Red Inject - Web Vulnerability Scanner v1.0.0
Red Inject is a lightweight, Python-based web vulnerability scanner designed to help security researchers and developers identify potential weaknesses in web applications. It specializes in detecting Cross-Site Scripting (XSS) and SQL Injection (SQLi) vulnerabilities within HTML forms, enabling users to quickly pinpoint and remediate security issues. The tool automatically crawls websites, extracts all HTML forms, and tests each input field with custom payloads and known injection patterns. With an easy-to-use interface and customizable payloads, Red Inject provides a fast and efficient way to strengthen web application security and improve overall resilience against common cyberattacks.
How does it works?
The script performs these steps:
- Initialize utilities (colors, banner, HTTP session).
- Crawl the target URL up to a configurable depth.
- On each page, extract HTML forms and test each form for XSS and SQLi using payload files.
- Collect and print found vulnerabilities.
Key components
requests.Session()— reuses a session and headers for all requests.BeautifulSoup— parses HTML and extracts<form>,<a>, inputs, etc.- Payload loaders — read payload lists from
payloads/xss_pl.txtandpayloads/sqli_pl.txt. visitedset — prevents revisiting the same URL during crawling.
Functionality
Fetches the page and returns all
<form> elements. Handles network errors and returns an empty list on failure.
Reads payloads from a file (one per line). If file missing, it prints an error and returns an empty list.
Depth-first crawler: stops when depth is 0 or URL already visited. On each page it:
- Parses page HTML
- Loads payload files
- Runs XSS & SQLi tests on every form
- Finds all
<a href>links and recursively crawls them withmax_depth - 1
Safety & limitations (important)
> This is for educational purposes only.
- This scanner sends requests and injects payloads — only run it against targets you own or are authorized to test.
- Detection is basic: XSS is checked by reflection of payload or presence of <script> text; SQLi looks for common error strings — both can produce false positives/negatives.
- Forms with CSRF tokens, dynamic JavaScript submission, or non-standard inputs may not be tested correctly.