diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ff2e25c..5c155e8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,8 +36,10 @@ jobs:
root / 'index.html',
root / '404.html',
root / 'passive-scanner' / 'index.html',
+ root / 'passive-scanner' / 'report' / 'index.html',
root / 'online-passive-scanner' / 'index.html',
root / 'online-passive-scanner' / 'report.html',
+ root / 'online-passive-scanner' / 'report-legacy.html',
]
missing_html = [str(p) for p in html_files if not p.exists()]
if missing_html:
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 32ccf7a..2cfc12e 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -45,8 +45,10 @@ jobs:
Path('index.html'),
Path('404.html'),
Path('passive-scanner/index.html'),
+ Path('passive-scanner/report/index.html'),
Path('online-passive-scanner/index.html'),
Path('online-passive-scanner/report.html'),
+ Path('online-passive-scanner/report-legacy.html'),
]
pattern = re.compile(r'(?:href|src)=["\']([^"\']+)["\']')
ignore_exact = {'link', 'link_to_plugin'}
diff --git a/README.md b/README.md
index 333a6b6..ccb3cf2 100644
--- a/README.md
+++ b/README.md
@@ -42,3 +42,4 @@ The scanner is vendored at `/online-passive-scanner/` and is accessible at:
A Jekyll-native launcher page is available at:
- `/passive-scanner/`
+- `/passive-scanner/report/`
diff --git a/_includes/header.html b/_includes/header.html
index 9b5d2ad..4ea35b8 100644
--- a/_includes/header.html
+++ b/_includes/header.html
@@ -2,5 +2,5 @@
Overview Capabilities Standards Scanner Docs
diff --git a/online-passive-scanner/report-legacy.html b/online-passive-scanner/report-legacy.html
new file mode 100644
index 0000000..b0a137a
--- /dev/null
+++ b/online-passive-scanner/report-legacy.html
@@ -0,0 +1,1237 @@
+
+
+
+
+
+
+
+
+ OWASP OWTF Report
+
+
+
+
+
+
+
+
+
+
Fork me on GitHub
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Status Complete
+
+
Command: owtf.py -t passive
+
Target: ( )
+
+
+
+
+
+
History
+
+
+
+ N°
+ START
+ END
+ COMMAND
+ STATUS
+
+
+
+
+
+ 1
+
+
+ owtf.py -t passive
+ Complete
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Plugin Groups
+
+
+
+
+
+
+ aux
+
+
+
+ net
+
+
+
+ web
+
+
+
+
+
+
+
+ Web Plugin Types
+ Aux Plugin Types
+ Net Plugin Types
+
+
+
+
+
+
+ active
+
+
+
+ external
+
+
+
+ grep
+
+
+
+ passive
+
+
+
+ semi_passive
+
+
+
+
+
+
+
+
+ bruteforce
+
+
+
+ dos
+
+
+
+ exploit
+
+
+
+ rce
+
+
+
+ se
+
+
+
+ selenium
+
+
+
+ smb
+
+
+
+
+
+
+
+
+ active
+
+
+
+ bruteforce
+
+
+
+
+
+
+
+ Web Test Groups
+
+
+
+
+
+
+
+
+ OWASP-IG-001 - Spiders, Robots, and Crawlers (robots.txt Analysis)
+
+
+
+ OWASP-IG-002 - Search engine discovery/reconnaissance (Google Hacking, Metadata)
+
+
+
+ OWASP-IG-003 - Identify application entry points (Crawling)
+
+
+
+ OWASP-IG-004 - Web Application Fingerprint (What is that site running?)
