## https://sploitus.com/exploit?id=C5C8F46A-EA92-55B0-ADBD-85EB68956EB5
# VPulse
**Automated web security audit toolkit with screenshot evidence and actionable PoC reports.**
VPulse crawls a web target, exercises it against the most common and most dangerous
vulnerability classes, captures visual evidence of every finding, and produces a
human- and machine-readable report that includes proof-of-concept steps and fix guides.
[](#)
[](#license)
[](#development)
[](#)
---
## Table of Contents
- [What is VPulse](#what-is-vpulse)
- [The Approach](#the-approach)
- [Attack Surface Coverage](#attack-surface-coverage)
- [Architecture](#architecture)
- [Installation](#installation)
- [Quick Start](#quick-start)
- [CLI Reference](#cli-reference)
- [Reports](#reports)
- [Boundaries & Legal](#boundaries--legal)
- [Built-in Safety Controls](#built-in-safety-controls)
- [Project Structure](#project-structure)
- [Development](#development)
- [License](#license)
---
## What is VPulse
VPulse is a single-command security assessment tool. Point it at a URL and it will:
1. **Discover** endpoints, parameters, and forms (requests-based spider or Playwright browser).
2. **Attack** them with targeted payloads for SQLi, XSS, SSRF, IDOR, command injection, XXE, and CSRF.
3. **Audit** configuration — missing security headers, TLS/post-quantum crypto posture, and LatAm data-protection compliance.
4. **Capture** annotated screenshot evidence of each finding.
5. **Report** findings as JSON, Markdown, and an interactive HTML report with replication steps and remediation checklists.
It is designed for security teams, penetration testers, and developers who want a
fast, repeatable baseline assessment before a manual deep-dive.
---
## The Approach
VPulse follows a **reconnaissance → enumeration → attack → evidence → report** pipeline,
aligned with the phases of the [Penetration Testing Execution Standard (PTES)](http://www.pentest-standard.org/)
and the [OWASP Web Security Testing Guide](https://owasp.org/www-project-web-security-testing-guide/).
```
┌──────────────┐
target URL ──▶│ CRAWL │──▶ endpoints, parameters, forms
└──────┬───────┘
│
┌──────▼───────┐
│ ATTACK │──▶ SQLi · XSS · SSRF · IDOR · CMDi · XXE · CSRF
└──────┬───────┘
│
┌──────▼───────┐
│ EVIDENCE │──▶ Playwright screenshots + annotated banners
└──────┬───────┘
│
┌──────▼───────┐
│ REPORT │──▶ JSON · Markdown · interactive HTML
└──────────────┘
```
Each finding carries structured metadata so the output is as useful to a human
analyst as it is to a CI pipeline or an automation agent:
- **Severity** (CRITICAL / HIGH / MEDIUM / LOW / INFO)
- **Evidence** (what was observed)
- **PoC replication steps** (copy-paste `curl` / browser commands)
- **Fix steps** (language-specific remediation guidance)
- **Verification command** (confirm the fix after remediation)
---
## Attack Surface Coverage
| Module | Vulnerability class | Severity potential | Method |
|--------|--------------------|--------------------|--------|
| `sqli` | SQL injection (error/boolean/time/stacked/blind) | CRITICAL | Parameter fuzzing |
| `xss` | Cross-site scripting (reflected & stored) | HIGH / CRITICAL | Payload reflection |
| `ssrf` | Server-side request forgery | HIGH / CRITICAL | Internal/cloud-metadata probing |
| `idor` | Insecure direct object reference | HIGH | ID manipulation |
| `cmdi` | OS command injection | CRITICAL | Command separators |
| `xxe` | XML external entity injection | CRITICAL | Malformed XML/DTD |
| `csrf` | Cross-site request forgery | MEDIUM / HIGH | Missing/weak tokens |
| `headers`| Missing security headers, clickjacking | MEDIUM / HIGH | Response analysis |
| `crypto` | Post-quantum TLS posture (weak ciphers, RSA key size, deprecated protocols) | CRITICAL / INFO | TLS handshake + cert inspection |
| `compliance` | LatAm privacy law checks (LGPD, LFPDPPP, LEPD, PDPA, LPD, LPDP, LOPDP) | MEDIUM | Policy/cookie/HSTS analysis |
---
## Architecture
VPulse is a modular Python package. Each concern is isolated so modules can be
tested and extended independently.
