---

name: Security - VAPT 100+ Tools description: FG VAPT gives your AI agent 110 security scan tools — OWASP Top 10, XSS, SQLi, NoSQLi, LFI, IDOR, 403 Bypass, 3-role Auth Matrix, Gemini AI scan, security header scoring, 2FA bypass, and more. One POST request. Structured JSON threats back. version: 1.0.1 author: Suryam2498 license: MIT tags: [vapt, security, owasp, penetration-testing, xss, sqli, lfi, nosql, auth-matrix, idor, gemini-ai, security-headers, api-security] testingTypes: [security, api, performance] frameworks: [pytest, requests, flask, owasp-zap] languages: [python, javascript] domains: [web, api, mobile] agents: [claude-code, cursor, github-copilot, windsurf, cline, continue, aider, zed, codex-cli, bolt, lovable, v0, devin, cody, tabnine, replit, amazon-q, jetbrains-ai, gemini-code-assist, supermaven, amp, gitpod, void, pear, melty]

FG VAPT Security Scanner

Core API

Start a scan:

POST http://localhost:3337/scan
Content-Type: application/json
{ "target": "https://example.com", "tool_type": "<tool_name>" }

Response:

{
  "output": "raw scan text",
  "ports": ["80", "443"],
  "threats": [
    { "name": "SQL Injection", "severity": "HIGH",
      "description": "SQLi at /login", "endpoint": "/login" }
  ]
}

Other endpoints:

• GET /api/reports — list saved reports
• GET /api/report/<id>/pdf — download PDF
• GET /api/report/<id>/docx — download DOCX
• GET /api/biz_logic/items — 20-item business logic checklist
• POST /api/set_gemini_key — set Gemini API key {"key":"..."}

---

110 Scan Tools

Network

nmap_fast nmap_full nmap_vuln nmap_os nmap_service arp_scan smb_enum snmp_enum dns_zone infra_ssl infra_firewall

OWASP Top 10

owasp_a01_access owasp_a02_crypto owasp_a03_injection owasp_a04_design owasp_a05_config owasp_a06_components owasp_a07_auth owasp_a08_integrity owasp_a09_logging owasp_a10_ssrf

Web Attacks

web_xss web_sql web_csrf web_traversal web_ssti web_redirect web_errordisclosure web_hostheader web_session_audit web_js_analysis web_api_shadow web_clickjacking

AI & Advanced (NEW)

gemini_ai_scan — 108-pattern AI scan (Gemini API or heuristic fallback) auth_matrix — 3-role matrix: Admin / User / Anonymous vs 18 endpoints auto_idor — crawl numeric params, probe ±5 adjacent IDs bypass_403 — 12 bypass techniques (X-Original-URL, X-Forwarded-For, path tricks) source_disclosure — 29 paths (.git, .env, backup.sql, .DS_Store) api_rate_limit — 20 rapid requests, detect missing 429 header_score — 10 headers graded A+ to F twofa_bypass — OTP no-session, OTP in response, step-skip nosqli_test — MongoDB $gt, $ne, $regex, $where bypass lfi_scan — 15 params × 12 payloads, /etc/passwd indicators

Specialized

jwt_analyzer xxe_injection ssrf_advanced open_redirect_scan log4shell_check graphql_probe cookie_audit email_security http_smuggling session_fixation subdomain_takeover file_upload_security mass_assignment oauth_audit websocket_security cache_poisoning pii_scan secret_leak_scan crossdomain_scan robots_analyzer cloud_metadata superset_probe cert_transparency http_param_pollution clickjacking_poc default_files nuclei_cves nuclei_exposed-panels

---

Code Examples

Single scan

import requests

r = requests.post("http://localhost:3337/scan",
    json={"target": "https://example.com", "tool_type": "header_score"},
    timeout=60)
d = r.json()
print(d["output"])
for t in d.get("threats", []):
    print(f"[{t['severity']}] {t['name']} — {t['description']}")

Parallel OWASP Top 10 sweep

import requests
from concurrent.futures import ThreadPoolExecutor, as_completed

TARGET = "https://example.com"
TOOLS  = [f"owasp_a0{i}_{'access crypto injection design config components auth integrity logging'.split()[i-1]}"
          for i in range(1,10)] + ["owasp_a10_ssrf"]

def scan(tool):
    r = requests.post("http://localhost:3337/scan",
                      json={"target": TARGET, "tool_type": tool}, timeout=60)
    d = r.json()
    return tool, d.get("threats", [])

with ThreadPoolExecutor(max_workers=5) as pool:
    for f in as_completed({pool.submit(scan, t): t for t in TOOLS}):
        tool, threats = f.result()
        print(f"{tool}: {'VULNERABLE' if threats else 'CLEAN'} ({len(threats)} findings)")

Auth Matrix (3-role)

r = requests.post("http://localhost:3337/scan",
    json={"target": "https://example.com", "tool_type": "auth_matrix"},
    timeout=60)
print(r.json()["output"])
# Shows which endpoints Admin/User/Anonymous can access.
# Threats raised when lower-privilege role reaches admin endpoints.

Download PDF report

reports = requests.get("http://localhost:3337/api/reports", timeout=10).json()
if reports:
    pdf = requests.get(f"http://localhost:3337/api/report/{reports[0]['id']}/pdf", timeout=30)
    open("report.pdf", "wb").write(pdf.content)

---

Severity Guide

Severity	Action
CRITICAL	Block release — RCE / auth bypass
HIGH	Fix before next release — SQLi, XSS, IDOR
MEDIUM	Fix within sprint — CSRF, open redirect
LOW	Backlog — info disclosure

Header Score Grades

A+ (100%) → all 10 headers present and correct A (90%+) → minor gaps B (75%+) → several missing F (<50%) → critical headers absent

Headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Cache-Control, COOP, CORP.

---

Common Mistakes

# ✅ Correct route
requests.post("http://localhost:3337/scan", ...)

# ❌ Wrong — 404
requests.post("http://localhost:3337/api/scan", ...)

# ✅ Always include scheme
"target": "https://example.com"

# ❌ Missing scheme — scan errors out
"target": "example.com"

# ✅ Heavy tools need longer timeout
requests.post(..., timeout=120)   # nmap_full, gemini_ai_scan, auth_matrix

# ✅ Parallel limit — avoid triggering target rate limiter
ThreadPoolExecutor(max_workers=5)  # not more than 5 concurrent

/api/report/consolidated/pdf returns 500 if no prior scans exist — run at least one scan first.

---

Start the Scanner

# Windows
python security\fg_vapt.py

# WSL / Linux
python3 security/fg_vapt.py

# Full platform (all 8 modules)
npm start

Install Dependencies

pip install flask requests psutil gtts reportlab python-docx