Metadata-Version: 2.4
Name: ersec
Version: 27.1.0
Summary: ERSEC Defensive Security Scanner
Home-page: https://github.com/ersec/ersec
Author: ERSEC Team
Author-email: ersec.team@protonmail.com
License: MIT
Requires-Python: >=3.8
Description-Content-Type: text/markdown
Requires-Dist: requests>=2.28
Requires-Dist: beautifulsoup4>=4.12
Requires-Dist: lxml>=4.9
Requires-Dist: urllib3>=2.0
Requires-Dist: rich>=13.0
Dynamic: author
Dynamic: author-email
Dynamic: home-page
Dynamic: requires-python

# ERSEC

A web vulnerability scanner with a fully offline, built-in remediation
advisor — no API key, no network call for the AI layer, no external
dependency beyond the scan itself.

## What's inside

**Detection (24 modules, all non-destructive):**
Security headers, TLS/cert config, server banner disclosure, dangerous
HTTP methods, CORS misconfiguration, exposed sensitive files/secrets
(30+ known paths), SQL injection (error-based + boolean-differential),
NoSQL injection, reflected XSS, server-side template injection, JWT
config weaknesses (alg=none, weak HS256), directory listing, verbose
error/stack-trace disclosure, mixed content, missing Subresource
Integrity, insecure password forms, GraphQL introspection exposure,
CRLF/response-splitting, Host header injection, open redirect, missing
CSRF tokens, vulnerable client-side JS libraries, sensitive HTML
comments, missing Cache-Control on authenticated pages, and LDAP
injection signals.

The crawler also seeds from `robots.txt` and `sitemap.xml` (same
technique OWASP ZAP's spider uses) to find pages a plain link-crawl
would miss.

**The "smart" layer — deterministic, not a neural net:**
- Stack fingerprinting from cookies/headers (Django, Rails, Laravel,
  Express, PHP, etc.)
- A rule-based risk-correlation engine that chains individually-moderate
  findings into compound risks (e.g. XSS + missing cookie flags →
  "Session hijack chain") and reorders findings by priority accordingly

**The built-in advisor (`AdvisorEngine`):** a local expert system — a
curated knowledge base indexed by vulnerability category, with
stack-specific code snippets selected automatically from the
fingerprint, and chain-aware "fix this first" guidance. Runs instantly,
completely offline. This is a rule-based expert system, not a language
model — worth being precise about, since it's a different (older, more
predictable) kind of AI than an LLM.

**No exploitation code anywhere.** Every active check sends at most one
or two harmless boundary-condition probes and looks for a behavioral
signal (error text, timing, reflection) — the same detection tier as
ZAP/Nikto, not sqlmap/Metasploit. No payload chains, no data extraction,
no RCE.

## Setup
```bash
pip install -r requirements.txt
```
That's it — no API key needed.

## Usage
```bash
python3 ersec.py -t example.com --profile baseline -o report.json --html dashboard.html
```

Flags:
- `--profile passive|baseline|deep` — passive = header/TLS/banner checks
  only, zero payloads sent
- `--scope-file scope.json` — restrict hosts/ports/paths/methods/request
  budget
- `--cookie` / `--bearer` — authenticate as a logged-in user to scan
  behind auth
- `--no-ai` — skip the built-in advisor, show bare finding descriptions
- `--insecure` — skip TLS verification (self-signed certs in staging)

Open the `--html` output in a browser for the interactive dashboard:
filterable/searchable findings, a dedicated risk-chain panel, severity
distribution, and detected stack.

## Legal
Only run this against systems you own or have explicit written
authorization to test. Unauthorized scanning can violate the CFAA (US),
the Computer Misuse Act (UK), and equivalent laws elsewhere — even
"just scanning" without exploiting anything.
