mugdhav/security_auditor_orig
1
1<!DOCTYPE html>2<html lang="en">3<head>4 <meta charset="UTF-8">5 <meta name="viewport" content="width=device-width, initial-scale=1.0">6 <title>Security Auditor - Help Guide</title>7 <style>8 :root {9 --bg: #faf9f6;10 --text: #131314;11 --accent: #d97757;12 --accent-hover: #cc6944;13 --gray: #6b7280;14 --light-gray: #9ca3af;15 --border: #e5e7eb;16 --card-bg: #ffffff;17 --critical: #dc2626;18 --critical-bg: #fef2f2;19 --critical-border: #fca5a5;20 --high: #ea580c;21 --high-bg: #fff7ed;22 --high-border: #fdba74;23 --medium: #d97706;24 --medium-bg: #fffbeb;25 --medium-border: #fcd34d;26 --low: #0d9488;27 --low-bg: #f0fdfa;28 --low-border: #5eead4;29 --info-color: #6b7280;30 --info-bg: #f9fafb;31 --info-border: #d1d5db;32 }33 34 * { margin: 0; padding: 0; box-sizing: border-box; }35 36 body {37 font-family: system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;38 background: var(--bg);39 color: var(--text);40 line-height: 1.7;41 max-width: 920px;42 margin: 0 auto;43 padding: 40px 24px 60px;44 }45 46 /* Header */47 .header {48 display: flex;49 align-items: center;50 gap: 14px;51 padding-bottom: 24px;52 border-bottom: 1px solid var(--border);53 margin-bottom: 32px;54 }55 .header-icon {56 width: 44px;57 height: 44px;58 background: var(--text);59 border-radius: 8px;60 display: flex;61 align-items: center;62 justify-content: center;63 flex-shrink: 0;64 }65 .header-icon svg { width: 24px; height: 24px; stroke: white; fill: none; }66 .header-title { font-size: 24px; font-weight: 700; }67 .header-subtitle { font-size: 14px; color: var(--gray); margin-top: 2px; }68 69 /* Headings */70 h2 {71 font-size: 22px;72 font-weight: 700;73 margin: 48px 0 16px;74 padding-bottom: 8px;75 border-bottom: 2px solid var(--border);76 display: flex;77 align-items: center;78 gap: 10px;79 }80 h2 .h-num {81 display: inline-flex;82 align-items: center;83 justify-content: center;84 width: 30px;85 height: 30px;86 background: var(--accent);87 color: white;88 border-radius: 50%;89 font-size: 14px;90 font-weight: 700;91 flex-shrink: 0;92 }93 h3 {94 font-size: 17px;95 font-weight: 600;96 margin: 28px 0 12px;97 color: var(--text);98 }99 100 /* Paragraphs and lists */101 p { margin: 0 0 14px; color: var(--text); }102 ul, ol { margin: 0 0 16px; padding-left: 24px; }103 li { margin: 6px 0; }104 105 /* Links */106 a { color: var(--accent); text-decoration: none; }107 a:hover { color: var(--accent-hover); text-decoration: underline; }108 109 /* Table of Contents */110 .toc {111 background: var(--card-bg);112 border: 1px solid var(--border);113 border-radius: 10px;114 padding: 24px 28px;115 margin: 0 0 40px;116 }117 .toc-title {118 font-size: 15px;119 font-weight: 700;120 margin-bottom: 12px;121 color: var(--text);122 }123 .toc ol { padding-left: 20px; margin: 0; }124 .toc li { margin: 7px 0; font-size: 15px; }125 .toc a { color: var(--accent); font-weight: 500; }126 127 /* Cards */128 .card {129 background: var(--card-bg);130 border: 1px solid var(--border);131 border-radius: 10px;132 padding: 20px 24px;133 margin: 16px 0;134 }135 .card-label {136 font-size: 12px;137 font-weight: 600;138 text-transform: uppercase;139 letter-spacing: 0.05em;140 color: var(--gray);141 margin-bottom: 6px;142 }143 144 /* Steps */145 .steps { counter-reset: step; list-style: none; padding-left: 0; }146 .steps li {147 counter-increment: step;148 position: relative;149 padding-left: 40px;150 margin: 14px 0;151 }152 .steps li::before {153 content: counter(step);154 position: absolute;155 left: 0;156 top: 1px;157 width: 26px;158 height: 26px;159 background: var(--accent);160 color: white;161 border-radius: 50%;162 font-size: 13px;163 font-weight: 700;164 display: flex;165 align-items: center;166 justify-content: center;167 }168 169 /* Severity badges */170 .severity-sample {171 display: inline-flex;172 align-items: center;173 gap: 8px;174 padding: 8px 16px;175 border-radius: 6px;176 font-size: 13px;177 font-weight: 600;178 border: 2px solid;179 margin: 4px 4px 4px 0;180 }181 182 /* Severity table */183 .severity-table { width: 