VS.py

import os
import re
import tkinter as tk
from tkinter import filedialog, messagebox

# Define the OWASP Top 10 vulnerabilities patterns
Full_Vuln_List = {
    "Injection": [
        r"(?i)\b(?:select|insert|update|delete|drop|alter|create)\b[^;]*\b(?:from|into|where)\b",
        r"(?i)\b(?:exec|eval|system|os\.popen|subprocess\.call)\b",
        r"(?i)\b(?:<\?php|\$_(GET|POST|REQUEST|COOKIE))\b"
    ],
    "Broken Authentication": [
        r"(?i)\b(?:password|passwd|admin|login)\b"
    ],
    "Sensitive Data Exposure": [
        r"(?i)\b(?:apikey|secretkey|password|credentials)\b"
    ],
    "XML External Entities (XXE)": [
        r"(?i)\b<!ENTITY\b"
    ],
    "Broken Access Control": [
        r"(?i)\b(?:chmod|chown|chmod777)\b"
    ],
    "Security Misconfiguration": [
        r"(?i)\b(?:debug=True|verbose=True)\b"
    ],
    "Cross-Site Scripting (XSS)": [
        r"(?i)<\s*script\b[^>]*>[^<]*<\s*/\s*script\s*>",
        r"(?i)\b(?:alert|document\.write|eval\(|javascript:|<\s*img\b[^>]*\sonerror\b)",
    ],
    "Insecure Deserialization": [
        r"(?i)\b(?:pickle|cPickle|unpickle|pyYAML|yaml\.load)\b"
    ],
    "Using Components with Known Vulnerabilities": [
        r"(?i)\b(?:django|flask|rails|struts|phpmyadmin)\b"
    ],
    "Insufficient Logging and Monitoring": [
        r"(?i)\b(?:print|console\.log)\b"
    ],
    "Unvalidated Redirects and Forwards": [
        r"(?i)\b(?:redirect|forward)\([^)]+\)"
    ],
    "Cross-Site Request Forgery (CSRF)": [
        r"(?i)<\s*form\b[^>]*>\s*<\s*input\b[^>]*\stype=['\"]hidden['\"]\s*name=['\"]csrf_token['\"]"
    ],
    "Server-Side Request Forgery (SSRF)": [
        r"(?i)\b(?:file_get_contents|urllib\.request|urllib2\.urlopen|httplib\.HTTP|http\.client\.HTTPConnection)\b"
    ],
    "Cross-Site Script Inclusion (XSSI)": [
        r"(?i)\b(?:<\s*script\b[^>]*\bsrc=['\"]https?://[^'\"]+)"
    ],
    "Mass Assignment": [
        r"(?i)\b(?:setattr|__dict__|request\.POST)\b"
    ]
}

def scan_directory(directory):
    vulnerabilities = []

    for root, dirs, files in os.walk(directory):
        for file in files:
            file_path = os.path.join(root, file)
            with open(file_path, "r", encoding="latin-1") as f:
                content = f.read()
            for vulnerability, patterns in Full_Vuln_List.items():
                for pattern in patterns:
                    matches = re.findall(pattern, content)
                    if matches:
                        vulnerabilities.append((file_path, vulnerability, matches))

    return vulnerabilities

def select_directory():
    directory = filedialog.askdirectory()
    directory_entry.delete(0, tk.END)
    directory_entry.insert(0, directory)

def scan_directory_gui():
    directory = directory_entry.get()
    if not directory:
        messagebox.showerror("Error", "Please select a directory.")
        return

    vulnerabilities_found = scan_directory(directory)

    if vulnerabilities_found:
        result_text.delete(1.0, tk.END)
        for file_path, vulnerability, matches in vulnerabilities_found:
            result_text.insert(tk.END, f"Vulnerability: {vulnerability}\n")
            result_text.insert(tk.END, f"File: {file_path}\n")
            result_text.insert(tk.END, "Matches:\n")
            for match in matches:
                result_text.insert(tk.END, f"{match}\n")
            result_text.insert(tk.END, "\n")

        save_to_file(vulnerabilities_found)  # Save the output to a file
    else:
        result_text.delete(1.0, tk.END)
        result_text.insert(tk.END, "No vulnerabilities found.")

def save_to_file(vulnerabilities):
    file_path = filedialog.asksaveasfilename(defaultextension=".txt")
    if not file_path:
        return

    with open(file_path, "w") as f:
        for file_path, vulnerability, matches in vulnerabilities:
            f.write(f"Vulnerability: {vulnerability}\n")
            f.write(f"File: {file_path}\n")
            f.write("Matches:\n")
            for match in matches:
                f.write(f"{match}\n")
            f.write("\n")

    messagebox.showinfo("Save Successful", "Output saved to file.")

# Create the GUI window
window = tk.Tk()
window.title("Vulnerability Scanner")
window.geometry("1000x700")

# Directory selection
directory_label = tk.Label(window, text="Select Directory:")
directory_label.pack()

directory_entry = tk.Entry(window, width=40)
directory_entry.pack()

select_button = tk.Button(window, text="Browse", command=select_directory)
select_button.pack()

# Scan button
scan_button = tk.Button(window, text="Scan Directory", command=scan_directory_gui)
scan_button.pack()

# Result text area
result_text = tk.Text(window, height=100)
result_text.pack()

# Start the GUI event loop
window.mainloop()