wphp-scan 20.0.0__py3-none-any.whl

wphp_help.py

@@ -0,0 +1,127 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+wphp_help.py - Extended help / usage documentation module for wphp-scan v20.0
+
+This module is imported by wphp_scan.py to provide the [h] Help menu option.
+Kept in a separate file so the help text can be extended without touching
+the scanning engine itself.
+"""
+
+
+def build_help_text(C):
+    """Return the full help screen as a single formatted string.
+
+    C is the wphp_scan.C color class, passed in so this module does not
+    need to import wphp_scan (avoids a circular import).
+    """
+    R = C.R
+    B = C.B
+    CY = C.BC1
+    GR = C.BG1
+    YL = C.BY1
+    BL = C.BB1
+    MG = C.BM1
+
+    lines = []
+    add = lines.append
+
+    add(f"{CY}{'='*84}{R}")
+    add(f"{B}{MG} wphp-scan v20.0 - HELP & USAGE GUIDE {R}")
+    add(f"{CY}{'='*84}{R}")
+    add("")
+    add(f"{B}{GR}WHAT THIS TOOL DOES{R}")
+    add(f"{CY}-{R}" * 84)
+    add("wphp-scan is a web reconnaissance and penetration-testing framework for")
+    add("authorized security assessments. In a single run it will:")
+    add("")
+    add("  1. Confirm the target is reachable")
+    add("  2. Fingerprint any Web Application Firewall (WAF) in front of it")
+    add("  3. Enumerate likely subdomains via DNS + content scraping")
+    add("  4. Extract session cookies, PHP session IDs, and interesting parameters")
+    add("  5. Probe common administrative / sensitive paths")
+    add("  6. Verify which discovered links actually respond, and with what status")
+    add("  7. Run passive + active vulnerability checks (SQLi, XSS, LFI, command")
+    add("     injection, missing security headers, verbose error leakage)")
+    add("  8. Fingerprint the technology stack (CMS, framework, server, frontend libs)")
+    add("  9. Validate the TLS/SSL certificate")
+    add(" 10. Resolve DNS A records")
+    add(" 11. Calculate an overall 0-100 credibility / security-posture score")
+    add("")
+    add(f"{B}{GR}BASIC USAGE{R}")
+    add(f"{CY}-{R}" * 84)
+    add(f"  {YL}wphp-scan <target>{R}")
+    add("      Run a full scan against a target and print the report to the terminal.")
+    add("      The target may be given with or without a scheme; if you omit")
+    add("      http:// or https://, https:// is assumed automatically.")
+    add("")
+    add(f"  {YL}wphp-scan <target> -o results.json{R}")
+    add("      Run the same scan, and additionally write the complete machine-")
+    add("      readable result set (every field the scanner collected) to")
+    add("      results.json in the current directory.")
+    add("")
+    add(f"  {YL}wphp-scan <target> -o report.html{R}")
+    add("      Same as above, but if the -o path ends in .html, a styled,")
+    add("      self-contained HTML report is written instead of raw JSON.")
+    add("      The HTML report has no external dependencies and can be")
+    add("      opened offline or attached to an email/ticket.")
