Secure Scan

Can your websites for security vulnerabilties

Comment

Inspiration

What it does

It scans your website for vulnerabilities

How we built it

Out of sheer will.

This is a react app running on AWS EC@ instance for the backend. On the backend, we run SSL Labs, Nmaps and nuclei to scan websites and their backends.

Challenges we ran into

Half of us worked on backend, while the other half worked on frontend. This was our first mistake. No shared git histrooy meant merge conflicts and a lot of preventable time spent stitching bakcned and frontend together.

Then, code would not work on others' machine, so we solidified our package.json file and created install.sh.

Initially, we used Puppeteer to create PDFs but that did not work. It was 5AM and I went to sleep, and Vallabh figured PDF generation out.

Scans were long since they were running in series, so we made them run in parallel

Now, we are working to make sure the deployment works.

Accomplishments that we're proud of

Website has been deployed :)

How we used git to collaborate.

What we learned

What's next for Secure Scan

To work on SQL and XSS injection To find RCE vulns To add wappalyzer and other APIs To show Broken Access Control Show publically accessible endpoints Make scans faster Update dependencies to latest Integrate LLM to explain how vuln was found and how a hacker could exploit it

Built With

Share this project:

Updates

posted an update —

  1. How We Built It (Technical Details) We made a complete web application that handles the whole security process automatically: "Core Workflow" -Start the Scan: The user types a website address (URL). Our custom Node.js brain (backend API) safely runs the necessary security tools in the background. -Clean the Data: We take all the messy results from these tools and turn it into clear, easy-to-read information. -Final Report: The system creates a professional PDF report that gives a clear Security Score and specific fix-it steps for every issue found.

  2. Challenge while running code and how we deal with them:

  3. Managing Long Scans, stopping the website from freezing up: We used a background job queue (a waiting list) to handle the long scans. This keeps the website fast and ready for the user.

  4. Using Pro Tools to get clear info from complex programs: We built a custom API wrapper (a special translator) to run Nuclei tests and turn the complex results into a simple data list.

  5. Making the PDF report from raw data: We built a dedicated service to organize the complicated data and turn it into a professional, easy-to-share PDF document.

  6. Ensured Reliability: We created a simple install script (install.sh) so the code behaves consistently across all team computers.

  7. Deployment: We set up the scanning part on AWS (a big web server) and hosted the user interface on Netlify for speed, making sure the website is fast and always online.

  8. Elements that are important for the judge and potential future development: The most important result of Security Scanner is changing a complicated, high-skill security check into a simple, powerful website service. We have built a finished tool that makes professional security auditing available to everyone with one insert. We chose to skip XSS testing to save time. This lets us fully finish and polish the core features (Nmap, SSL, Nuclei) for a complete, working demo.

Log in or sign up for Devpost to join the conversation.

posted an update —

Problem & Solution:

  1. The main problem is that checking website security is slow and confusing. This leaves a huge gap where most small websites can get hacked easily. A full security check means using many different, complicated security programs (like Nmap and Nuclei). Because it's too hard or expensive, small and mid-sized websites are often left open to simple attacks.
  2. Our Solution: Security Scanner We wanted to make web security easy for everyone. Security Scanner takes high-level, serious security checks and puts them into a single, simple, one-click website. Our goal was to combine the power of top tools into one place, so the user never needs to touch a command line.

Log in or sign up for Devpost to join the conversation.