OWASP, HTTP Scanners, and Web Vulnerability Mapping

Why the OWASP Top 10 Guides KittySploit Scanning

The OWASP Top 10 (2021) is not a checklist of modules to tick off. It is a common language between pentesters, developers, and decision-makers. KittySploit provides more than fifty HTTP scanners in modules/scanner/http/; without a framework, you risk either running everything (noise, false positives), or overlooking vulnerability families (misconfiguration, vulnerable components).

OWASP Top 10 (2021) Overview → KittySploit Modules

The following table proposes an indicative mapping. Several categories overlap; a single module may support multiple OWASP axes.

ID	OWASP Category	Relevant `scanner/http/` modules
A02	Cryptographic Failures	`security_headers_detect` (HSTS), `http_response_credential_leak_detect`
A03	Injection	Targeted CVE modules; manual DVWA validation (SQLi, XSS, Command)
A04	Insecure Design	`graphql_detect`, `firebase_fingerprint_detect`, `swagger_detect`
A05	Security Misconfiguration	`exposed_env_detect`, `exposed_git_detect`, `phpinfo_detect`, `django_debug_detect`, `flask_debug_detect`
A06	Vulnerable and Outdated Components	`wordpress_detect`, `tomcat_detect`, `jenkins_detect`, `_cve_` modules
A07	Identification and Authentication Failures	`admin_panel_detect`, `robots_txt_detect`; bruteforce in isolated test environment
A08	Software and Data Integrity Failures	`exposed_git_detect`, `docker_registry_detect`
A09	Security Logging and Monitoring Failures	`server_banner_detect`, leaks in `http_response_credential_leak_detect`
A10	SSRF	`nextjs_cve_2026_44578_websocket_upgrade_ssrf_detect` (Next.js stack)

The Three Scanner Execution Modes

Bulk Mode --- `scanner -u`

Runs all HTTP modules compatible with the target, in parallel:

scanner -u http://127.0.0.1 --threads 10
scanner -u http://127.0.0.1 --threads 5 -v
scanner -u http://127.0.0.1 --tags web,security --threads 8

Useful options:

--module <path> --- a single module (e.g.\ security_headers_detect).
--tags --- filter by catalogue tags (wordpress, graphql…).
--scan-ports --- broadens service discovery before HTTP scanning.
-v / --verbose --- details of truncated requests and responses.

Discovery Mode --- `search`

Before executing, explore the indexed catalogue (sync now after an update):

search security headers --type scanner --protocol http
search exposed env --type scanner
search graphql --type scanner --limit 10
search --cve CVE-2024-4577 --type scanner
search wordpress --type scanner --protocol http --limit 20
search admin panel --type scanner

Cross-reference with attack show scanner/http/<module> for declared MITRE coverage.

Targeted Mode --- `use`, `set`, `run`

For fine-grained control of options (rhost, rport, ssl, vhost):

use scanner/http/security_headers_detect
set rhost 127.0.0.1
set rport 80
run

use scanner/http/exposed_env_detect
set rhost 127.0.0.1
run

After each run, review vuln list and attach confirmations to the host:

host services 127.0.0.1
vuln list

A01:2021 --- Broken Access Control

Definition and Stakes

Broken access control covers privilege escalation, IDOR, path bypass, and access to resources without authentication. It is the most frequent category in OWASP reports.

KittySploit Modules

search access control --type scanner --protocol http
use scanner/http/admin_panel_detect
set rhost 127.0.0.1
run

use scanner/http/directory_listing_detect
set rhost 127.0.0.1
run

use scanner/http/sensitive_files_detect
set rhost 127.0.0.1
run

admin_panel_detect probes common administration paths (/admin/, /administrator/, /wp-admin/…). directory_listing_detect identifies Apache/nginx directory listings that are not disabled. sensitive_files_detect searches for backups, temporary files, and deployment artefacts.

DVWA Context

On DVWA, test manually after the scan:

Brute Force --- absence of account lockout (A07 as well).
File Inclusion --- inclusion of files outside the intended scope.
SQL Injection with credential extraction followed by session reuse.

Automated scanners do not replace authenticated browsing: configure the proxy then browse DVWA modules with the admin account.

scanner -u http://127.0.0.1 --module admin_panel_detect -v