WEB-WATCH – WEB VULNERABILITY SCANNER

Abstract

Web application security represents a critical challenge in contemporary cybersecurity as organizations increasingly rely on web-based services to handle sensitive data. Existing vulnerability scanners typically operate in two distinct categories: active scanners that effectively detect vulnerabilities but risk disrupting live systems, and passive scanners that minimize operational impact but may miss critical threats. This paper introduces Web-Watch, a hybrid web vulnerability scanner designed to bridge this gap by seamlessly integrating both active and passive scanning methodologies. Web-Watch combines the thorough detection capabilities of active scanning with the non-intrusive characteristics of passive scanning, enabling comprehensive vulnerability assessments without adversely affecting target system performance. The tool employs Python-based architecture optimized for Linux environments, featuring a command-line interface with planned GUI expansion, a vulnerability database powered by SQL, and integration capabilities with CI/CD pipelines. Evaluation on test applications demonstrated Web-Watch’s effectiveness in detecting SQL injection, cross-site scripting (XSS), command injection, and other critical vulnerabilities with high accuracy and minimal false positives. Results indicate Web-Watch successfully identifies security issues comparable to industry standards while maintaining resource efficiency. The tool positions itself as an accessible, adaptable solution for security professionals, developers, and organizations seeking balanced web application security assessments.