AI Vulnerability Scanner

This is an automated web vulnerability scanner. It uses OWASP ZAP to find security issues and then passes them to a local AI model (running in Ollama) to see if they are real threats. The AI will then generate a final report with clear steps on how to reproduce and fix each issue.

Prerequisites

You will need these installed on your system:

• Docker
• Python 3

How to use it

We have included a wrapper script that handles everything for you automatically, including starting the Docker containers, pulling the AI model, and running the scan.

1. Make the script executable

Open your terminal in the ai-scanner folder and run this once:

chmod +x run.sh

2. Run a scan

Run the script using sudo (since it needs to manage Docker containers) and pass the target URL:

sudo ./run.sh http://your-target-url.com

If you want to save the report to a specific file instead of the default report.md, you can use the --output flag:

sudo ./run.sh http://testfire.net --output results.md

What the script does under the hood

When you run run.sh, it automatically:

1. Starts the OWASP ZAP and Ollama services via Docker.
2. Waits for both services to be fully up and running.
3. Downloads the xploiter/the-xploiter AI model if you do not already have it.
4. Activates the Python virtual environment (if one exists).
5. Kicks off the scan against your target URL.

Once the scan finishes, it outputs a markdown report containing the developer tickets and exploitation steps for any found vulnerabilities.