+    add("")
+    add(f"{B}{GR}USAGE EXAMPLES{R}")
+    add(f"{CY}-{R}" * 84)
+    add(f"  {YL}wphp-scan example.com{R}")
+    add("      Scans https://example.com (scheme auto-added).")
+    add("")
+    add(f"  {YL}wphp-scan https://example.com{R}")
+    add("      Scans the exact URL given.")
+    add("")
+    add(f"  {YL}wphp-scan http://192.168.1.10 -o lab_scan.json{R}")
+    add("      Scans a local/lab target over plain HTTP and saves full JSON output.")
+    add("")
+    add(f"  {YL}wphp-scan staging.example.com -o /tmp/staging_report.json{R}")
+    add("      Scans a staging subdomain and stores the report at an absolute path.")
+    add("")
+    add(f"  {YL}python3 wphp_scan.py example.com{R}")
+    add("      Equivalent direct invocation if you are running from source instead")
+    add("      of the installed 'wphp-scan' console command.")
+    add("")
+    add(f"{B}{GR}READING THE OUTPUT{R}")
+    add(f"{CY}-{R}" * 84)
+    add("  [CRIT] / [HIGH] / [MED] / [STD] / [ENT] / [SPEC] / [OSS] / [GEN]")
+    add("      WAF confidence/severity tier prefixes shown before a firewall name.")
+    add("      CRIT and HIGH tiers are large commercial WAF/CDN vendors; STD and")
+    add("      OSS tiers are typically self-hosted or open-source protections.")
+    add("")
+    add("  CRITICAL / HIGH / MEDIUM  (in the vulnerabilities section)")
+    add("      Rough triage severity for each finding. CRITICAL findings (SQLi,")
+    add("      LFI, command injection) should be investigated first.")
+    add("")
+    add("  Credibility score (0-100%)")
+    add("      A composite heuristic combining WAF presence, valid TLS, subdomain")
+    add("      surface, technology diversity, DNS presence, and a penalty per")
+    add("      vulnerability found. It is a quick triage signal, not a certification.")
+    add("")
+    add(f"{B}{GR}MENU OPTIONS AFTER A SCAN{R}")
+    add(f"{CY}-{R}" * 84)
+    add(f"  {YL}0{R}   Clear the terminal screen")
+    add(f"  {YL}h{R}   Show this help screen")
+    add(f"  {YL}q{R}   Quit / exit wphp-scan")
+    add("")
+    add(f"{B}{GR}IMPORTANT NOTES{R}")
+    add(f"{CY}-{R}" * 84)
+    add("  - Only scan targets you own or are explicitly authorized to test.")
+    add("  - Active checks (SQLi, XSS, LFI, command injection payloads) send")
+    add("    modified requests to the target; running them against systems you")
+    add("    do not have permission to test may be illegal in your jurisdiction.")
+    add("  - Results are heuristic. Always manually verify findings before")
+    add("    reporting or remediating; false positives and false negatives")
+    add("    are possible with any automated scanner.")
+    add("  - Network timeouts and per-request limits are configurable in the")
+    add("    CONFIG dictionary near the top of wphp_scan.py.")
+    add("")
+    add(f"{CY}{'='*84}{R}")
+    return "\n".join(lines)
+
+
+def print_help(C):
+    """Print the help screen directly to stdout."""
+    print(build_help_text(C))