+
+
+
+ OWASP-IG-005 - Application Discovery (Port Scanning, Whois)
+
+
+
+ OWASP-IG-006 - Testing for Error Code (Error Messages)
+
+
+
+ OWASP-CM-001 - Testing for SSL-TLS (SSL Testing)
+
+
+
+ OWASP-CM-002 - Testing for DB Listener (DB Service Testing)
+
+
+
+ OWASP-CM-003 - Infrastructure Configuration Management (WAF, Load Balancer, Rev Proxy, User Agent)
+
+
+
+ OWASP-CM-004 - Application Configuration Management (Comments, Source code disclosure)
+
+
+
+ OWASP-CM-005 - File Extensions Handling (File uploads, etc)
+
+
+
+ OWASP-CM-006 - Old, Backup and Unreferenced Files (DirBuster, directory/file bruteforce)
+
+
+
+ OWASP-CM-007 - Testing for Admin Interfaces (Admin interface)
+
+
+
+ OWASP-CM-008 - HTTP Methods and XST (PUT, TRACE, WebDAV, etc)
+
+
+
+ OWASP-AT-001 - Testing for Credentials Transport (Passwords in clear-text)
+
+
+
+ OWASP-AT-002 - Testing for User Enumeration (User Enumeration)
+
+
+
+ OWASP-AT-003 - Default or Guessable User Account (Default accounts)
+
+
+
+ OWASP-AT-004 - Testing for Brute Force (Brute Force)
+
+
+
+ OWASP-AT-005 - Bypassing Authentication Schema ()
+
+
+
+ OWASP-AT-006 - Vulnerable Remember Password and Pwd Reset ()
+
+
+
+ OWASP-AT-007 - Logout and Browser Cache Management ()
+
+
+
+ OWASP-AT-008 - Testing for Captcha ()
+
+
+
+ OWASP-AT-009 - Multiple Factors Authentication ()
+
+
+
+ OWASP-AT-010 - Race Conditions ()
+
+
+
+ OWASP-SM-001 - Session Management Schema ()
+
+
+
+ OWASP-SM-002 - Cookies Attributes ()
+
+
+
+ OWASP-SM-003 - Session Fixation ()
+
+
+
+ OWASP-SM-004 - Exposed Session Variables ()
+
+
+
+ OWASP-SM-005 - Testing for CSRF ()
+
+
+
+ OWASP-AZ-001 - Path Traversal ()
+
+
+
+ OWASP-AZ-002 - Bypassing Authorization Schema ()
+
+
+
+ OWASP-AZ-003 - Privilege Escalation ()
+
+
+
+ OWASP-BL-001 - Business Logic ()
+
+
+
+ OWASP-DV-001 - Reflected Cross Site Scripting ()
+
+
+
+ OWASP-DV-002 - Stored Cross Site Scripting ()
+
+
+
+ OWASP-DV-003 - DOM-based Cross Site Scripting ()
+
+
+
+ OWASP-DV-004 - Cross Site Flashing ()
+
+
+
+ OWASP-DV-005 - SQL Injection ()
+
+
+
+ OWASP-DV-006 - LDAP Injection ()
+
+
+
+ OWASP-DV-007 - ORM Injection ()
+
+
+
+ OWASP-DV-008 - XML Injection ()
+
+
+
+ OWASP-DV-009 - SSI Injection ()
+
+
+
+ OWASP-DV-010 - XPath Injection ()
+
+
+
+ OWASP-DV-011 - SMTP Injection ()
+
+
+
+ OWASP-DV-012 - Code Injection ()
+
+
+
+ OWASP-DV-013 - Command Injection ()
+
+
+
+ OWASP-DV-014 - Buffer Overflow ()
+
+
+
+ OWASP-DV-015 - Incubated Vulnerability ()
+
+
+
+ OWASP-DV-016 - HTTP Splitting/Smuggling ()
+
+
+
+ OWASP-DS-001 - SQL Wildcard Attacks ()
+
+
+
+ OWASP-DS-002 - DoS Locking Customer Accounts ()
+
+
+
+ OWASP-DS-003 - DoS Buffer Overflows ()
+
+
+
+ OWASP-DS-004 - DoS User Specified Object Allocation ()
