.com/maxfroggatt/Web-Application-Vulnerability-Scanner.git
cd Web-Application-Vulnerability-Scanner
python -m venv .venvActivate the environment:
Windows PowerShell
.\.venv\Scripts\Activate.ps1Windows Command Prompt
.venv\Scripts\activate.batmacOS/Linux
source .venv/bin/activateInstall the dependencies and start the application:
python -m pip install -r requirements.txt
python main.pyThe default connection expects OWASP ZAP at 127.0.0.1:8090 with the API key 12345. These settings can be changed inside the application.
This academic prototype does not replace a professional penetration test. Automated black-box scanning cannot fully assess business logic, role-based authorisation, source-code flaws, supply-chain controls, or every authentication workflow. Findings may also require manual validation to eliminate false positives.
Only scan systems that you own or have explicit permission to test. Vulnerability scanning can disrupt services and may be unlawful when performed without authorisation. This project is intended for education, research, and authorised security testing.