SiteShow is a powerful, automated Web & API vulnerability scanner designed for penetration testers, bug bounty hunters, developers, and security learners. It performs intelligent crawling, deep vulnerability testing, CVE fingerprinting, and produces clean HTML/JSON reports to help you find and fix real-world security issues.
- Smart crawling to discover pages, forms, and API endpoints
- Detects XSS, SQLi (error/blind/time), Command Injection, Path Traversal, SSRF, XXE, IDOR, Open Redirects
- Checks CSRF, CORS misconfigurations, security headers, insecure cookies, and session handling
- Sensitive data discovery (API keys, credentials, private keys)
- Built-in CVE detection engine for common stacks (Apache, Nginx, PHP, WordPress, Drupal, Spring, Log4j)
- API security tests: exposed endpoints, missing rate limiting, mass assignment
- Multi-threaded scanning and colorized console logging
- Generates professional HTML and JSON reports with severity, payloads, and remediation tips
# Update package list
sudo apt update
# Install Python and pip (if not already installed)
sudo apt install python3 python3-pip -y
# Install required system dependencies
sudo apt install build-essential python3-dev -yAuthor: Tricks2erCl0wn
pip3 install requests beautifulsoup4 urllib3 lxml
#if doed not work the try
pip3 install requests beautifulsoup4 urllib3 lxml --break-system-packages
#Run the scanner
python site_show.pyTip: Run against a target you own or have explicit permission to test.
- HTML report (e.g.,
security_report_YYYYMMDD_HHMMSS.html) - JSON report (same name,
.json)
Reports include vulnerability details, severity breakdown, CVE findings, and recommended fixes.
- Bug bounty hunts
- Penetration testing engagements
- DevSecOps scanning for staging environments
- Security training and research
Contributions, issue reports, and feature requests are welcome. Please open issues or PRs on this repository.
This project is distributed under the MIT License. See the LICENSE file for details.