100%; border-collapse: collapse; margin: 16px 0; }184 .severity-table th {185 text-align: left;186 padding: 12px 16px;187 background: var(--bg);188 border-bottom: 2px solid var(--border);189 font-size: 13px;190 font-weight: 600;191 color: var(--gray);192 text-transform: uppercase;193 letter-spacing: 0.05em;194 }195 .severity-table td {196 padding: 14px 16px;197 border-bottom: 1px solid var(--border);198 vertical-align: top;199 font-size: 14px;200 }201 .severity-table tr:last-child td { border-bottom: none; }202 .severity-tag {203 display: inline-block;204 padding: 3px 10px;205 border-radius: 4px;206 font-size: 12px;207 font-weight: 700;208 white-space: nowrap;209 }210 211 /* Screenshots */212 .screenshot {213 display: block;214 max-width: 100%;215 border: 1px solid var(--border);216 border-radius: 10px;217 margin: 20px 0;218 box-shadow: 0 2px 8px rgba(0, 0, 0, 0.06);219 }220 .screenshot-caption {221 font-size: 13px;222 color: var(--gray);223 text-align: center;224 margin: -10px 0 20px;225 font-style: italic;226 }227 228 /* Tip / Note boxes */229 .tip {230 background: var(--high-bg);231 border-left: 4px solid var(--accent);232 border-radius: 0 8px 8px 0;233 padding: 14px 18px;234 margin: 16px 0;235 font-size: 14px;236 }237 .tip-label {238 font-weight: 700;239 color: var(--accent);240 margin-bottom: 4px;241 }242 243 /* Footer */244 .footer {245 margin-top: 60px;246 padding-top: 24px;247 border-top: 1px solid var(--border);248 text-align: center;249 color: var(--gray);250 font-size: 13px;251 }252 253 /* Keyboard shortcut styling */254 kbd {255 background: var(--bg);256 border: 1px solid var(--border);257 border-radius: 4px;258 padding: 2px 6px;259 font-size: 13px;260 font-family: ui-monospace, 'SF Mono', Monaco, 'Cascadia Code', monospace;261 }262 263 /* Print */264 @media print {265 body { background: white; max-width: 100%; padding: 20px; }266 .toc { break-after: page; }267 .card, .severity-table tr { break-inside: avoid; }268 .screenshot { max-width: 80%; margin: 12px auto; }269 a { color: var(--text); }270 h2 { break-after: avoid; }271 }272 273 /* Responsive */274 @media (max-width: 640px) {275 body { padding: 20px 16px 40px; }276 .header-title { font-size: 20px; }277 h2 { font-size: 19px; }278 .severity-table th, .severity-table td { padding: 10px 10px; font-size: 13px; }279 }280 </style>281</head>282<body>283 284 <!-- Header -->285 <div class="header">286 <div class="header-icon">287 <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">288 <rect x="3" y="11" width="18" height="11" rx="2" ry="2"></rect>289 <path d="M7 11V7a5 5 0 0 1 10 0v4"></path>290 </svg>291 </div>292 <div>293 <div class="header-title">Security Auditor</div>294 <div class="header-subtitle">Help Guide</div>295 </div>296 </div>297 298 <!-- Table of Contents -->299 <nav class="toc">300 <div class="toc-title">Contents</div>301 <ol>302 <li><a href="#getting-started">Getting Started</a></li>303 <li><a href="#local-scan">Scanning a Local Directory</a></li>304 <li><a href="#remote-scan">Scanning a Remote URL</a></li>305 <li><a href="#understanding-results">Understanding Your Results</a></li>306 <li><a href="#nvd-enrichment">National Vulnerability Database (NVD) Enrichment</a> <a href="https://nvd.nist.gov/general/cve-process" target="_blank" rel="noopener noreferrer">NVD CVE Process</a></li>307 <li><a href="#severity-guide">Severity Levels Guide</a></li>308 </ol>309 </nav>310 311 <!-- Section 1: Getting Started -->312 <h2 id="getting-started"><span class="h-num">1</span> Getting Started</h2>313 314 <p>315 Security Auditor is a combined <strong>Static Application Security Testing (SAST)</strong> and316 <strong>Dynamic Application Security Testing (DAST)</strong> platform that identifies security317 vulnerabilities in your application code and web deployments. It performs <strong>40+ security checks</strong>318 across two scanning modes.319 </p>320 321 <p>322 The checks this tool performs overlap with the <strong><a href="https://owasp.org/www-project-top-ten/" target="_blank" rel="noopener noreferrer">Open Web Application Security Project (OWASP)</a></strong> Top Ten; many checks map to common OWASP categories such as Injection, Cross-Site Scripting (XSS), Broken Authentication, and Security Misconfiguration.323 </p>324 325 <div class="card">326 <div class="card-label">Two Scanning Modes</div>327 <ul>328 <li><strong>Local Directory</strong> — Upload source code files or specify a directory path. The SAST engine scans your code for 28+ vulnerability patterns including SQL injection, XSS, command injection, hardcoded credentials, and more.