International Journal of Engineering Applied Sciences and Technology, 2019 Vol. 4, Issue 1, ISSN No. 2455-2143, Pages 132-136 Published Online May 2019 in IJEAST (http://www.ijeast.com) 132 AUTOMATED WEB VULNERABILITY SCANNER Rahul Maini Department of Computer Engineering BVDUCOEP, Pune, Maharashtra, INDIA Rahul Pandey Department of Computer Engineering BVDUCOEP, Pune, Maharashtra, INDIA Rajeev Kumar Department of Computer Engineering BVDUCOEP, Pune, Maharashtra, INDIA Rajat Gupta Department of Computer Engineering BVDUCOEP, Pune, Maharashtra, INDIA Abstract— In this era, when the time and internet has evolved, the web application threats have increased by ten folds. The cause of the web vulnerabilities are still due to the lack of input validation. This causes the CIA (Confidentiality Integrity and Availability) Triad Model to break. To solve this, we develop a scanner for finding common vulnerabilities in web applications including SQL Injection, Cross-Site-Scripting (XSS), CRLF Injection, and Open Redirect. It also include a simple port scanner along with a web crawler module which helps to identify other services which may be running on the web server. In this paper, we introduce a simple black-box security test technique for finding these issues. At the end of the paper, we demonstrate how easy it is to scan a complex enterprise-grade web application with our scanner. The main goal of the scanner is to uncover the vulnerabilities and produce a better result/report of each web application in effective manner. Keywords— SQL Injection, XSS, CRLF Injection, Open Redirect, Web application vulnerability, Port Scanner, Web Crawler, Web Scanner tool I. INTRODUCTION Web Applications are continuously emerging and largely prevalent critical piece of our daily lives. The Web technology stack, the languages, frameworks etc. have improved a lot. However, the security of web application is still basic proposed by Marcus Pinto et al [1]. Security is never thought of while developing an application. The term vulnerability is a weakness or a shortcoming in a piece of software that allows a threat actor to harm or destroy the respectability of a system. The Most Common Vulnerabilities present in Web Applications as of 2019 are: Cross Site Scripting (XSS), SQL (Structured Query Language) Injection, Carriage Return Line Feed (CRLF) Injection, Open Redirects and others. Even after a noteworthy period of existence, these vulnerabilities still do not cease to exist. Exploiting these vulnerabilities are also very simple and easy for a threat actor. Identifying vulnerabilities for the most part is not an easy task, and not many basic vulnerabilities can be effectively identified via automated scanners proposed by V. Suhina et al [7]. Most of the software bugs in web application are a result from an invalid input sanitization proposed by David Shelly et al [2][4]. These vulnerabilities may be SQL injection, Cross-Site Scripting, Carriage Return Line Feed Injection, Open Redirect. Although the dominant part of web vulnerabilities are straight-forward and to maintain a calculated distance from, numerous web designers are, shockingly, not security-mindful. Consequently, there exist an expansive number of vulnerable applications as well as websites on World Wide Web. Most important ways to deal with testing programming applications for the Web Applications are static (white-box) and dynamic (black box) as well as gray-box approach. In Black Box based Security testing, only high- level of information is made available to testers such as URL or address of the organization to perform penetration testing. Here, tester may see himself as a hacker who is unaware of the system/network. Black box testing is a time consuming approach as the tester is not cognizable of system/network‟s attributes and he/she will need considerable amount of time to explore system‟s properties and details. Further, this approach of testing may result into missing out of some areas, keeping in view limited time period and information. proposed by University of Zagreb et al [8] At the end, we present that how the port scanner finds the services running on the server and open ports, how the web crawler module work into the identification of endpoints and paths or how the scanner implements to sidestep the verification of web application and recognize web application helplessness existed in them by re-enacting web assaulting and investigating the information of reaction. In the scanner module, we send specially crafted payloads for identifying vulnerable web