[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-573770-105":3,"detail-sidebar-cat-1-en-105":74,"doc-detail-573770-en":120},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":67,"head_meta":69,"extra_data":71,"updated_unix":73},105,"en","kieron-turk-a-web-application-vulnerability-scanner-dissertation","Kieron Turk - A Web Application Vulnerability Scanner - Dissertation","","A web application vulnerability scanner is designed and implemented to crawl a target website, identify reachable pages and input points, and run extensible vulnerability tests. Core focus targets Cross Site Scripting and Command Injection, with additional modules for code injection, ShellShock, and path traversal. The system supports both Unix-like and Windows command injection, performs OS fingerprinting, generates location-based vulnerability reports, and provides optional explanations and mitigations. Evaluation includes discovered vulnerabilities, comparisons with multi- and single-purpose scanners, and analysis of limitations.",{"@graph":14,"@context":66},[15,34,49],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/paper-templates/","Paper Templates",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/kieron-turk-a-web-application-vulnerability-scanner-dissertation/573770/",4,{"url":32,"name":10,"@type":35,"author":36,"headline":10,"publisher":39,"fileFormat":42,"inLanguage":8,"description":12,"dateModified":43,"datePublished":43,"encodingFormat":42,"isAccessibleForFree":44,"interactionStatistic":45},"DigitalDocument",{"name":37,"@type":38},"Lucas Martin","Person",{"url":19,"name":40,"@type":41},"DocShare","Organization","application/pdf","2026-10-14",true,{"@type":46,"interactionType":47,"userInteractionCount":4},"InteractionCounter",{"@type":48},"ViewAction",{"@type":50,"mainEntity":51},"FAQPage",[52,58,62],{"name":53,"@type":54,"acceptedAnswer":55},"What is the primary goal of the project?","Question",{"text":56,"@type":57},"To build a system that crawls a website, identifies inputs, and detects vulnerabilities that can be exploited on those inputs, with extensibility for future tests.","Answer",{"name":59,"@type":54,"acceptedAnswer":60},"Which vulnerability tests are implemented as the core of the scanner?",{"text":61,"@type":57},"Cross Site Scripting and Command Injection are the core tests, with additional support for code injection, ShellShock, and path traversal.",{"name":63,"@type":54,"acceptedAnswer":64},"How are results delivered and how is extensibility supported?",{"text":65,"@type":57},"The scanner creates vulnerability reports indicating vulnerability locations and can optionally provide explanations and mitigations. The design supports adding further vulnerability tests over time.","https://schema.org",{"og:url":32,"og:type":68,"og:title":10,"og:site_name":40,"og:description":12},"article",{"robots":70,"canonical":32},"index,follow",{"doc_id":72,"site_id":7},573770,1791945584,{"code":4,"msg":75,"data":76},"success",[77,82,87,92,97,102,107,112,116],{"id":78,"doc_module":22,"doc_module_name":25,"category_name":79,"show_sort_weight":80,"slug":81},11,"Presentations",90,"presentations",{"id":83,"doc_module":22,"doc_module_name":25,"category_name":84,"show_sort_weight":85,"slug":86},12,"Resumes",80,"resumes",{"id":88,"doc_module":22,"doc_module_name":25,"category_name":89,"show_sort_weight":90,"slug":91},14,"Invoices",70,"invoices",{"id":93,"doc_module":22,"doc_module_name":25,"category_name":94,"show_sort_weight":95,"slug":96},15,"Posters",60,"posters",{"id":98,"doc_module":22,"doc_module_name":25,"category_name":99,"show_sort_weight":100,"slug":101},16,"Social Media",50,"social-media",{"id":103,"doc_module":22,"doc_module_name":25,"category_name":104,"show_sort_weight":105,"slug":106},17,"Forms",40,"forms",{"id":108,"doc_module":22,"doc_module_name":25,"category_name":109,"show_sort_weight":110,"slug":111},18,"Letters",30,"letters",{"id":113,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":114,"slug":115},21,5,"papers-templates",{"id":117,"doc_module":22,"doc_module_name":25,"category_name":118,"show_sort_weight":4,"slug":119},158,"General","general-158",{"code":4,"msg":75,"data":121},{"doc_id":72,"user_id":122,"nickname":37,"user_avatar":123,"doc_module":22,"category_id":113,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":124,"file_id":125,"file_url":126,"file_type":127,"file_size":128,"view_count":4,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":129,"language":130,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":131,"faqs":132,"seo_title":133,"seo_description":12,"update_tm":73,"read_time":93},8796095360427,"https://ap-avatar.wpscdn.com/davatar_994ba38a5ba835b3df7d355c54d3ed8d","Kieron Turk  \nA Web Application Vulnerability  \nScanner  \nPart II Computer Science Project  \nGonville and Caius College  \n2020  \nDeclaration of Originality  \nI, Kieron Turk of Gonville and Caius College, being a candidate for Part II of the Computer Science Tripos, hereby declare that this dissertation and the work described in it are my own work, unaided except as may be speci􀀌ed below, and that the dissertation does not contain material that has already been used to any substantial extent for a comparable purpose.  \nI, Kieron Turk of Gonville and Caius College, am content for my dissertation to be made available to the students and sta􀀋 of the University.  \nSigned  \nDate: 14 April 2020  \nProforma  \nCandidate Number: 2342E  \nProject Title: A Web Application Vulnerability Scanner  \nExamination: Computer Science Tripos-Part II 2020  \nWord Count 1 : 11782  \nLines of Code2 : 1597  \nProject Originator: Dissertation Author  \nProject Supervisor: Graham Rymer  \nOriginal Aims of Project  \nThe aim of this project is to create a system which can crawl a website, identify all inputs, and proceed to detect a range of vulnerabilities than can be exploited on these inputs. It will be designed for extensibility, such that further vulnerability tests can easily be added in the future. The core tests will be Cross Site Scripting and Command Injection. A command line interface will be created, and graphical interfaces or plugins .  \nWork Completed  \nThe site crawler has been designed and implemented, and 􀀌nds all inputs on pages reachable with the given credentials or cookies. Both re􀀍ected and stored XSS detection have been implemented, detecting many known vulnerabilities on tested websites. Both *NIX and Windows command injection have been implemented, using a range of methods to discover vulnerabilities on a range of systems. I have also implemented code injection, path traversal, and ShellShock vulnerability tests as extensions. Vulnerability reports are created, indicating the vulnerability locations, and optionally providing explanations and mitigations for the vulnerabilities.  \nSpecial Di􀀎culties  \nPandemic.  \n1 Counted with TeXCount  \n2 Counted with cat ∗f,/∗[g](g.py)[.py](g.py) ∗ . sh j wc 􀀀l  \nContents  \n1 Introduction 5  \n1.1 Motivation ......................................... 5  \n1.2 Related Work ....................................... 6  \n2 Preparation 7  \n2.1 Requirements Analysis .................................. 7  \n2.2 Cross Site Scripting .................................... 8  \n2.3 Command Injection .................................... 9  \n2.4 Code Injection ....................................... 9  \n2.5 ShellShock ......................................... 10  \n2.6 Path Traversal ....................................... 11  \n2.7 Technologies Used ..................................... 12  \n2.8 Professional Practice ................................... 12  \n2.8.1 Development Model ................................ 12  \n2.8.2 Legality & Disclaimer .............................. 12  \n2.8.3 Licences ...................................... 14  \n2.9 Starting Point ....................................... 14  \n3 Implementation 15  \n3.1 System Structure ..................................... 15  \n3.2 Scanner Core ....................................... 17  \n3.3 Crawling .......................................... 17  \n3.3.1 Finding Pages ................................... 18  \n3.3.2 Finding Inputs .................................. 18  \n3.3.3 Additional URLs ................................. 18  \n3.4 OS Fingerprinting ..................................... 19  \n3.5 Cross Site Scripting (XSS) ................................ 19  \n3.5.1 XSS Payloads ................................... 20  \n3.6 Command Injection .................................... 20  \n3.6.1 Web Requests ................................... 20  \n3.6.2 Sleeping ...................................... 21  \n3.6.3 Command Injection Payloads .......................... 21  \n3.7 C","cbCaiuvEU3JpwRFT","https://ap.wps.com/l/cbCaiuvEU3JpwRFT","pdf",502789,43,"English","# Introduction\n## Motivation\n## Related Work\n# Preparation\n## Requirements Analysis\n## Cross Site Scripting\n## Command Injection\n## Code Injection\n## ShellShock\n## Path Traversal\n## Technologies Used\n## Professional Practice\n### Development Model\n### Legality & Disclaimer\n### Licences\n## Starting Point\n# Implementation\n## System Structure\n## Scanner Core\n## Crawling\n### Finding Pages\n### Finding Inputs\n### Additional URLs\n## OS Fingerprinting\n## Cross Site Scripting (XSS)\n### XSS Payloads\n## Command Injection\n### Web Requests\n### Sleeping\n### Command Injection Payloads\n## Code Injection\n### Disambiguation\n### Collision with Command Injection\n## ShellShock\n## Path Traversal\n### Encodings\n## Repository Overview\n# Evaluation\n## Vulnerabilities Discovered\n## Comparison to other many-vulnerability scanners\n## Comparison to other single-purpose scanners\n### XSS Scanners\n### Command and Code Injection Scanners\n### Path Traversal Scanners\n### ShellShock scanners\n## Discovered Limitations\n## Summary\n# Conclusions\n## Successes and Failures\n## The Project in Hindsight\n## Possible Continuations","[{\"question\":\"What is the primary goal of the project?\",\"answer\":\"To build a system that crawls a website, identifies inputs, and detects vulnerabilities that can be exploited on those inputs, with extensibility for future tests.\"},{\"question\":\"Which vulnerability tests are implemented as the core of the scanner?\",\"answer\":\"Cross Site Scripting and Command Injection are the core tests, with additional support for code injection, ShellShock, and path traversal.\"},{\"question\":\"How are results delivered and how is extensibility supported?\",\"answer\":\"The scanner creates vulnerability reports indicating vulnerability locations and can optionally provide explanations and mitigations. The design supports adding further vulnerability tests over time.\"}]","Kieron Turk - A Web Application Vulnerability Scanner - Dissertation | PDF"]