ToolsWeb Scanner
webSlow

Web Scanner

Web Server & Misconfiguration Scanner

"Web server misconfiguration scanner — dangerous files, outdated software, and known vulnerabilities."

▶ Scan with Web Scanner
Overview

Web Scanner focuses specifically on web server misconfigurations that are commonly overlooked: test files left in production, backup files containing source code, outdated server software, dangerous HTTP methods enabled, and information leakage in headers and error pages.

Unlike template-based tools, Web Scanner uses a comprehensive database of known bad patterns and dangerous paths. It checks thousands of potential issues in a systematic way. Three scan modes let you balance speed against coverage.

Scan options
OptionDescriptionEst. time
quick
Fast surface check — top issues only
~5 min/host
standardDEFAULT
Comprehensive scan — most checks, recommended
~10 min/host
thorough
Exhaustive check — everything, slowest
~20 min/host
Example findings
HIGHHTTP PUT Method Enabled — File Upload Possible
HIGH/phpinfo.php Exposed — Full PHP Config Leaked
MEDIUMApache 2.4.49 — Path Traversal CVE-2021-41773
MEDIUMDirectory Listing Enabled at /uploads/
What it discovers
  • Dangerous HTTP methods enabled (PUT, DELETE, TRACE)
  • Test and backup files exposed (/test.php, /backup.zip, /.bak)
  • Default files and installations (/phpinfo.php, /server-status)
  • Outdated web server software with known CVEs
  • Information disclosure in headers and error pages
  • Insecure cookie attributes
  • Directory listing enabled
  • CGI vulnerabilities