+
+
+
+ OWASP-DS-005 - User Input as a Loop Counter ()
+
+
+
+ OWASP-DS-006 - Writing User Provided Data to Disk ()
+
+
+
+ OWASP-DS-007 - DoS Failure to Release Resources ()
+
+
+
+ OWASP-DS-008 - Storing too Much Data in Session ()
+
+
+
+ OWASP-WS-001 - WS Information Gathering ()
+
+
+
+ OWASP-WS-002 - Testing WSDL ()
+
+
+
+ OWASP-WS-003 - Testing for XML Structural ()
+
+
+
+ OWASP-WS-004 - Testing for XML Content-Level ()
+
+
+
+ OWASP-WS-005 - WS HTTP GET parameters/REST attacks ()
+
+
+
+ OWASP-WS-006 - Naughty SOAP Attachments ()
+
+
+
+ OWASP-WS-007 - Testing for WS Replay ()
+
+
+
+ OWASP-AJ-001 - Testing for AJAX Vulnerabilities ()
+
+
+
+ OWASP-AJ-002 - Testing for AJAX ()
+
+
+
+ OWTF-WGP-001 - ClickJacking (ClickJacking)
+
+
+
+ OWTF-WGP-002 - Cross Origin Resource Sharing (CORS) (CORS)
+
+
+
+ OWTF-WVS-001 - Arachni Unauthenticated ()
+
+
+
+ OWTF-WVS-002 - Nikto Unauthenticated ()
+
+
+
+ OWTF-WVS-003 - Wapiti Unauthenticated ()
+
+
+
+ OWTF-WVS-004 - W3AF Unauthenticated ()
+
+
+
+ OWTF-WVS-005 - WebSecurify Unauthenticated ()
+
+
+
+ OWTF-WVS-006 - Skipfish Unauthenticated ()
+
+
+
+
+
+
+ Available Targets
+
+
+
+
+
+
+
+
+
+ -
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Statistics
+
+
Passed Tests
+
+
Findings
+
+
Unrated
+
+
+
+
+
+
+
+ Subreport is not loaded yet ... click Refresh button!
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/online-passive-scanner/report.html b/online-passive-scanner/report.html
index b0a137a..6bfff66 100644
--- a/online-passive-scanner/report.html
+++ b/online-passive-scanner/report.html
@@ -1,1237 +1,27 @@
-
-
-
-
-
-
OWASP OWTF Report
-
-
-
-
-
-
+
+
+
Redirecting to passive scanner report...
+
+
-
-
Fork me on GitHub
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Status Complete
-
-
Command: owtf.py -t passive
-
Target: ( )
-
-
-
-
-
-
History
-
-
-
- N°
- START
- END
- COMMAND
- STATUS
-
-
-
-
-
- 1
-
-
- owtf.py -t passive
- Complete
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Plugin Groups
-
-
-
-
-
-
- aux
-
-
-
- net
-
-
-
- web
-
-
-
-
-
-
-
- Web Plugin Types
- Aux Plugin Types
- Net Plugin Types
-
-
-
-
-
-
- active
-
-
-
- external
-
-
-
- grep
-
-
-
- passive
-
-
-
- semi_passive
-
-
-
-
-
-
-
-
- bruteforce
-
-
-
- dos
-
-
-
- exploit
-
-
-
- rce
-
-
-
- se
-
-
-
- selenium
-
-
-
- smb
-
-
-
-
-
-
-
-
- active
-
-
-
- bruteforce
-
-
-
-
-
-
-
- Web Test Groups
-
-
-
-
-
-
-
-
- OWASP-IG-001 - Spiders, Robots, and Crawlers (robots.txt Analysis)
-
-
-
- OWASP-IG-002 - Search engine discovery/reconnaissance (Google Hacking, Metadata)
-
-
-
- OWASP-IG-003 - Identify application entry points (Crawling)
-
-
-
- OWASP-IG-004 - Web Application Fingerprint (What is that site running?)