</li>329 <li><strong>Remote URL</strong> — Enter a web application URL. The DAST engine checks HTTP security headers, probes for exposed sensitive paths, verifies HTTPS configuration, and scans response content for information leaks.</li>330 </ul>331 </div>332 333 <img src="/helpimg/NewGradioScreenshot_landingPage.png"334 alt="Security Auditor landing page showing Local Directory mode selected"335 class="screenshot" />336 <p class="screenshot-caption">The Security Auditor landing page with Local Directory mode selected.</p>337 338 <p>339 <strong>Supported file types for local scanning:</strong><br />340 <code>.py, .js, .ts, .java, .php, .go, .rb, .c, .cpp, .cs, .swift, .kt, .scala, .rs, .jsx, .tsx</code>341 </p>342 343 <!-- Section 2: Local Directory Scan -->344 <h2 id="local-scan"><span class="h-num">2</span> Scanning a Local Directory</h2>345 346 <p>Use this mode to scan application source code files for security vulnerabilities using static analysis.</p>347 348 <ol class="steps">349 <li>Select <strong>Local Directory</strong> in the Analysis Mode panel on the left sidebar.</li>350 <li>Provide your code using one of two methods:351 <ul>352 <li><strong>Upload files</strong> — Drag and drop or click the upload area (total size maximum 25 MB).</li>353 <li><strong>Enter a directory path</strong> — Type the full path to a local directory, e.g. <kbd>C:/Projects/my-application</kbd>.</li>354 </ul>355 </li>356 <li>Optionally toggle <strong>NVD Enriched Scan Results</strong> on or off (see <a href="#nvd-enrichment">Section 5</a>).</li>357 <li>Click the <strong>Analyze</strong> button.</li>358 <li>Wait for the scan to complete. A progress indicator shows the current status.</li>359 </ol>360 361 <div class="tip">362 <div class="tip-label">Tip</div>363 When uploading files, you can select multiple files at once. The scanner analyses all uploaded files together, detecting cross-file vulnerability patterns.364 </div>365 366 <img src="/helpimg/NewGradioScreenshot_LocalAppResult.png"367 alt="Local directory scan results showing Analysis Summary and Security Findings"368 class="screenshot" />369 <p class="screenshot-caption">Results from a local directory scan showing the Analysis Summary, severity badges, and individual finding cards.</p>370 371 <!-- Section 3: Remote URL Scan -->372 <h2 id="remote-scan"><span class="h-num">3</span> Scanning a Remote URL</h2>373 374 <p>Use this mode to dynamically test a running web application for security misconfigurations and vulnerabilities.</p>375 376 <ol class="steps">377 <li>Select <strong>Remote URL</strong> in the Analysis Mode panel.</li>378 <li>Enter the target web application URL in the <strong>Web Application URL</strong> field, e.g. <kbd>https://your-app.example.com</kbd>.</li>379 <li>Click the <strong>Analyze</strong> button.</li>380 </ol>381 382 <h3>What Gets Checked</h3>383 <div class="card">384 <ul>385 <li><strong>HTTP Security Headers</strong> — Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Strict-Transport-Security, Referrer-Policy, Permissions-Policy.</li>386 <li><strong>Sensitive Path Exposure</strong> — Probes for common exposed paths such as <code>/.env</code>, <code>/.git/config</code>, <code>/admin</code>, <code>/phpinfo.php</code>, <code>/swagger.json</code>, and 15+ other paths.</li>387 <li><strong>HTTPS Configuration</strong> — Verifies the application uses HTTPS rather than unencrypted HTTP.</li>388 <li><strong>Response Content Analysis</strong> — Scans HTML responses for database error messages, stack trace disclosures, debug mode indicators, and sensitive data in comments.