```
vpulse/
├── __main__.py # python -m vpulse entry point
├── cli.py # argparse CLI, consent gate, proxy/Tor wiring
├── core/
│ ├── auditor.py # Orchestrator: crawl → attack → checks → evidence
│ └── reporter.py # JSON / Markdown / HTML report generation
└── modules/
├── attack/ # sqli, xss, ssrf, idor, cmdi, xxe, csrf
├── crawl/ # spider (requests) + browser_crawl (Playwright)
├── crypto/ # post-quantum TLS audit
└── compliance/ # LatAm data-protection checks
```
### Data flow
- `Auditor` coordinates the pipeline and owns the target, proxy, and TLS-verification settings.
- Crawl modules produce a normalized `DiscoveredEndpoint` / `BrowserEndpoint` list.
- Attack modules are pure functions: `test_*(url, method, params, proxy_url, verify) -> list[findings]`.
- The reporter consumes a single `audit_result` dict — no coupling between scanning and output.
---
## Installation
Requires **Python 3.12+**.
```bash
git clone
cd vpulse
# Install the package
pip install .
# Install the headless browser (only needed for --browser and screenshots)
python -m playwright install chromium
```
Verify:
```bash
vpulse --version
```
### Optional: Tor / proxy support
- `--proxy socks5://host:port` routes HTTP traffic through an arbitrary proxy.
- `--tor` routes through the local Tor SOCKS5 listener (`127.0.0.1:9050`).
- `--insecure` disables TLS certificate verification (use only against known
self-signed targets — see [Built-in Safety Controls](#built-in-safety-controls)).
---
## Configuration
VPulse reads an optional YAML config file (`vpulse.yaml` in the working directory,
or any path via `--config`). See [`vpulse.example.yaml`](vpulse.example.yaml) for a
fully documented example.
```yaml
# vpulse.yaml
headers: # extra headers on every request (auth tokens)
Authorization: "Bearer ..."
cookies: # authenticated session cookies
session: "..."
scope: # crawl scope
allowed_domains: [example.com]
exclude: [/logout, /admin]
concurrency: 5 # parallel crawl workers
rate_limit: 0.5 # min seconds between requests (polite scanning)
timeout: 10 # per-request timeout
verify: true # TLS verification (keep true)
custom_payloads: # extra attack payloads
sqli: ["' OR 1=1--"]
```
CLI flags override the config file: `--header "K: V"`, `--cookie "k=v"`,
`--concurrency`, `--rate-limit`, `--timeout`, `--proxy`, `--insecure`.
---
## Quick Start
```bash
# Full audit with browser crawling and screenshot evidence
vpulse audit --target https://example.com --browser
# Authenticated audit (bearer token + session cookie)
vpulse audit --target https://example.com \
--header "Authorization: Bearer $TOKEN" --cookie "session=$COOKIE" --browser
# Skip crawling — test URL parameters directly
vpulse audit --target "https://example.com/page?id=1" --no-crawl
# Polite scanning against a production target
vpulse audit --target https://example.com --rate-limit 0.5 --concurrency 2
# Discovery only
vpulse crawl --target https://example.com --browser --max-pages 50
# Re-generate a report from a previous audit JSON
vpulse report --input vpulse_report/audit_report.json
# Disable individual phases
vpulse audit --target https://example.com --no-attacks --no-crypto --no-compliance
```
> **Safe demo target:** `make run-audit` runs against `http://testphp.vulnweb.com`,
> Acunetix's intentionally-vulnerable public test application.
