0

Let me quickly explain and then ask the question. I'm developing a Web Vulnerability assessment scanner for a project, and I'm learning python as I go, so forgive me if it might sound like a dumb question. The idea is to allow a user to run periodical scans against their website and report SQL injection findings, XSS vulnerabilities for the beginning and further develop from there. They could then go back and view all the scans and keep track of their website's security performance.

The pre-requisite is for the user to be logged in when they run the scan to grab the Session ID to mimic the user. But I want the scan to be able to run once a day in the background. How would that be possible? Is the Session ID used initially still being valid for the next scans? Is there a better approach I could take to it, maybe?

Thanks for taking the time to read so far. Hopefully might get some advice from someone more knowledgeable than me :)

PS: If you have any recommendation to make me consider other vulnerabilities/libraries, I'm all ears

2
  • see stackoverflow.com/questions/12737740/… – mti2935 Oct 22 '20 at 22:29
  • 2
    "Is the Session ID used initially still being valid for the next scans?" - this fully depends on the actual implementation of the web application, i.e. there is no general rule. But in most cases it is likely expired already after a day. – Steffen Ullrich Oct 23 '20 at 3:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.