-
-
-
- OWASP-IG-005 - Application Discovery (Port Scanning, Whois)
-
-
-
- OWASP-IG-006 - Testing for Error Code (Error Messages)
-
-
-
- OWASP-CM-001 - Testing for SSL-TLS (SSL Testing)
-
-
-
- OWASP-CM-002 - Testing for DB Listener (DB Service Testing)
-
-
-
- OWASP-CM-003 - Infrastructure Configuration Management (WAF, Load Balancer, Rev Proxy, User Agent)
-
-
-
- OWASP-CM-004 - Application Configuration Management (Comments, Source code disclosure)
-
-
-
- OWASP-CM-005 - File Extensions Handling (File uploads, etc)
-
-
-
- OWASP-CM-006 - Old, Backup and Unreferenced Files (DirBuster, directory/file bruteforce)
-
-
-
- OWASP-CM-007 - Testing for Admin Interfaces (Admin interface)
-
-
-
- OWASP-CM-008 - HTTP Methods and XST (PUT, TRACE, WebDAV, etc)
-
-
-
- OWASP-AT-001 - Testing for Credentials Transport (Passwords in clear-text)
-
-
-
- OWASP-AT-002 - Testing for User Enumeration (User Enumeration)
-
-
-
- OWASP-AT-003 - Default or Guessable User Account (Default accounts)
-
-
-
- OWASP-AT-004 - Testing for Brute Force (Brute Force)
-
-
-
- OWASP-AT-005 - Bypassing Authentication Schema ()
-
-
-
- OWASP-AT-006 - Vulnerable Remember Password and Pwd Reset ()
-
-
-
- OWASP-AT-007 - Logout and Browser Cache Management ()
-
-
-
- OWASP-AT-008 - Testing for Captcha ()
-
-
-
- OWASP-AT-009 - Multiple Factors Authentication ()
-
-
-
- OWASP-AT-010 - Race Conditions ()
-
-
-
- OWASP-SM-001 - Session Management Schema ()
-
-
-
- OWASP-SM-002 - Cookies Attributes ()
-
-
-
- OWASP-SM-003 - Session Fixation ()
-
-
-
- OWASP-SM-004 - Exposed Session Variables ()
-
-
-
- OWASP-SM-005 - Testing for CSRF ()
-
-
-
- OWASP-AZ-001 - Path Traversal ()
-
-
-
- OWASP-AZ-002 - Bypassing Authorization Schema ()
-
-
-
- OWASP-AZ-003 - Privilege Escalation ()
-
-
-
- OWASP-BL-001 - Business Logic ()
-
-
-
- OWASP-DV-001 - Reflected Cross Site Scripting ()
-
-
-
- OWASP-DV-002 - Stored Cross Site Scripting ()
-
-
-
- OWASP-DV-003 - DOM-based Cross Site Scripting ()
-
-
-
- OWASP-DV-004 - Cross Site Flashing ()
-
-
-
- OWASP-DV-005 - SQL Injection ()
-
-
-
- OWASP-DV-006 - LDAP Injection ()
-
-
-
- OWASP-DV-007 - ORM Injection ()
-
-
-
- OWASP-DV-008 - XML Injection ()
-
-
-
- OWASP-DV-009 - SSI Injection ()
-
-
-
- OWASP-DV-010 - XPath Injection ()
-
-
-
- OWASP-DV-011 - SMTP Injection ()
-
-
-
- OWASP-DV-012 - Code Injection ()
-
-
-
- OWASP-DV-013 - Command Injection ()
-
-
-
- OWASP-DV-014 - Buffer Overflow ()
-
-
-
- OWASP-DV-015 - Incubated Vulnerability ()
-
-
-
- OWASP-DV-016 - HTTP Splitting/Smuggling ()
-
-
-
- OWASP-DS-001 - SQL Wildcard Attacks ()
-
-
-
- OWASP-DS-002 - DoS Locking Customer Accounts ()
-
-
-
- OWASP-DS-003 - DoS Buffer Overflows ()
-
-
-
- OWASP-DS-004 - DoS User Specified Object Allocation ()
-
-
-
- OWASP-DS-005 - User Input as a Loop Counter ()
-
-
-
- OWASP-DS-006 - Writing User Provided Data to Disk ()
-
-
-
- OWASP-DS-007 - DoS Failure to Release Resources ()
-
-
-