---
## CLI Reference
```
vpulse audit Full pipeline: crawl, attack, audit headers/crypto/compliance, report
vpulse crawl Endpoint & form discovery
vpulse report Regenerate reports from an audit JSON
```
Key `audit` flags:
| Flag | Purpose |
|------|---------|
| `--target URL` | Target to audit (required) |
| `--config PATH` | YAML config file (headers, cookies, scope, concurrency, payloads) |
| `--header K:V` / `--cookie K=V` | Authenticate requests (repeatable) |
| `--browser` | Use Playwright for JS rendering + screenshots |
| `--no-crawl` | Skip discovery, test URL params directly |
| `--no-attacks` / `--no-compliance` / `--no-crypto` | Disable individual phases |
| `--proxy URL` / `--tor` | Route traffic through a proxy / Tor |
| `--insecure` | Skip TLS cert verification |
| `--concurrency N` | Parallel crawl workers |
| `--rate-limit SECONDS` | Minimum delay between requests |
| `--timeout SECONDS` | Per-request timeout |
| `--authorized` | Confirm you have permission to test the target |
| `--formats json md html` | Select output formats |
| `--max-pages N` | Crawl depth limit |
---
## Reports
VPulse writes three formats to `vpulse_report/` by default:
| Format | File | Audience |
|--------|------|----------|
| JSON | `audit_report.json` | CI/CD, automation, downstream tooling |
| Markdown | `audit_report.md` | Analysts, code review |
| HTML | `audit_report.html` | Interactive review with embedded screenshots + fix checklist |
The HTML report includes an interactive remediation checklist (progress persists in
localStorage) and an inline screenshot gallery. Screenshots are annotated with the
finding type, URL, parameter, and payload for audit-ready evidence.
---
## Boundaries & Legal
**VPulse performs active security testing. Use it only against systems you own or
have explicit written authorization to test.**
- Unauthorized scanning, exploitation, or access of systems is **illegal** in most
jurisdictions and may be prosecuted under laws such as the Computer Fraud and Abuse
Act (CFAA, US), the Computer Misuse Act (UK), or equivalent local statutes.
- VPulse blocks testing of protected domains (`.gov`, `.mil`, `.edu`) unless you pass
`--authorized` to explicitly assert authorization.
- You are solely responsible for how you use this tool. The maintainers assume no
liability for misuse.
If you find a vulnerability in a third-party system, report it responsibly through
the vendor's disclosure program. See [SECURITY.md](SECURITY.md).
---
## Built-in Safety Controls
VPulse ships with several safeguards for responsible use:
- **Consent gate** — protected-domain detection blocks `.gov`, `.mil`, `.edu` targets
unless `--authorized` is asserted.
- **TLS verification by default** — certificate validation is on. `--insecure` is an
explicit opt-in, never a silent default.
- **Report output escaping** — attacker-controlled strings (payloads, URLs, evidence)
are HTML-escaped so a finding can never become stored XSS in your own report.
- **Scope enforcement** — the crawler stays within the target's domain by default and
honors an explicit allowlist/exclude list.
- **Rate limiting** — `--rate-limit` enforces a minimum delay between requests for
polite, non-disruptive scanning.
- **Anonymity options** — `--proxy` and `--tor` allow routing scans through a proxy
or the Tor network when anonymity is required by the engagement.
- **Passive-first pipeline** — discovery and header/compliance checks are low-impact;
active exploitation is gated behind the same authorization model.
---
## Project Structure
```
.
├── vpulse/ # The package
│ ├── cli.py
│ ├── core/ # auditor + reporter
│ └── modules/ # attack / crawl / crypto / compliance
├── tests/ # pytest suite
├── pyproject.toml # Packaging, dependencies, ruff config
├── Makefile # Common task shortcuts
├── README.md
├── SECURITY.md
└── LICENSE
```
---
## Development
```bash
pip install -e ".[dev]"
# Run the test suite
make test
# Run tests with coverage
pytest --cov=vpulse
# Lint and format
make lint
make format
```
VPulse uses [ruff](https://github.com/astral-sh/ruff) for linting and formatting,
[pytest](https://docs.pytest.org/) for tests, and GitHub Actions for CI (configured in
`.github/workflows/ci.yml`).
---
## License
[MIT](LICENSE) © VPulse Team.
**Use responsibly. Only test systems you are authorized to test.**