All Options
Complete CLI reference for WebSec-Audit.
./websec-audit.sh -t <target> [options]
Required
| Flag |
Description |
-t, --target <url\|ip> |
Target URL or IP address. If no scheme is provided, https:// is assumed. |
Output
| Flag |
Default |
Description |
-o, --output <dir> |
./results_<domain>_<ts> |
Directory where all results are saved |
--format <fmt> |
all |
Report format: json | html | txt | all |
Scan options
| Flag |
Default |
Description |
-T, --threads <n> |
10 |
Concurrent threads passed to brute-force tools |
-p, --ports <profile> |
top-1000 |
Port profile: top-100 | top-1000 | full |
--timeout <s> |
10 |
Connection timeout in seconds for all HTTP/TCP operations |
--depth <n> |
3 |
Crawl depth used in aggressive sqlmap and CMS scans |
--proxy <url> |
(none) |
Route all traffic through this proxy (e.g. http://127.0.0.1:8080) |
--aggressive |
off |
Aggressive mode — deeper scans, higher noise, more findings |
--stealth |
off |
Stealth mode — slower, lower detection footprint |
Warning
--aggressive and --stealth are mutually exclusive. If both are provided, --aggressive takes precedence.
Module control
Every module can be individually disabled. Useful for scoping an audit or skipping slow/noisy tools.
| Flag |
Module disabled |
--skip-recon |
Reconnaissance (WHOIS, DNS, subdomain enum) |
--skip-portscan |
Port scanning (nmap) |
--skip-fingerprint |
Web fingerprinting (WhatWeb, WAF) |
--skip-ssl |
SSL/TLS analysis |
--skip-headers |
HTTP security headers |
--skip-dirbrute |
Directory & file brute-forcing |
--skip-nikto |
Nikto web scanner |
--skip-sqli |
SQL injection (sqlmap) |
--skip-xss |
XSS testing (dalfox + manual) |
--skip-cms |
CMS detection & scanning |
--skip-cors |
CORS misconfiguration tests |
--skip-redirect |
Open redirect tests |
--skip-ssrf |
SSRF tests |
--skip-subtakeover |
Subdomain takeover checks |
--skip-nuclei |
Nuclei template scan |
Wordlists
| Flag |
Default |
Description |
--wl-dirs-small <file> |
/usr/share/wordlists/dirb/common.txt |
Small wordlist for directory brute-force (normal mode) |
--wl-dirs-big <file> |
/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt |
Large wordlist (aggressive mode) |
--wl-dns <file> |
/usr/share/wordlists/dnsmap.txt |
DNS subdomain brute-force wordlist |
Misc
| Flag |
Description |
-v, --verbose |
Print verbose debug output to stdout |
--no-color |
Disable ANSI colour output (useful for piping / CI) |
--no-banner |
Suppress the ASCII banner (useful for scripting) |
-V, --version |
Print version and exit |
-h, --help |
Print usage and exit |
Examples
# Basic scan
./websec-audit.sh -t https://target.com
# Aggressive with 20 threads, custom output dir
./websec-audit.sh -t https://target.com --aggressive -T 20 -o /tmp/audit
# Stealth through Burp Suite
./websec-audit.sh -t https://target.com --stealth --proxy http://127.0.0.1:8080
# Skip slow modules, verbose, JSON only
./websec-audit.sh -t https://target.com --skip-nikto --skip-sqli -v --format json
# Full port scan, deep crawl
./websec-audit.sh -t https://target.com --ports full --depth 5 --aggressive
# Headers and SSL audit only (everything else skipped)
./websec-audit.sh -t https://target.com \
--skip-recon --skip-portscan --skip-fingerprint \
--skip-dirbrute --skip-nikto --skip-sqli --skip-xss \
--skip-cms --skip-cors --skip-redirect --skip-ssrf \
--skip-subtakeover --skip-nuclei
# No colour, no banner — clean output for CI/logging
./websec-audit.sh -t https://target.com --no-color --no-banner