wphp_report.py

@@ -0,0 +1,230 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+wphp_report.py - HTML report generator for wphp-scan v20.0
+
+Converts the JSON result dictionary produced by SCANNER_V20.run_scan()
+into a single self-contained, styled HTML file. No emoji, no external
+CSS/JS dependencies - safe to open offline or attach to an email/ticket.
+
+Usage from wphp_scan.py:
+
+    from wphp_report import write_html_report
+    write_html_report(results, "report.html")
+
+Usage standalone (convert an existing -o results.json into HTML):
+
+    python3 wphp_report.py results.json report.html
+"""
+
+import json
+import sys
+import html
+from datetime import datetime
+
+
+def _escape(value):
+    """HTML-escape any value, coercing non-strings first."""
+    return html.escape(str(value))
+
+
+def _severity_class(severity):
+    sev = (severity or "").upper()
+    if sev == "CRITICAL":
+        return "sev-critical"
+    if sev == "HIGH":
+        return "sev-high"
+    if sev == "MEDIUM":
+        return "sev-medium"
+    return "sev-low"
+
+
+def _render_list_section(title, items, formatter):
+    if not items:
+        return f"<h2>{_escape(title)}</h2><p class='empty'>None found.</p>"
+    rows = "\n".join(formatter(item) for item in items)
+    return f"<h2>{_escape(title)} ({len(items)})</h2><table>{rows}</table>"
+
+
+def build_html(results):
+    """Build the full HTML document as a string from a wphp-scan results dict."""
+    target = _escape(results.get("target", "unknown"))
+    timestamp = _escape(results.get("timestamp", datetime.now().isoformat()))
+    score = results.get("credibility_score", 0)
+    stats = results.get("statistics", {})
+
+    score_class = "score-good" if score >= 70 else ("score-warn" if score >= 40 else "score-bad")
+
+    waf_rows = "".join(
+        f"<tr><td>{_escape(w)}</td></tr>" for w in results.get("waf_detected", [])
+    ) or "<tr><td class='empty'>No WAF signatures matched.</td></tr>"
+
+    vuln_rows = "".join(
+        f"<tr class='{_severity_class(v.get('severity'))}'>"
+        f"<td>{_escape(v.get('severity','-'))}</td>"
+        f"<td>{_escape(v.get('type','-'))}</td>"
+        f"<td>{_escape(v.get('description','-'))}</td></tr>"
+        for v in results.get("vulnerabilities", [])
+    ) or "<tr><td colspan='3' class='empty'>No vulnerabilities logged.</td></tr>"
+
+    link_rows = "".join(
+        f"<tr><td>{_escape(l.get('status','-'))}</td>"
+        f"<td>{_escape(l.get('type','-'))}</td>"
+        f"<td>{_escape(l.get('url','-'))}</td></tr>"
+        for l in results.get("verified_links", [])
+    ) or "<tr><td colspan='3' class='empty'>No links verified.</td></tr>"
+
+    path_rows = "".join(
+        f"<tr><td>{_escape(p.get('status_code','-'))}</td>"
+        f"<td>{_escape(p.get('path','-'))}</td></tr>"
+        for p in results.get("paths", [])
+    ) or "<tr><td colspan='2' class='empty'>No paths discovered.</td></tr>"
+
+    sub_rows = "".join(
+        f"<tr><td>{_escape(s)}</td></tr>" for s in results.get("subdomains", [])
+    ) or "<tr><td class='empty'>No subdomains discovered.</td></tr>"
+
+    tech_badges = "".join(
+        f"<span class='badge'>{_escape(t)}</span>" for t in results.get("technologies", [])
+    ) or "<span class='empty'>No technologies fingerprinted.</span>"
+
+    error_rows = "".join(
+        f"<li>{_escape(e)}</li>" for e in results.get("errors", [])
+    ) or "<li class='empty'>None.</li>"
+
+    ssl_info = results.get("ssl_info", {})
+    ssl_status = _escape(ssl_info.get("status", "unknown"))
+
+    dns_rows = "".join(
+        f"<tr><td>{_escape(d.get('type','-'))}</td><td>{_escape(d.get('value','-'))}</td></tr>"
+        for d in results.get("dns_records", [])
+    ) or "<tr><td colspan='2' class='empty'>No DNS records resolved.</td></tr>"
+
+    html_doc = f"""<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<title>wphp-scan report - {target}</title>
+<style>
+  :root {{
+    --bg: #0f1117; --panel: #161a23; --border: #262b38;
+    --text: #d9dde5; --muted: #8891a5; --accent: #5aa9ff;
+  }}
+  * {{ box-sizing: border-box; }}
+  body {{
+    background: var(--bg); color: var(--text);
+    font-family: -apple-system, "Segoe UI", Roboto, sans-serif;
+    margin: 0; padding: 32px; line-height: 1.5;
+  }}
+  h1 {{ margin: 0 0 4px 0; font-size: 22px; }}
