HackGuard is a Python-based automated web security scanner designed for ethical hacking, penetration testing, and educational purposes. It scans websites, APIs, and local web apps for vulnerabilities like SQL Injection, XSS, CSRF, and open ports. The tool leverages OWASP ZAP, Nmap, and DNS/WHOIS lookups.
- Automated OWASP ZAP Vulnerability Scan (SQLi, XSS, CSRF, etc.)
- Port Scanning with Nmap
- DNS and WHOIS Lookup
- Generates PDF and CSV Security Reports
- CLI Interface
- IP reputation check (Optional with AbuseIPDB/IPInfo)
- Python 3
- OWASP ZAP API
- Nmap
- DNS Python
- Python-WHOIS
- ReportLab (PDF Generation)
- SQLite (Optional for logging)
- dotenv (for API key management)
- Clone the repository
git clone https://github.com/LalwaniPalash/HackGuard.git
cd HackGuard
- Install dependencies
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
- Install Nmap
sudo apt install nmap # Linux
brew install nmap # macOS
- Install OWASP ZAP (Locally)
-
Download ZAP from: https://www.zaproxy.org/download/
-
Run ZAP:
./zap.sh # Linux/macOS zap.bat # Windows
-
- Open ZAP GUI
- Go to
Tools→Options→API - Enable API
- Set or copy the API key (default port is
localhost:8080) - Add your API key to a
.envfile:
ZAP_API_KEY=your_zap_api_key
python hackguard.py
You'll be prompted to enter a target URL (e.g., http://testphp.vulnweb.com).
HackGuard_Report.pdf- Detailed PDF report with vulnerabilities, ports, and DNS infoHackGuard_Report.csv- CSV format report
- http://testphp.vulnweb.com
- http://zero.webappsecurity.com
- http://scanme.nmap.org (For port scan only)
This project is licensed under the The Unlicense.
- For educational purposes only.
- Do NOT scan websites without permission.
- Use only on legal targets or within authorized environments.
Pull requests are welcome! Feel free to fork the repository and submit improvements.