- OWASP-DS-008 - Storing too Much Data in Session ()
-
-
-
- OWASP-WS-001 - WS Information Gathering ()
-
-
-
- OWASP-WS-002 - Testing WSDL ()
-
-
-
- OWASP-WS-003 - Testing for XML Structural ()
-
-
-
- OWASP-WS-004 - Testing for XML Content-Level ()
-
-
-
- OWASP-WS-005 - WS HTTP GET parameters/REST attacks ()
-
-
-
- OWASP-WS-006 - Naughty SOAP Attachments ()
-
-
-
- OWASP-WS-007 - Testing for WS Replay ()
-
-
-
- OWASP-AJ-001 - Testing for AJAX Vulnerabilities ()
-
-
-
- OWASP-AJ-002 - Testing for AJAX ()
-
-
-
- OWTF-WGP-001 - ClickJacking (ClickJacking)
-
-
-
- OWTF-WGP-002 - Cross Origin Resource Sharing (CORS) (CORS)
-
-
-
- OWTF-WVS-001 - Arachni Unauthenticated ()
-
-
-
- OWTF-WVS-002 - Nikto Unauthenticated ()
-
-
-
- OWTF-WVS-003 - Wapiti Unauthenticated ()
-
-
-
- OWTF-WVS-004 - W3AF Unauthenticated ()
-
-
-
- OWTF-WVS-005 - WebSecurify Unauthenticated ()
-
-
-
- OWTF-WVS-006 - Skipfish Unauthenticated ()
-
-
-
-
-
-
- Available Targets
-
-
-
-
-
-
-
-
-
- -
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Statistics
-
-
Passed Tests
-
-
Findings
-
-
Unrated
-
-
-
-
-
-
-
- Subreport is not loaded yet ... click Refresh button!
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
Redirecting to the modern passive scanner report view...
+
Continue
+
diff --git a/passive-scanner/index.html b/passive-scanner/index.html
index baa7044..396e559 100644
--- a/passive-scanner/index.html
+++ b/passive-scanner/index.html
@@ -11,7 +11,7 @@
Passive scanner
Scan a target URL
-
This Jekyll page launches OWTF's upstream online passive scanner and opens its report view for the URL you provide.
+
Passive scanning reviews publicly exposed signals such as headers, metadata, and client-side behavior to surface likely security misconfigurations without active exploitation.
@@ -54,7 +54,7 @@
Sca
try {
var parsed = new URL(value);
- var destination = '/online-passive-scanner/report.html#q=' + encodeURIComponent(parsed.href);
+ var destination = '/passive-scanner/report/#q=' + encodeURIComponent(parsed.href);
window.location.assign(destination);
} catch (err) {
showError('The value provided is not a valid URL.');
diff --git a/passive-scanner/report/index.html b/passive-scanner/report/index.html
new file mode 100644
index 0000000..a3190e9
--- /dev/null
+++ b/passive-scanner/report/index.html
@@ -0,0 +1,95 @@
+---
+layout: default
+title: "OWTF Passive Scanner Report"
+description: "Review passive scan findings in a modern report interface."
+---
+
+
+ {% include header.html %}
+
+
+
+
Passive scanner report
+
Target Findings
+
This report highlights externally visible signals that can indicate weak security posture, such as risky headers, information disclosure, and client-side findings.
+
+
+
+
+
+
Target
+
No target selected.
+
Enter a URL and reopen the report if you need to switch targets.
+
+
+
+
+
+
+
+
Report View
+
Embedded legacy engine
+
+
+
+
+
+ {% include footer.html %}
+
+