Web Application Scanning System

About The Project

Indusface WAS (Web Application Scanning) Application

Indusface WAS with its automated scans & manual pen-testing ensures none of the OWASP Top10, business logic vulnerabilities and malwares go unnoticed. With zero false positive guarantee and comprehensive report with remediation guidance, Indusface WAS ensures developers quickly fixes vulnerabilities. The proprietary scanner built ground up, keeping js framework driven, single page applications in mind to provide complete & intelligent crawling.

App Features

As per client's need PHPDots has developed WAS.

App Features

Customer can add/remove his sub users. We provide users-based permission and role.
Customer can register multiple websites in one customer and he can able to assign particular website to particular user.
User can on board his website through email or domain verification and make payment for it.
We provide functionality for Start / Stop / Pause / Resume scan for website.
Download report in different format like CSV, PDF, XLS
User can create customize report based on his requirement. Also, he can able to schedule report at any time and get the report in email.
Display scanning result in different type of chart view.
We send scan summary report in email after the scan completed.
Customer can schedule scan on his time.

Admin Features

We provide role(permission)-based admin panel.
Manage customer and his users with websites.
Add/Re-new websites based on licensed.
Manage website scanning based on customer requirement.
Admin can add vulnerability through manual pen-testing and publish the scanning report.
Manage schedule scanning based on date time.
Manage POC (proof-of-concept) request by customer.

Challenges

Our client wanted to provide platform where customer can add website for scanning with get result in different type of report.
Launch and terminate AWS server based on scanning requirements.
Need to manage multiple websites scanning parallel time. Manage multiple scanners to run websites scanning.
it’s hard to do manually work to find vulnerability in website which provided by our client. A more complex is remove duplicate vulnerability manually.
More time consuming on create different type of report like PDF, CSV, XLS of founded vulnerability and send to client.
Client wants proof of concept of founded vulnerability.

Solutions

How We Work

Implement third party API for Launch and terminate AWS server.
Implement WAS API for all scanner to post scanning result
Our auto process can manage all the website scanning based on its schedule time. It can start multiple website scan in one time. We pick customer schedule time and start scan on this time.
Website scan time is fixed. We are not running automated scan after it’s max time exceed. So, it’s not affected in running site.
Manage scanning count and service expiry based on license.
We have provided automated scanning of all type with report generation.
Client can able to download report in different format. (PDF XLS, CSV.)
Create third party API for scanning of different type of scanner.
Manage unique vulnerability for each website and remove duplicate vulnerability from every scan through automated.
Create third party API for scanning of different type of scanner.