SecuriScan - Web Security Analyzer
SecuriScan is a powerful Chrome extension that performs comprehensive passive security analysis on any website. Built for developers, security professionals, and anyone who wants quick security insights without setting up complex tools like Burp Suite or OWASP ZAP. š šŖššš§'š¦ š”ššŖ šš” š©š.š°.š¬ ā¢ š” OWASP Top 10 view ā maps every finding to the OWASP Top 10 (2021) with PASS/WARN/FAIL badges ā¢ š¤ AI Explain & Fix ā one-click explanations and copy-paste code fixes for every vulnerability found ā¢ š Side Panel mode ā persistent scanning panel that stays open alongside your browsing (Alt+Shift+P) ā¢ š¢ Toolbar badge ā live issue count on the extension icon, colour-coded by severity ā¢ š” Network security scan ā detects insecure WebSockets (ws://), WebRTC IP leakage, unsafe postMessage usage, hardcoded private IPs, and dynamic script injection ā¢ ā SARIF 2.1.0 export ā export results in industry-standard SARIF format for CI/CD pipeline integration ā¢ āØ Keyboard shortcuts ā Alt+Shift+S to scan, Alt+Shift+P to open the side panel ā¢ š± Right-click context menu ā scan any page directly from the right-click menu ā¢ ā Settings tab ā toggle auto-scan (opt-in, off by default), desktop notifications, and badge display ā¢ š Score sparklines ā visual score history chart per domain in the History tab š šŖššš§'š¦ š”ššŖ šš” š©š.šÆ.š¬ ā¢ š Privacy tracker detection ā flags 18 third-party trackers including Meta Pixel, TikTok, Hotjar, FullStory, and more ā¢ š¾ Browser storage audit ā scans localStorage and sessionStorage for exposed tokens, keys, and PII ā¢ š Scan history & score trends ā tracks your last 10 scans per domain and shows ā/ā trend on every result ā¢ š JSON export ā export results as machine-readable JSON alongside the existing HTML report š šŖššš§ šš§ šš¢šš¦ When you click scan, SecuriScan analyzes the current page for security misconfigurations and vulnerabilities across 13 categories: š š¦š²š°ššæš¶šš šš²š®š±š²šæš (šš¬ š°šµš²š°šøš) ā¢ Content-Security-Policy (CSP) ā¢ Strict-Transport-Security (HSTS) ā¢ X-Frame-Options ā¢ X-Content-Type-Options ā¢ Referrer-Policy ā¢ Permissions-Policy ā¢ Cross-Origin-Opener-Policy ā¢ Cross-Origin-Resource-Policy ā¢ Cross-Origin-Embedder-Policy ā¢ X-XSS-Protection šŖ šš¼š¼šøš¶š² š¦š²š°ššæš¶šš ā¢ HttpOnly and Secure flag validation ā¢ Session token exposure detection ā¢ Sensitive cookie pattern matching ā¢ SameSite attribute guidance š š©šš¹š»š²šæš®šÆš¹š² šš®šš®š¦š°šæš¶š½š šš¶šÆšæš®šæš¶š²š (šÆš±+ š¹š¶šÆšæš®šæš¶š²š) š“ Critical Severity: ā¢ Handlebars < 4.7.7 (arbitrary code execution) ā¢ Socket.IO < 4.4.1 (CORS bypass) ā¢ Minimist < 1.2.6 (prototype pollution) ā¢ EJS < 3.1.7 (template injection) š High Severity: ā¢ jQuery < 3.5.0 (CVE-2020-11022, CVE-2020-11023) ā¢ AngularJS < 1.8.3 (CVE-2023-26116) ā¢ Lodash < 4.17.21 (CVE-2021-23337, CVE-2020-28500) ā¢ React < 16.14.0 (CVE-2021-23648) ā¢ Vue.js < 2.6.14 (CVE-2021-3766) ā¢ Marked < 4.0.10 (ReDoS and XSS) ā¢ DOMPurify < 2.3.10 (XSS bypass) ā¢ Express < 4.17.3 (open redirect) ā¢ Webpack < 5.76.0 (cross-realm access) ā¢ Underscore < 1.13.0 (code execution) ā¢ Next.js < 12.3.2 (open redirect) ā¢ Nuxt.js < 2.15.7 (directory traversal) ā¢ Pug < 3.0.1 (code injection) š” Medium Severity: ā¢ Bootstrap < 4.3.1 (CVE-2019-8331) ā¢ Moment.js < 2.29.4 (CVE-2022-31129) ā¢ Axios < 0.21.3 (SSRF) ā¢ D3.js, Chart.js, DataTables, and more š š¦š²š»šš¶šš¶šš² šš®šš® šš š½š¼šššæš² (š®š±+ š½š®ššš²šæš»š) š API Keys & Tokens: ā¢ AWS Access/Secret Keys ā¢ Google API Keys & OAuth ā¢ GitHub Personal Access Tokens ā¢ Stripe API Keys (live & test) ā¢ Slack Tokens ā¢ Twilio, SendGrid, Mailgun API Keys ā¢ PayPal Braintree Tokens ā¢ Square OAuth Secrets ā¢ Shopify Access Tokens & Shared Secrets ā¢ Generic API key patterns š Credentials & Secrets: ā¢ Private Keys (RSA, SSH, EC, PGP, OpenSSH) ā¢ Database Connection Strings (MongoDB, MySQL, PostgreSQL) ā¢ JWT Tokens ā¢ Passwords in source code ā¢ Firebase URLs šŖŖ PII: ā¢ Credit Card Patterns ā¢ Social Security Numbers ā¢ Email Addresses (filtered for false positives) š š£šæš¶šš®š°š š§šæš®š°šøš²šæš Detects 18 third-party tracking scripts that collect and share your users' behavioral data: ā¢ š„ Session recorders: Hotjar, FullStory, Mouseflow, Crazy Egg ā¢ š¢ Ad pixels: Meta/Facebook, TikTok, Twitter/X, LinkedIn Insight ā¢ š Analytics: Google Analytics, Google Tag Manager, Mixpanel, Amplitude, Heap, Clarity ā¢ š¬ CRM: HubSpot, Intercom, Pardot, Segment Each tracker is rated by severity ā session recorders (high) vs. analytics-only (medium) ā so you know which ones are most invasive. š¾ ššæš¼ššš²šæ š¦šš¼šæš®š“š² ššš±š¶š Scans localStorage and sessionStorage for sensitive data that XSS could steal: ā¢ Auth tokens, JWT, session IDs stored under sensitive key names ā¢ API keys, AWS credentials, private keys in stored values ā¢ Credit card numbers and SSNs ā¢ Flags risky storage patterns and recommends HttpOnly cookies instead š” š”š²ššš¼šæšø š¦š²š°ššæš¶šš (š”ššŖ š¶š» šš.