</li>389 <li><strong>Server Version Disclosure</strong> — Detects if the server reveals its software version in response headers.</li>390 </ul>391 </div>392 393 <img src="/helpimg/NewGradioScreenshot_RemoteURLResult.png"394 alt="Remote URL scan results showing missing security headers and other findings"395 class="screenshot" />396 <p class="screenshot-caption">Results from a remote URL scan showing missing security headers and insecure HTTP connection findings.</p>397 398 <!-- Section 4: Understanding Results -->399 <h2 id="understanding-results"><span class="h-num">4</span> Understanding Your Results</h2>400 401 <h3>Analysis Summary</h3>402 <p>403 After a scan completes, the <strong>Analysis Summary</strong> section appears at the top of the results. It404 displays metadata about the scan and a count of findings grouped by severity level.405 </p>406 <div class="card">407 <ul>408 <li><strong>Target</strong> — The directory path or URL that was scanned.</li>409 <li><strong>Files Analyzed</strong> — Number of source code files processed (local scans only).</li>410 <li><strong>Total Findings</strong> — Total number of security issues detected.</li>411 <li><strong>Analysis Type</strong> — Either <em>Local</em> (SAST) or <em>Web</em> (DAST).</li>412 </ul>413 </div>414 415 <h3>Severity Badges</h3>416 <p>417 Below the metadata, colour-coded severity badges show how many findings fall into each severity level:418 </p>419 <p>420 <span class="severity-sample" style="background: var(--critical-bg); color: var(--critical); border-color: var(--critical-border);">Critical</span>421 <span class="severity-sample" style="background: var(--high-bg); color: var(--high); border-color: var(--high-border);">High</span>422 <span class="severity-sample" style="background: var(--medium-bg); color: var(--medium); border-color: var(--medium-border);">Medium</span>423 <span class="severity-sample" style="background: var(--low-bg); color: var(--low); border-color: var(--low-border);">Low</span>424 <span class="severity-sample" style="background: var(--info-bg); color: var(--info-color); border-color: var(--info-border);">Info</span>425 </p>426 427 <h3>Finding Cards</h3>428 <p>Each detected vulnerability is displayed as a finding card containing the following information:</p>429 <div class="card">430 <ul>431 <li><strong>Vulnerability Name</strong> — The type of security issue (e.g. "SQL Injection", "Missing Security Header: Content-Security-Policy").</li>432 <li><strong>Severity Tag</strong> — A colour-coded badge showing CRITICAL, HIGH, MEDIUM, LOW, or INFO.</li>433 <li><strong>Common Weakness Enumeration (CWE) Reference</strong> — The identifier (e.g. CWE-89).</li>434 <li><strong>CVE References</strong> — Related Common Vulnerabilities and Exposures entries (when NVD enrichment is enabled).</li>435 <li><strong>File Path & Line Number</strong> — Exact location in the source code (local scans) or the target URL (remote scans).</li>436 <li><strong>Description</strong> — Explanation of the vulnerability and its potential impact.</li>437 <li><strong>Remediation Guidance</strong> — Click the expandable section to view recommended fixes and best practices.</li>438 </ul>439 </div>440 441 <h3>Exporting Reports</h3>442 <p>443 At the bottom of the results, two export options are available:444 </p>445 <ul>446 <li><strong>Export JSON Report</strong> — Downloads a structured JSON file containing all scan data, suitable for integration with CI/CD pipelines or other security tools.</li>447 <li><strong>Export Markdown Report</strong> — Downloads a Markdown report with findings grouped by severity, including file locations, code snippets, and remediation guidance. Ideal for pasting into vibe-coding platforms (Cursor, Lovable, Bolt, etc.) to fix identified issues.</li>448 </ul>449 450 <!