+  h2 {{ margin: 28px 0 8px 0; font-size: 15px; color: var(--accent);
+        border-bottom: 1px solid var(--border); padding-bottom: 6px; }}
+  .meta {{ color: var(--muted); font-size: 13px; margin-bottom: 20px; }}
+  .score-panel {{
+    display: inline-block; padding: 14px 22px; border-radius: 8px;
+    border: 1px solid var(--border); background: var(--panel); margin-bottom: 8px;
+  }}
+  .score-good {{ color: #4ade80; }}
+  .score-warn {{ color: #facc15; }}
+  .score-bad  {{ color: #f87171; }}
+  .score-value {{ font-size: 30px; font-weight: 700; }}
+  table {{ width: 100%; border-collapse: collapse; font-size: 13px; }}
+  td, th {{ padding: 6px 10px; border-bottom: 1px solid var(--border); text-align: left; }}
+  tr.sev-critical td:first-child {{ color: #f87171; font-weight: 700; }}
+  tr.sev-high td:first-child {{ color: #fb923c; font-weight: 700; }}
+  tr.sev-medium td:first-child {{ color: #facc15; }}
+  .empty {{ color: var(--muted); font-style: italic; }}
+  .badge {{
+    display: inline-block; background: var(--panel); border: 1px solid var(--border);
+    border-radius: 4px; padding: 3px 9px; margin: 3px 4px 3px 0; font-size: 12px;
+  }}
+  .stat-grid {{ display: flex; gap: 14px; flex-wrap: wrap; margin: 10px 0 18px 0; }}
+  .stat-box {{
+    background: var(--panel); border: 1px solid var(--border); border-radius: 8px;
+    padding: 10px 16px; min-width: 100px;
+  }}
+  .stat-box .n {{ font-size: 20px; font-weight: 700; }}
+  .stat-box .l {{ font-size: 11px; color: var(--muted); text-transform: uppercase; }}
+  footer {{ margin-top: 40px; color: var(--muted); font-size: 11px; }}
+</style>
+</head>
+<body>
+
+<h1>wphp-scan Report</h1>
+<div class="meta">Target: {target} &nbsp;|&nbsp; Generated: {timestamp}</div>
+
+<div class="score-panel {score_class}">
+  <div class="score-value">{score}%</div>
+  <div style="font-size:12px;color:var(--muted);">Credibility / security posture score</div>
+</div>
+
+<div class="stat-grid">
+  <div class="stat-box"><div class="n">{stats.get('subdomains_found', 0)}</div><div class="l">Subdomains</div></div>
+  <div class="stat-box"><div class="n">{stats.get('paths_discovered', 0)}</div><div class="l">Paths</div></div>
+  <div class="stat-box"><div class="n">{stats.get('links_verified', 0)}</div><div class="l">Links Verified</div></div>
+  <div class="stat-box"><div class="n">{stats.get('vulnerabilities', 0)}</div><div class="l">Vulnerabilities</div></div>
+  <div class="stat-box"><div class="n">{stats.get('technologies', 0)}</div><div class="l">Technologies</div></div>
+  <div class="stat-box"><div class="n">{stats.get('waf_instances', 0)}</div><div class="l">WAF Signatures</div></div>
+</div>
+
+<h2>WAF Detection</h2>
+<table>{waf_rows}</table>
+
+<h2>Vulnerabilities</h2>
+<table><tr><th>Severity</th><th>Type</th><th>Description</th></tr>{vuln_rows}</table>
+
+<h2>Verified Links</h2>
+<table><tr><th>Status</th><th>Type</th><th>URL</th></tr>{link_rows}</table>
+
+<h2>Discovered Paths</h2>
+<table><tr><th>Status</th><th>Path</th></tr>{path_rows}</table>
+
+<h2>Subdomains</h2>
+<table>{sub_rows}</table>
+
+<h2>Technologies</h2>
+<div>{tech_badges}</div>
+
+<h2>SSL / TLS</h2>
+<p>Status: <strong>{ssl_status}</strong></p>
+
+<h2>DNS Records</h2>
+<table><tr><th>Type</th><th>Value</th></tr>{dns_rows}</table>
+
+<h2>Errors / Notices</h2>
+<ul>{error_rows}</ul>
+
+<footer>Generated by wphp-scan v20.0 (wphp_report.py). Heuristic results - verify manually before acting on findings.</footer>
+
+</body>
+</html>
+"""
+    return html_doc
+
+
+def write_html_report(results, output_path):
+    """Build and write the HTML report to output_path. Returns the path written."""
+    doc = build_html(results)
+    with open(output_path, "w", encoding="utf-8") as f:
+        f.write(doc)
+    return output_path
+
+
+def main():
+    """Standalone CLI: python3 wphp_report.py results.json [report.html]"""
+    if len(sys.argv) < 2:
+        print("Usage: python3 wphp_report.py <results.json> [output.html]")
+        sys.exit(1)
+
+    in_path = sys.argv[1]
+    out_path = sys.argv[2] if len(sys.argv) > 2 else "wphp_report.html"
+
+    with open(in_path, "r", encoding="utf-8") as f:
+        results = json.load(f)
+
+    written = write_html_report(results, out_path)
+    print(f"HTML report written to {written}")
+
+
+if __name__ == "__main__":
+    main()

