⚡ Free & Open Source · Self-Hosted · No Token Billing

Scan your website with
200 security modules — free forever

The largest fully-deterministic, self-hostable website protection suite ever open-sourced. Finds XSS, SQLi, SSRF, SSTI and injection risks with ownership-gated, evidence-backed testing — the same engine that powers 2mny.com.

⭐ Star on GitHub 🍴 Fork the Repo ⚡ Try the Free Online Scan
GitHub stars Forks License Release
2MNY scanner engine — wireframe globe with rotating scan arcs and live module pings
200
Scanner Modules
13,641
Nuclei Templates
6
WordPress Scanners
100%
Self-Hosted · MIT

Built for real protection

Every module is deterministic — same target, same findings, every run. Evidence a CISO can defend, not "the model said so".

🧩

OWASP-Grade Detection

XSS · SQLi · SSRF · SSTI · command injection · subdomain takeover · IDOR and race-condition probes across the OWASP Top 10.

🤖

AI-Stack Safety

MCP server auditing, LLM gateway exposure, agent-panel detection and leaked AI provider keys — the newest attack surface, covered.

📄

Evidence-Backed Reports

CVSS-scored findings with HTTP request/response evidence, CWE→OWASP mapping and step-by-step remediation. HTML + PDF.

🏠

Fully Self-Hosted

One Docker command. No API keys, no per-scan billing, no vendor lock-in. Your scans and your data stay on your hardware.

⚔️

False-Positive Guards

Soft-404 baselining, WAF fingerprinting, 3-gate confirmation on template hits and ownership gating before anything intrusive runs.

📡

Continuous Monitoring

Scheduled re-scans, score-drop alerts, SSL-expiry watch and defacement detection — watch your attack surface over time.

What a scan looks like

Live terminal stream, severity-ranked findings and evidence cards — generated from a real run of the engine.

Live scan demo — terminal output with CRITICAL, HIGH and PASS evidence cards

Up in one command

Docker Compose builds the whole stack — app, MySQL, Redis, nginx and the scanner toolchain.

root@scanner:~# install
# clone & boot the full stack
git clone https://github.com/RanaKhan77/Website-Vulnerability-Scanner.git
cd Website-Vulnerability-Scanner
./install.sh                        # random passwords · build · migrate · admin user

# or step by step
cp .env.example .env                # set DB passwords + APP_URL
docker compose --project-directory . -f docker/docker-compose.yml up -d --build
docker compose --project-directory . -f docker/docker-compose.yml exec app php artisan migrate --seed

✔ 6 healthy services · login at http://localhost:8080

Full walkthrough, troubleshooting and non-Docker notes in INSTALL.md · module catalog in docs/SCANNERS.md

Spin it up in Codespaces

No local Docker? Launch a cloud dev environment with the full stack in your browser.

🚀

One-click launch

Open the repo, press . (or Code → Codespaces → Create), and the container builds with Docker-in-Docker ready.

🧪

Run the stack

  1. Wait for postStartCommand to report Docker ready
  2. cp .env.example .env and set passwords
  3. docker compose --project-directory . -f docker/docker-compose.yml up -d --build
  4. Port 8080 auto-forwards — open the app in the browser
🔐

Safe by default

Ownership gating means intrusive modules only run against domains you verify. Scan responsibly — authorized targets only.