-- Section 5: NVD Enrichment -->451 <h2 id="nvd-enrichment"><span class="h-num">5</span> NVD Enrichment</h2>452 453 <p>454 The <strong>NVD Enriched Scan Results</strong> toggle in the sidebar controls whether scan findings are455 enriched with data from the <strong><a href="https://nvd.nist.gov/general/cve-process" target="_blank" rel="noopener noreferrer">NVD</a></strong>, maintained by the <strong><a href="https://www.nist.gov/" target="_blank" rel="noopener noreferrer">National Institute of Standards and Technology (NIST)</a></strong>.456 </p>457 458 <div class="card">459 <div class="card-label">What NVD Enrichment Adds</div>460 <ul>461 <li>Related <strong><a href="https://nvd.nist.gov/general/cve-process" target="_blank" rel="noopener noreferrer">Common Vulnerabilities and Exposures (CVE)</a></strong> references for each finding.</li>462 </div>463 464 <h3>When to Enable</h3>465 <ul>466 <li>Comprehensive security audits where you need full CVE context.</li>467 <li>Compliance reporting that requires specific vulnerability references.</li>468 <li>When you need detailed remediation guidance for each finding.</li>469 </ul>470 471 <h3>When to Disable</h3>472 <ul>473 <li>Quick scans where speed is the priority.</li>474 <li>Offline environments without internet access.</li>475 <li>When the NVD API is rate-limited or unavailable.</li>476 </ul>477 478 <div class="tip">479 <div class="tip-label">Note</div>480 NVD enrichment adds processing time to the scan. The toggle is enabled by default. You can disable it for faster scans and re-run with enrichment when needed.481 </div>482 483 <!-- Section 6: Severity Levels Guide -->484 <h2 id="severity-guide"><span class="h-num">6</span> Severity Levels Guide</h2>485 486 <p>487 Findings are classified into five severity levels. Use this guide to prioritise remediation efforts.488 </p>489 490 <table class="severity-table">491 <thead>492 <tr>493 <th style="width: 120px;">Severity</th>494 <th>Description</th>495 <th style="width: 200px;">Examples</th>496 </tr>497 </thead>498 <tbody>499 <tr>500 <td><span class="severity-tag" style="background: var(--critical-bg); color: var(--critical);">CRITICAL</span></td>501 <td>Immediate action required. These vulnerabilities can lead to full system compromise, data breaches, or remote code execution.</td>502 <td>SQL Injection, Command Injection, Hardcoded Credentials, Insecure Deserialization</td>503 </tr>504 <tr>505 <td><span class="severity-tag" style="background: var(--high-bg); color: var(--high);">HIGH</span></td>506 <td>Serious vulnerabilities requiring prompt attention. These can lead to significant data exposure or unauthorized access.</td>507 <td>Cross-Site Scripting (XSS), Path Traversal, SSRF, JWT Without Verification</td>508 </tr>509 <tr>510 <td><span class="severity-tag" style="background: var(--medium-bg); color: var(--medium);">MEDIUM</span></td>511 <td>Moderate risk requiring investigation. These may enable attacks under certain conditions or weaken security posture.</td>512 <td>CORS Misconfiguration, Weak Cryptographic Algorithm, Open Redirect, Missing Content-Security-Policy</td>513 </tr>514 <tr>515 <td><span class="severity-tag" style="background: var(--low-bg); color: var(--low);">LOW</span></td>516 <td>Minor issues with lower priority. These represent defence-in-depth concerns or best practice violations.</td>517 <td>Debug Mode Enabled, Missing Non-Critical Headers, Verbose Error Messages, Sensitive Data in Logs</td>518 </tr>519 <tr>520 <td><span class="severity-tag" style="background: var(--info-bg); color: var(--info-color);">INFO</span></td>521 <td>Informational findings with no direct security risk. These highlight areas for awareness or potential improvement.</td>522 <td>Technology Detection, Configuration Notes, Server Version Disclosure</td>523 </tr>524 </tbody>525 </table>526 527 <div class="tip">528 <div class="tip-label">Prioritisation Strategy</div>529 Address <strong>Critical</strong> and <strong>High</strong> findings first, as they pose the greatest risk. Medium findings should be reviewed and scheduled for remediation. Low and Info findings can be addressed as part of regular maintenance cycles.530 </div>531 532 <!-- Footer -->533 <div class="footer">534 Security Auditor · SAST + DAST Platform<br />535 </div>536 537 538</body>539</html>540