{
  "markdown": "# webscanner\n\nA [Claude Code](https://claude.ai/code) plugin that performs automated client-side web security assessments. Point it at any domain and it produces a structured Markdown pentest report covering secrets exposure, vulnerable JS libraries, security misconfigurations, XSS sinks, CORS issues, and more — with zero manual setup required.\n\n## What it does\n\n**webscanner** runs a fixed 6-step security review against the target's browser-facing attack surface:\n\n| Step | Check | Tools used |\n|------|-------|------------|\n| 0 | OS detection + auto-install deps | `pip3`, `uname` |\n| 1 | Security headers, cookie flags, HTTPS redirect | `curl` |\n| 2 | Sensitive path exposure (`.env`, `.git`, Swagger, admin panels, etc.) | `curl` |\n| 3 | HTML analysis — SRI, tabnapping, CSRF, clickjacking, base tag injection, HTML comment secrets | `curl` |\n| 4 | JavaScript analysis — 40+ secret patterns, DOM XSS sinks, prototype pollution, source map exposure | `curl`, `python3` |\n| 4b | Vulnerable JS library detection via retire.js CVE database | `npx retire` *(requires Node.js)* |\n| 5 | CORS misconfiguration testing | `curl` |\n| 6 | Subdomain enumeration + takeover detection via crt.sh | `curl`, `python3` |\n\n### What it detects\n\n**Secrets & sensitive data**\n- AWS / GCP / GitHub / Stripe / Twilio / SendGrid / Slack / Firebase / Sentry API keys\n- JWT tokens, private keys, hardcoded passwords, database connection strings\n- Internal IPs, staging URLs, source maps, debug artifacts in production JS\n\n**Vulnerabilities**\n- DOM XSS sinks: `innerHTML`, `document.write`, `eval`, `location.href`, `dangerouslySetInnerHTML`\n- Prototype pollution patterns\n- Missing / misconfigured security headers (CSP, HSTS, X-Frame-Options, CORP, COOP, etc.)\n- Insecure cookie flags (missing `Secure`, `HttpOnly`, `SameSite`)\n- CORS misconfiguration (wildcard, origin reflection, credentials + wildcard)\n- Subdomain takeover (S3, GitHub Pages, Heroku, Netlify, Azure, Fastly, Cloudfront)\n- Exposed sensitive paths: `.env`, `.git/config`, `/actuator/env`, Swagger, GraphQL, phpinfo\n\n**Library vulnerabilities**\n- Known CVEs in jQuery, Bootstrap, lodash, Angular, React, and 1000+ other libraries via the retire.js database\n\n---\n\n## Requirements\n\n| Dependency | Required | Notes |\n|------------|----------|-------|\n| `python3` | Yes | 3.7+ |\n| `curl` | Yes | Pre-installed on macOS and most Linux |\n| `pip3` | Yes | Ships with Python 3 |\n| `npx` / Node.js | No | Enables Step 4b (retire.js). Without it, library CVE scanning is skipped. |\n\nThe plugin **auto-installs** `requests`, `beautifulsoup4`, and `dnspython` on first run via `pip3 install --user`. If anything is missing it prints the correct install command for your OS (macOS, Ubuntu/Debian, RHEL, Arch).\n\n---\n\n## Installation\n\n**Option A — Load directly (no install, development/personal use):**\n```bash\nclaude --plugin-dir /path/to/web_scan\n```\n\n**Option B — Install from GitHub (persistent, recommended):**\n```\n/plugin marketplace add enderphan94/web_scan\n/plugin install webscan@enderphan94\n```\n\n---\n\n## Usage\n\n```\n/webscan:scan <target>\n```\n\nThe target can be in any of these formats — the plugin normalises it automatically:\n\n```\n/webscan:scan acb.com\n/webscan:scan www.acb.com\n/webscan:scan https://www.acb.com\n/webscan:scan http://staging.acb.com/app\n```\n\nThe scan runs all steps and writes a report to `client_side_pentest_report.md` in your current working directory.\n\n---\n\n## Example use cases\n\n**Bug bounty recon**\n```\n/webscan:scan target.com\n```\nQuickly maps the client-side attack surface before manual testing — surfaces exposed secrets, vulnerable libraries, and misconfigured headers in one pass.\n\n**Pre-release security review**\n```\n/webscan:scan staging.myapp.com\n```\nCatch hardcoded API keys, missing security headers, and vulnerable dependencies before shipping to production.\n\n**CTF / web challenge**\n```\n/webscan:scan chall.ctf.example.com\n```\nAutomates the initial recon phase — checks for exposed `.git`, source maps, debug endpoints, and JS secrets that are common CTF entry points.\n\n**Third-party vendor assessment**\n```\n/webscan:scan vendor-portal.thirdparty.com\n```\nAssess the client-side security posture of a vendor's web portal without needing access to their source code.\n\n**Internal audit**\n```\n/webscan:scan https://intranet.company.internal\n```\nAudit internal web apps for the same issues that external attackers would look for.\n\n---\n\n## Output\n\nThe plugin writes `client_side_pentest_report.md` with:\n\n- **Executive summary** — severity count table and top 3 findings\n- **Methodology** — OS detected, steps run, tools used\n- **Asset inventory** — subdomains and JS files found\n- **Findings** — grouped CRITICAL → HIGH → MEDIUM → LOW → INFO, each with evidence, reproduction steps, impact, and remediation\n- **False positives** — explicitly called out\n- **Remediation priorities** — ordered by severity\n- **Appendix** — raw evidence, all probed paths and HTTP status codes\n\n---\n\n## Approximate token usage\n\nToken usage depends on the target's JS bundle size and number of findings. Typical ranges:\n\n| Target type | Input tokens | Output tokens | Total |\n|-------------|-------------|---------------|-------|\n| Simple landing page (1–3 JS files) | ~8,000–15,000 | ~3,000–5,000 | ~11,000–20,000 |\n| Medium SPA (5–10 JS files) | ~20,000–45,000 | ~5,000–10,000 | ~25,000–55,000 |\n| Large app (10+ JS files, many subdomains) | ~50,000–120,000 | ~8,000–20,000 | ~58,000–140,000 |\n\n**What drives token usage:**\n- JS file sizes — minified bundles are large. The plugin caps analysis at 10 JS files.\n- Number of subdomains returned by crt.sh — capped at 20 probes.\n- Number of findings — more findings = longer report = more output tokens.\n\n> Tip: If you are on a token budget, run against a specific path (`/webscan:scan example.com/app`) rather than the root to limit the HTML and JS surface crawled.\n\n---\n\n## Safety and scope\n\n- **Non-destructive only** — no brute force, no credential stuffing, no DoS\n- **Passive first** — reads publicly accessible pages and JS; does not attempt to exploit\n- **Moderate request volume** — respects rate limits; paths are probed once, not in loops\n- **Authorized use only** — only scan targets you own or have explicit written permission to test\n\n---\n\n## License\n\nMIT — see [LICENSE](LICENSE)\n\n## Author\n\n[Ender Phan](https://github.com/enderphan94)\n",
  "bytes": 6356,
  "sha": "4749f532cceab3570bb27b1a364fdacc38ae77f6e0c9528cfbf1d0d3d2ff9055",
  "repo_slug": "enderphan94/web_scan",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_enderphan94_web_scan_webscanner_182a3968/readme"
}