Shikra: Modular Security Scanner and Automated Remediation Suite
Inspiration
When testing modern web and mobile ecosystems, security engineers and developers constantly face two major bottlenecks: tool fragmentation and scan fatigue.
Auditing an application today requires juggling completely separate tools for web endpoints, Android APKs, and AI/LLM integrations. To make matters worse, traditional automated scanners blindly spam target servers with hundreds of redundant requests simply because a parameter value changed, without testing anything genuinely new. Worst of all, most vulnerability scanners stop at generating a massive list of warnings, leaving developers completely on their own to figure out how to write patches without breaking functionality.
We built Shikra—named after the swift, sharp-eyed sparrowhawk—to unify this broken workflow. Our objective was clear: create a cohesive, desktop-based offensive security suite that eliminates scanning noise across modern attack surfaces (Web, Mobile, and AI) and closes the loop by automatically generating verified source-code fixes.
What It Does
Shikra consolidates 37 specialized security audit modules into an agile, terminal-style desktop interface:
- Web Security (16 Modules): Crawls domains and audits injection surfaces for SQLi, XSS, CSRF, SSRF, LFI, RCE, IDOR, XXE, CORS misconfigurations, and broken authentication flows.
- Mobile / APK Auditing (15 Modules): Ingests Android .apk files for zero-dependency static analysis (manifest flaws, exported components, exposed secrets, insecure crypto) and on-device dynamic audits via ADB.
- AI & LLM Red-Teaming (6 Modules): Evaluates language model prompts and connected API providers (Claude, GPT, Gemini) against prompt injection, jailbreaks, data exfiltration, and system prompt extraction.
- Autonomous AI Solver: Once a vulnerability is confirmed, Shikra spins up an isolated sandbox, inspects the project source code, and creates precise Git patches that can be applied with one click.
Technical Architecture and Deduplication Math
Shikra couples an Electron.js desktop presentation layer with an asynchronous Python 3 engine using non-blocking stdio IPC.
1. Attack-Surface Deduplication
To solve the issue of scanners wasting hours on duplicate URLs, we designed a canonical signature function. For any crawled URL u, the signature S(u) extracts the host, path, and sorted query parameter keys:
Signature Formula: S(u) = ( Host(u), Path(u), Sort(Keys(Query(u))) )
The scannable target set filters out duplicate surfaces so that every unique injection profile is evaluated exactly once:
Scannable Target Set: U_scannable = { u in U | forall v in U_scannable, u != v implies S(u) != S(v) }
2. Concurrency and Scan Speedup
By eliminating redundant paths and distributing requests across asynchronous worker tasks governed by semaphores, the overall scanning speedup is modeled by:
Speedup Formula: Speedup = ( |U| / |U_scannable| ) * ( 1 / ((1 - p) + (p / N)) )
Where |U| / |U_scannable| represents the deduplication ratio, p is the parallelizable fraction of the scan routine, and N is the concurrency worker limit. On real-world targets, this reduces network requests by over 70% while improving overall scan velocity.
How We Built It
- Frontend: Built using Electron.js with vanilla JavaScript, HTML5, and CSS3. This keeps memory usage low while rendering real-time streaming telemetry with custom status tags ([*], [>], [+], [!]).
- Core Engine: Written in Python using asyncio for non-blocking network I/O and process orchestration.
- Embedded SQLMap: Bundled directly into the scanner backend, parsing raw output on the fly into clean, structured vulnerability payloads.
- Remediation Pipeline: An isolated workspace manager (backend/solver/workspace.py) that executes automated coding agents in headless sandbox environments to generate Git diffs without risking file corruption on real projects.
Challenges We Ran Into
- High-Frequency IPC Data Flooding: Spawning concurrent processes produced high volumes of console output per second, causing renderer thread lag. We built a buffered streaming bridge that strips ANSI sequences, normalizes engine outputs, and staggers background heartbeats.
- Zero-Dependency APK Parsing: Instead of bundling heavy Java utilities like apktool or jadx, we wrote native Python binary parsers to decode binary XML (AndroidManifest.xml), extract DEX string tables, and inspect ELF headers for native .so security attributes (PIE, NX, Stack Canaries).
- Safe Automated Patch Generation: Letting AI modify code directly can easily break builds. We isolated all agent operations inside ephemeral sandboxes where modifications are strictly captured as unified diffs and reviewed by the developer prior to disk writes.
Accomplishments That We Are Proud Of
- Engineered a unified platform spanning 37 distinct security modules across Web, Android, and AI models.
- Replaced bloated third-party dependencies with fast, native Python parsers for mobile analysis.
- Built the AI Solver, successfully transforming a passive security scanner into an active remediation tool that writes accurate code patches.
What We Learned
- Attack surfaces have merged: Modern security testing cannot be compartmentalized; web backends, mobile clients, and AI endpoints operate together and must be audited within a unified context.
- Clarity drives remediation: Dense terminal dumps delay fixes. Structured logging and immediate code diffs significantly lower the friction between identifying a bug and resolving it.
What Is Next for Shikra
- CI/CD Integration: Building a headless CLI mode for GitHub Actions and GitLab CI to fail builds on high-severity findings.
- GraphQL and WebSocket Auditing: Introducing real-time introspection and payload fuzzing for modern streaming APIs.
- Community Module Marketplace: Creating an open plugin specification allowing security researchers to write and distribute custom detection modules easily.
Log in or sign up for Devpost to join the conversation.