DESIGN AND IMPLEMENTATION OF AN INTEGRATED AUTOMATED VULNERABILITY SCANNING PLATFORM FOR WEB APPLICATION SECURITY ASSESSMENT

Abstract

Topicality. The rapid proliferation of web applications across enterprise ecosystems has intensified the demand for comprehensive, automated vulnerability detection mechanisms. Existing standalone scanning tools exhibit inherent limitations in coverage scope, reporting standardization, and CI/CD pipeline integration, necessitating the development of unified orchestration platforms. The subject of study in this article is the architectural design and implementation of a modular, Python-based integrated vulnerability scanner that consolidates multiple open-source security testing utilities into a cohesive automation framework. The purpose of the article is to develop and validate an extensible platform capable of orchestrating reconnaissance, dynamic application security testing (DAST), static configuration analysis, and information leak detection through unified command-line interface and consolidated HTML reporting. The following results were obtained. A modular scanner architecture was designed, integrating industry-standard tools including Nuclei (template-based vulnerability detection), Burp Suite (proxy-based traffic analysis), Feroxbuster (directory fuzzing), Subfinder/DNSX (subdomain enumeration), Katana (URL crawling), and auxiliary modules for WAF detection (CDNCheck), 403 bypass (byp4xx), Postman collection leak analysis (Postleaks), and exposed configuration discovery (LeakIX). Conclusion. The developed platform achieves enhanced scanning coverage through multi-tool orchestration and generates structured HTML reports with categorized findings. The modular architecture enables rapid integration of emerging security tools, making the framework adaptable to evolving threat landscapes in modern web application security testing.