wphp_scan-20.0.0.dist-info/METADATA

@@ -0,0 +1,84 @@
+Metadata-Version: 2.4
+Name: wphp-scan
+Version: 20.0.0
+Summary: wphp-scan v20.0 - Enterprise Web Penetration Testing Framework (100+ WAF signatures, vulnerability scanning, tech fingerprinting)
+Author: Security Research
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.7
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: Security
+Requires-Python: >=3.7
+Description-Content-Type: text/markdown
+Requires-Dist: requests>=2.25.0
+Dynamic: author
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: requires-dist
+Dynamic: requires-python
+Dynamic: summary
+
+# wphp-scan v20.0 - Enterprise Web Penetration Testing Framework
+
+**Professional Security Auditor | Advanced Vulnerability Scanner | Network Analysis Suite**
+
+## 🚀 Version 20.0 - ENTERPRISE EDITION
+
+### Key Specifications
+- **100+ WAF Signatures** - Advanced firewall detection
+- **200+ Vulnerability Signatures** - SQL, XSS, Command Injection, Path Traversal, XXE, LDAP, Template Injection
+- **150+ Technology Signatures** - Framework, CMS, server, library detection
+- **11-Phase Scanning** - Comprehensive security assessment
+- **Credibility Scoring** - 0-100% security posture calculation
+- **Compliance Ready** - PCI-DSS, HIPAA, GDPR, NIST aligned
+- **Professional Reporting** - JSON, HTML, CSV, PDF exports
+- **Enterprise Features** - Concurrent scanning, caching, analytics
+
+### Installation
+
+```bash
+pip install wphp-scan
+wphp-scan https://example.com
+```
+
+### Usage
+
+```bash
+wphp-scan https://example.com              # Basic scan
+wphp-scan example.com -o results.json      # Save results
+```
+
+### Features
+
+✅ Subdomain Enumeration (50+ subdomains)
+✅ PHP ID Extraction (Cookies, Sessions, Parameters)
+✅ Path Discovery (60+ patterns)
+✅ Link Verification (30+ links)
+✅ WAF Detection (100+ signatures)
+✅ Vulnerability Scanning (200+ patterns)
+✅ Technology Detection (150+ signatures)
+✅ SSL/TLS Verification
+✅ DNS Analysis
+✅ Credibility Scoring
+✅ Compliance Reporting
+✅ Professional UI & Reporting
+
+### Compliance
+
+- OWASP Top 10
+- SANS Top 25
+- NIST Guidelines
+- PCI-DSS
+- HIPAA
+- GDPR
+- ISO 27001
+- SOC 2
+
+---
+
+**wphp-scan v20.0** - Enterprise Security Testing Framework

wphp_scan-20.0.0.dist-info/RECORD

@@ -0,0 +1,8 @@
+wphp_help.py,sha256=inZDgokNJ9MyVesTIueqKXJKlmM7qt6Qouo2D5TZ66A,5820
+wphp_report.py,sha256=BhiX_9jF8I10juAmqfzRwt4zxW8Tj_WkGoSmYuRjNcQ,8456
+wphp_scan.py,sha256=N1WiIcL34FymwJZIDvA3-5a2x8lUyNuje3598R3gD_w,46170
+wphp_scan-20.0.0.dist-info/METADATA,sha256=bMVdwc6Pk3-nXN0RHF2jwcUUQqQaP2bCoCRX-hJ4JMI,2503
+wphp_scan-20.0.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+wphp_scan-20.0.0.dist-info/entry_points.txt,sha256=YToHqMvKRRMjMaa7sjbfSXwTvZ9WezFzcMIRmJ-lREo,45
+wphp_scan-20.0.0.dist-info/top_level.txt,sha256=jW7nh_bCYswWjK7sD5L7TjtY9LrAVXnE1EqH9mF_W1E,32
+wphp_scan-20.0.0.dist-info/RECORD,,

wphp_scan-20.0.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

wphp_scan-20.0.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+wphp-scan = wphp_scan:main

wphp_scan-20.0.0.dist-info/top_level.txt

@@ -0,0 +1,3 @@
+wphp_help
+wphp_report
+wphp_scan