š°.š¬) Passively inspects inline scripts for risky network patterns: ā¢ Insecure WebSocket connections using ws:// instead of wss:// ā¢ WebRTC usage that can leak real IP addresses through VPNs ā¢ postMessage() calls without event.origin validation ā¢ Hardcoded private/internal IP addresses (192.168.x, 10.x, 127.0.0.1) ā¢ Dynamic <script> element injection ā¢ Hardcoded cross-origin fetch endpoints ā ļø šš¼šŗšŗš¼š» š©šš¹š»š²šæš®šÆš¶š¹š¶šš¶š²š ā¢ Mixed content detection (HTTP resources on HTTPS pages) ā¢ Forms submitting over insecure connections ā¢ Missing CSRF token detection ā¢ Password fields on non-HTTPS pages ā¢ Credit card/SSN fields without HTTPS ā¢ Inline event handlers (onclick, onload, etc.) ā¢ JavaScript URLs and data: URLs ā¢ eval() and dangerous DOM manipulation ā¢ Exposed API keys and credentials in source š” šš±š±š¶šš¶š¼š»š®š¹ š¦š²š°ššæš¶šš ššµš²š°šøš ā¢ Subresource Integrity (SRI) validation for CDN resources ā¢ CORS configuration analysis ā¢ Enhanced XSS detection with 10+ event handler types ā¢ srcdoc attribute usage in iframes ā¢ URL manipulation pattern detection āļø šš¢šŖ šš§ šŖš¢š„šš¦ All analysis runs locally in your browser. SecuriScan inspects the DOM, checks response headers via fetch, and pattern-matches against a comprehensive vulnerability database with CVE tracking. No data leaves your machine. Results are presented with a 0ā100 security score using severity-based weighting (Critical/High/Medium/Low). A trend indicator (ā/ā/ā) shows how the score changed since your last scan of that domain. The OWASP tab maps every finding to the OWASP Top 10 (2021) so you can communicate risk in a language your team understands. Click any category to see specific findings with remediation guidance and CVE references. Every vulnerability includes a š¤ Explain & Fix button with a plain-English explanation and a copy-paste code fix. Export as a formatted HTML report, machine-readable JSON, or SARIF 2.1.0 for CI/CD pipelines and client deliverables. š„ šŖšš¢ šš§'š¦ šš¢š„ ā¢ šØāš» Frontend developers checking sites before deployment ā¢ š Security engineers doing quick reconnaissance ā¢ š DevOps teams validating production configurations ā¢ šÆ Penetration testers performing initial assessments ā¢ š¼ Freelancers auditing client websites ā¢ š Students learning web security fundamentals ā¢ š Anyone concerned about website security š§ š§šššš”šššš ššš§šššš¦ Built on Manifest V3 with minimal permissions: ā¢ activeTab ā access current page when you click scan ā¢ scripting ā inject analysis code into the page ā¢ storage ā cache scan results and history locally ā¢ tabs ā read current tab URL for history tracking ā¢ sidePanel ā enable the persistent side panel (v1.4.0) ā¢ contextMenus ā add right-click scan option (v1.4.0) ā¢ notifications ā optional alerts for critical findings (v1.4.0, opt-in) āØ New in v1.4.0: ā¢ OWASP Top 10 (2021) compliance view ā¢ AI-powered Explain & Fix for every finding ā¢ Persistent side panel mode ā¢ Toolbar badge with live issue count ā¢ Network & API security scanning ā¢ SARIF 2.1.0 export ā¢ Keyboard shortcuts (Alt+Shift+S / Alt+Shift+P) ā¢ Right-click context menu integration ā¢ Configurable auto-scan (opt-in, off by default) ā¢ Settings tab with notification and badge controls No telemetry. No external API calls. The entire codebase is open source if you want to audit it or contribute. š« ššš šš§šš§šš¢š”š¦ This is a passive scanner, not a penetration testing tool. It cannot: ā¢ Test for server-side vulnerabilities (SQLi, SSRF, RCE, etc.) ā¢ Intercept or modify HTTP traffic ā¢ Perform authenticated scanning ā¢ Detect all possible security issues ā¢ Replace a proper security audit by professionals Think of it as a comprehensive health check and reconnaissance tool, not a replacement for professional security testing. šµļø š£š„šš©ššš¬ Zero data collection. No analytics. No tracking. No external servers. Everything stays on your device. Built by developers, for developers. No fluff, just useful security insights with real CVE tracking, OWASP mapping, and actionable remediation guidance.
