Dissect Logo

Passive Web Security Scanner for Modern Websites
Fast • Non-Intrusive • Professional Reporting

Version Status Python Flask Playwright License

https://dissect.up.railway.app/

Dissect is a passive web security scanner designed to help developers, cybersecurity students, and security professionals identify common web security misconfigurations without performing intrusive testing.

The scanner analyzes publicly accessible web resources—including HTTP responses, browser-rendered content, cookies, authentication surfaces, forms, and client-side resources—to provide meaningful security insights through structured reports.

Unlike active vulnerability scanners, Dissect does not attempt exploitation or modify server state, making it suitable for defensive security reviews and authorized assessments.

• ✅ Passive Security Assessment
• ✅ HTTP Security Header Analysis
• ✅ Cookie Security Review
• ✅ Authentication Surface Detection
• ✅ HTML Form Discovery
• ✅ JavaScript-Rendered DOM Analysis
• ✅ Technology Fingerprinting
• ✅ Interesting Endpoint Discovery
• ✅ Executive & Technical Reports
• ✅ Responsive Web Interface

• Security Header Analysis
• Response Header Inspection
• Redirect Chain Analysis
• Transport Security Review

• Secure Attribute Validation
• HttpOnly Detection
• SameSite Analysis
• Session Cookie Review
• Cookie Risk Assessment

• Login Page Detection
• Username Field Discovery
• Password Field Detection
• Password Reset Discovery
• Registration Form Detection
• Authentication Workflow Analysis

• Login Forms
• Registration Forms
• Contact Forms
• Search Forms
• Password Reset Forms
• Hidden Input Detection
• Suspicious Parameter Identification

Using Playwright, Dissect analyzes JavaScript-rendered pages to inspect content that is unavailable through traditional HTTP requests.

Capabilities include:

• JavaScript-rendered DOM Analysis
• Dynamic Authentication Detection
• SPA Login Discovery
• Client-side Resource Inspection

• Missing Security Header Detection
• Security Severity Classification
• Risk Explanation
• Actionable Security Recommendations

Dissect generates two complementary reports:

Designed for managers, developers, and quick assessments.

Includes:

• Overall Security Score
• Executive Summary
• Key Findings
• Risk Breakdown
• Recommendations

Designed for developers and security practitioners.

Includes:

• Complete Scan Results
• Detailed Technical Findings
• Evidence
• Risk Classification
• Security Recommendations

Homepage

Executive Report

Technical Report

 User
 │
 ▼
 Flask Web Application
 │
 ▼
 Passive Scanning Engine
 ┌─────────────┼─────────────┐
 │ │ │
 ▼ ▼ ▼
 HTTP Analysis Browser Render HTML Parsing
 (Requests) (Playwright) (BeautifulSoup)
 │ │ │
 └─────────────┼─────────────┘
 ▼
 Analysis Engine
 │
 ▼
 Risk Assessment
 │
 ┌─────────────┴─────────────┐
 ▼ ▼
 Executive Report Technical Report

Dissect follows a passive-first approach to web security assessment.

The scanner intentionally avoids:

• Payload Injection
• Exploitation
• Brute Force Attacks
• Server Modification
• Intrusive Testing

Instead, it focuses on identifying security weaknesses that are observable through publicly accessible resources and browser-rendered content.

• ✅ Passive Security Scanner
• ✅ HTTP Security Analysis
• ✅ Cookie Analysis
• ✅ Authentication Surface Detection
• ✅ HTML Form Analysis
• ✅ Browser Rendering
• ✅ Executive Report
• ✅ Technical Report
• ✅ Responsive Interface

• SSL/TLS Certificate Analysis
• DNS Information
• WHOIS Information
• robots.txt Analysis
• sitemap.xml Analysis
• Multi-page Crawling
• Historical Scan Comparison
• PDF Report Export
• User Dashboard
• Scheduled Scans

Dissect is intended for educational purposes and authorized security assessments only.

Only scan systems that you own or have explicit permission to assess.

Users are responsible for ensuring compliance with applicable laws and regulations.

This repository serves as the official documentation and project information page for Dissect, including its architecture, capabilities, development roadmap, and updates.

This project is licensed under the MIT License.

Ashish Agrawal

Cybersecurity Student • Security Enthusiast • Future Cybersecurity Engineer

Dissect is publicly available as a hosted web application. This repository serves as the official project page, containing documentation, architecture, release notes, and project updates.

The production implementation is maintained in a private repository while the project continues to evolve.

Community feedback, feature requests, bug reports, and suggestions are welcome through GitHub Issues and Discussions.

If you found this project interesting, consider ⭐ starring the repository.