🛡️ Misconfig Security Scanner

Lightweight Recon & Web Hygiene Scanner for Bug Bounty Hunters

🛡️ Misconfig Security Scanner

A lightweight, fast, and non-destructive reconnaissance & web hygiene scanner built for modern bug bounty hunters.

---

🚀 Overview

Misconfig Security Scanner (formerly Kay Bug Bounty Hunter) is a Python-based security tool designed to help researchers quickly perform authorized reconnaissance and identify common web security misconfigurations.

It focuses on clarity, speed, and practical results — making it ideal for:

• Bug bounty hunters
• Cybersecurity students
• Web pentesters

Unlike noisy scanners, this tool performs safe, controlled checks and generates clean, professional reports.

---

✨ Features

• 🔍 Subdomain enumeration (wordlist + passive discovery)

• 🌐 HTTP/HTTPS service analysis

• 🔐 Security headers inspection

• 🍪 Cookie security flag analysis

• 🌍 CORS policy checks

• 🚦 HTTP method checks (TRACE, PUT, DELETE, PATCH)

• 📄 Form & endpoint discovery

• 🧠 JavaScript endpoint extraction

• 🔑 Secret detection (API keys, tokens, credentials)

• 🗄️ Sensitive path/file brute-forcing (.git, .env, backups, admin panels)

• 🔒 TLS certificate analysis (expiry, errors)

• ⚠️ Subdomain takeover fingerprinting (CNAME + page fingerprints)

• ⚡ Multi-threaded scanning engine

• 📊 Automatic risk scoring (0–100)

• 📁 Report generation:

  • TXT (quick view)
  • CSV (spreadsheets)
  • JSON (automation)
  • HTML (professional report)

---

🎯 No-False-Positive Host Discovery

The scanner is designed to avoid reporting subdomains that don't actually exist:

• 🚫 Wildcard DNS detection — probes a random non-existent name; if it resolves, hosts that only match the wildcard IPs are dropped.
• ✅ HTTP/HTTPS liveness check — only hosts that actually respond over the web are kept (skip with --no-verify).
• 🔎 Strict crt.sh matching — names like evil-example.com are no longer mistaken for example.com subdomains.

---

⚙️ Installation

1. Clone the repository

git clone https://github.com/whoiskay404/Misconfig_Security
cd Misconfig_Security

2. Make executable (Linux/Kali)

chmod +x misconfig.py

3. Run the tool

python3 misconfig.py example.com

---

🧪 Usage

🔹 Basic Scan

python3 misconfig.py example.com

---

📌 Command Options

Option	Description
-o, --output	Output directory (default: bug/output)
-t, --threads	Number of threads (default: 20)
--timeout	Request timeout in seconds
--passive	Enable passive subdomain discovery (crt.sh)
-w, --wordlist	File of extra subdomains to enumerate (one per line)
--ports	Custom ports (e.g. 80,443,8080 or 8000-8100)
-d, --dirscan	Brute-force common sensitive paths and files
-v, --verbose	Print each finding as it is recorded
--no-verify	Skip HTTP/HTTPS liveness verification of resolved hosts

---

🧰 Examples

Passive + Faster Scan

python3 misconfig.py target.com --passive -t 40

Custom Output Directory

python3 misconfig.py target.com -o results/

Custom Ports

python3 misconfig.py target.com --ports 80,443,8080,8443

Sensitive Path / File Brute-Force

python3 misconfig.py target.com --dirscan

Custom Subdomain Wordlist

python3 misconfig.py target.com -w subdomains.txt

---

📊 Output

After scanning, reports are saved in:

bug/output/
├── report.txt
├── report.csv
├── report.json
└── report.html

---

🌐 HTML Report

The HTML report provides a clean, professional interface including:

• 📈 Risk score
• 📋 Findings table (Severity, Evidence, Recommendations)
• 🌍 Hosts and endpoints
• 🔍 Discovered services and metadata

Open it in your browser:

xdg-open bug/output/report.html

---

🔍 What the Tool Detects

🔴 High Severity

• Secrets exposed in JavaScript (API keys, tokens)
• Sensitive files exposed (.git, .env, backups)
• Subdomain takeover fingerprints (CNAME + page)
• TLS/SSL errors and expired certificates

🟡 Medium Severity

• Missing security headers
• Weak cookie configurations (Secure, HttpOnly, SameSite)
• CORS misconfigurations
• Non-standard HTTP methods (TRACE, PUT, DELETE)
• Certificates expiring soon

🔵 Informational / Low

• Open ports
• Forms and endpoints
• Interesting URLs
• Metadata files (robots.txt, sitemap.xml)
• Disclosed software versions

---

📈 Risk Scoring

Each finding contributes to a total risk score (0–100):

• Critical → 40
• High → 25
• Medium → 10
• Low → 4
• Info → 1

---

🧠 Recommended Workflow

1. Run scan:

python3 misconfig.py target.com --passive --dirscan

2. Open HTML report

3. Prioritize:

• 🔴 High → immediate investigation
• 🟡 Medium → configuration fixes
• 🔵 Info → manual testing leads

---

⚠️ Legal Disclaimer

This tool is intended for authorized security testing only.

You must:

• Only scan systems you own, or
• Have explicit permission to test

The author is not responsible for misuse.

---

🧑‍💻 Author

Karabo Kosi (Kaysociety)

• 🎥 YouTube: https://www.youtube.com/@kaysociety404
• 💼 LinkedIn: https://www.linkedin.com/in/karabo-kosi-534501380/

---

⭐ Support

If you find this project useful:

• ⭐ Star the repository
• 🍴 Fork it
• 📢 Share it

---

💡 Roadmap

• CVE detection
• Directory brute forcing (custom wordlists)
• API fuzzing
• Screenshot capture
• Integration with Burp Suite / OWASP ZAP

---

📜 License

This project is licensed under the MIT License.

---

🔥 Built for hackers. Designed for clarity.

📸 Screenshots