Security - VAPT 100+ Tools

VAPT Security Scanner

110 web application security scan tools in a single REST API — built for AI coding agents.

Install this skill into Claude Code, Cursor, Copilot, or any AI agent and it instantly knows how to run professional-grade vulnerability assessments, parse structured threat findings, and export PDF/DOCX reports — all with a single POST /scan call.

---

What Your AI Agent Can Do

After installing this skill your AI agent will:

• Run any of 110 security scan tools against a target URL
• Parse structured threat findings (name, severity, description, endpoint)
• Run OWASP Top 10 full sweeps in parallel
• Execute a 3-role Authorization Matrix (Admin / User / Anonymous)
• Detect IDOR vulnerabilities by auto-probing numeric URL parameters
• Score security headers from A+ to F
• Test NoSQL injection (MongoDB operator bypass)
• Perform LFI / Path Traversal with 15 parameters × 12 payloads
• Run Gemini AI vulnerability scan (108 patterns, with heuristic fallback)
• Export findings as PDF or DOCX reports
• Run all modules in parallel using the SubAgent pattern

---

Install

npx @qaskills/cli add fg-vapt-security-scanner

Or install directly:

npx @qaskills/cli add Suryam2498/fg-vapt-security-scanner

---

Quick Start

Start the FG VAPT server:

# Windows PowerShell
python security\fg_vapt.py

# WSL / Linux
python3 security/fg_vapt.py

Server starts at http://localhost:3337.

Run your first scan:

import requests

r = requests.post("http://localhost:3337/scan", json={
    "target": "https://example.com",
    "tool_type": "header_score"
}, timeout=60)

result = r.json()
print(result["output"])

for threat in result.get("threats", []):
    print(f"[{threat['severity']}] {threat['name']} — {threat['description']}")

---

Tool Categories

Category	Tools	Examples
Network & Infra	11	nmap_fast, nmap_full, smb_enum, dns_zone
OWASP Top 10	10	owasp_a01 through owasp_a10
Web Attacks	12	web_xss, web_sql, web_csrf, web_ssti
AI & Advanced	10	gemini_ai_scan, auth_matrix, auto_idor, lfi_scan
Specialized Security	21	jwt_analyzer, xxe_injection, ssrf_advanced, log4shell
Recon & Disclosure	9	secret_leak_scan, pii_scan, robots_analyzer
Nuclei Templates	6	nuclei_cves, nuclei_exposed-panels
Infrastructure	8	infra_ssl, infra_firewall
Data Exposure	5	cloud_metadata, crossdomain_scan
Total	110

---

API Reference

POST /scan

Run any security scan tool against a target.

POST http://localhost:3337/scan
Content-Type: application/json

{
  "target": "https://example.com",
  "tool_type": "web_xss"
}

Response:

{
  "output": "Raw scan output text...",
  "ports": ["80", "443"],
  "threats": [
    {
      "name": "Reflected XSS",
      "severity": "HIGH",
      "description": "XSS detected in search parameter",
      "endpoint": "/search?q="
    }
  ],
  "timestamp": "2026-08-26T10:00:00Z"
}

GET /api/reports

List all saved scan reports.

GET /api/report/{id}/pdf

Download a scan report as PDF.

GET /api/report/{id}/docx

Download a scan report as DOCX.

GET /api/biz_logic/items

Get the 20-item Business Logic security checklist.

---

Parallel Scan Example — OWASP Top 10

import requests
from concurrent.futures import ThreadPoolExecutor, as_completed

TARGET = "https://example.com"
OWASP  = [f"owasp_a0{i}" for i in range(1,10)] + ["owasp_a10_ssrf"]

def scan(tool):
    r = requests.post("http://localhost:3337/scan",
                      json={"target": TARGET, "tool_type": tool}, timeout=60)
    d = r.json()
    return tool, d.get("threats", [])

with ThreadPoolExecutor(max_workers=5) as pool:
    futures = {pool.submit(scan, t): t for t in OWASP}
    for f in as_completed(futures):
        tool, threats = f.result()
        status = "🔴 VULNERABLE" if threats else "🟢 CLEAN"
        print(f"{tool.upper()}: {status} ({len(threats)} findings)")

---

Threat Severity Guide

Severity	Meaning	Action
CRITICAL	RCE, auth bypass	Block release immediately
HIGH	SQLi, XSS, IDOR	Fix before next release
MEDIUM	CSRF, open redirect	Fix within sprint
LOW	Info disclosure	Add to backlog
INFO	Informational	Review and log

---

SubAgent Architecture

This skill includes a full SubAgent orchestration pattern — 8 specialized agents run in parallel, each testing a different FGQAI platform module. The orchestrator collects all results and generates a consolidated PDF report.

python subagents/run_orchestrator.py

Result: 78 tests × 8 modules, parallel execution, PDF report with per-module health scores.

---

Prerequisites

pip install flask requests psutil gtts reportlab python-docx

For Gemini AI scan:

curl -X POST http://localhost:3337/api/set_gemini_key \
     -H "Content-Type: application/json" \
     -d '{"key": "YOUR_GEMINI_API_KEY"}'

---

About

Built by Suryam Mangalampalli as part of the FGQAI (FluentGrid QA Intelligence) platform — a full-stack QA automation suite covering security scanning, API testing, performance testing, defect tracking, governance, AI test generation, and data/ETL validation.

• Platform: FGQAI (8 modules, ports 3333–3341)
• Security module: FG VAPT (port 3337, 110 tools)
• Language: Python (Flask)
• License: MIT

---

License

MIT © 2026 Suryam Mangalampalli