Downloaded 17 times
![thank you
[ QUESTION ]
WWW.2025.IDSECCONF.ORG
DURSGO](https://image.slidesharecdn.com/ali-dursgowebsecurityscannerwithaianalysis-251117092342-34531c10/75/IDSECCONF2025-Ali-DursGo-Web-Security-Scanner-with-AI-Analysis-pdf-33-2048.jpg)
Uploaded byidsecconf
IDSECCONF2025 - Ali - DursGo–Web Security Scanner with AI Analysis.pdf
DursGo adalah web application security scanner berbasis Go yang dirancang untuk penetration testing dan audit keamanan otomatis. Analisis Berbasis AI: Terintegrasi dengan LLM (Gemini, Groq) untuk memberikan analisis mendalam, ringkasan akar masalah, dan rekomendasi perbaikan kode. Integrasi OAST: Mendeteksi blind vulnerabilities menggunakan verifikasi out-of-band.
More Related Content
Similar to IDSECCONF2025 - Ali - DursGo–Web Security Scanner with AI Analysis.pdf
IDSECCONF2025 - Ali - DursGo–Web Security Scanner with AI Analysis.pdf
- 1. DURSGO W E BA P P L I C A T I O N S C A N N E R W I T H A I A N A L Y S I S WWW.2025.IDSECCONF.ORG
- 2. ABOUT ME CONTENT CREATOR RESEARCHER SATPAMAT PUNGGAWA CYBERSECURITY KANG ALI #IDSECCONF2025 ABOUT ME WWW.ROOMKANGALI.COM
- 3. ABOUT ME #IDSECCONF2025 OUTLINE WWW.ROOMKANGALI.COM DURS PROJECT DEVELOPMENT FEATURE& WORKFLOW SCANNERS DURSGO DEMO ROADMAP
- 4. ABOUT ME #IDSECCONF2025 DURS PROJECT Researchand Development eEcosystem in the field of Cyber Security. DursGo : Web Vulnerability Scanner With AI Analysis LabVulnerDursGo : Vulnerable lab environment DursVulnNSE : Nmap Script Engine (NSE) DursVuln-Database : Centralized DursVulnNSE database DursBurp : AI Extension for Burp Suite DursNet : Platform Vulnerability Scanner DursRAG : System designed to act as a cybersecurity assistant. DursLLM : Model LLM AI Vulnerability DursMCP : Management and Control platform AI
- 5.
- 6. ABOUT ME #IDSECCONF2025 DURSGO DOWNLOAD DursGois a web application security scanner designed for penetration testing and automated security audits. Built with Go, DursGo combines high-performance scanning with AI-powered analysis to deliver intelligent and actionable security insights. V V Link Repo dursgo Link Repo LabVulnerDursGo https://github.com/roomkangali/dursgo https://github.com/roomkangali/LabVulnerDursGo dursgo Ver 1.0.0 dursgo Ver 1.1.0 Web Application Security scanner designed for penetration testing and automated security audits. AI-powered analysis to deliver intelligent and actionable security insights V dursgo Ver 1.2.0 New module subdomain scanner attack surface by finding and validating active subdomains
- 7.
- 8.
- 9. ABOUT ME #IDSECCONF2025 DURSGO VULNERABILITYLABS A collection of vulnerable applications to test the DursGo scanner.
- 10. ABOUT ME #IDSECCONF2025 FEATURES DURSGO AI-PoweredAnalysis: Integrates with LLMs (Gemini, Groq) to provide detailed analysis, root cause summaries, and specific code remediation advice for discovered vulnerabilities. OAST (Out-of-Band) Integration: Detects blind vulnerabilities through out- of-band verification. Intelligent, Context-Aware Scanning: Detects a wide range of vulnerabilities using context-aware logic for high accuracy. Comprehensive Authentication Support: Capable of scanning applications protected by login forms, bearer tokens, or session cookies. In-Depth Automated Discovery: Performs comprehensive crawling of web applications, including JavaScript-based SPAs and API endpoints. Flexible Configuration: Highly customizable via both YAML configuration files and command-line flags.
- 11. ABOUT ME #IDSECCONF2025 DURSGO SCANNERFLOWCHART This flowchart illustrates the detailed workflow of the Dursgo scanner when initiated with command-line flags like -u, -s, etc. INITIALIZATION PRE-SCAN SETUP Dursgo starts with command-line flags processing ./dursgo -u http://example.com -c 10 - r 3 -s xss,sqli ./dursgo -u http://example.com -c 10 - r 3 -s blindssrf --oast ./dursgo -u http://spa.example.com -c 10 -r 3 -s domxss -render- js The --enable-ai flag must be used in conjunction with the -output-json flag, as the AI analysis is only added to the JSON report file. Primary source for scan settings (overrides config.yaml) Component initialization technology fingerprinting ⚠️Authentication DISABLED for safety when using -u flag 🌐To detect DOM-based XSS, JavaScript rendering must be enabled. This requires a headless browser (Chrome/Chromium) to be installed. HTTP Client OAST Client Headless Browser Concurrent crawling engine discovers endpoints & parameters Robots.txt & Sitemaps HTML & JS Links Forms & Parameters Hidden Parameters Output: List of parameterized requests ready for scanning VULNERABILITY SCANNING REPORTING SCANNERS: -s string Scanners to run, comma-separated (e.g., xss,sqli,idor). Use 'all' to run all scanners, 'none' for crawling only. Available Scanners: • none • xss • sqli • lfi • openredirect • ssrf • exposed • idor • csrf • cmdinjection • ssti • securityheaders • cors • fileupload • bola • massassignment • graphql • blindssrf • domxss • subdomain AI-powered analysis & report generation LLM Analysis Console Display JSON Report 🤖AI Analysis: Sends each finding to configured LLM (Gemini, Groq, etc.) for detailed summary, root cause analysis, and code remediation advice ✅Complete security assessment delivered DISCOVERY - CRAWLING
- 12. ABOUT ME #IDSECCONF2025 DURSGO SCANNERFLOWCHART This flowchart illustrates the detailed workflow of the Dursgo scanner when initiated with a config.yaml file. INITIALIZATION PRE-SCAN SETUP Dursgo starts with config.yaml as primary configuration source config.yaml Primary source for all settings: target, ai, auth, scanners, etc. Authentication handling & component initialization 🔐Authentication ENABLED when configured in config.yaml 🌐Dynamic Form Login: Sends POST to auth.login_url with auth.login_data, verifies with auth.login_check_keyword, captures session cookies 🔑Static Credentials: Applies auth.cookie and/or auth.headers to HTTP client Concurrent crawling engine discovers endpoints & parameters Robots.txt & Sitemaps HTML & JS Links Forms & Parameters Hidden Parameters Output: List of parameterized requests ready for scanning DISCOVERY - CRAWLING VULNERABILITY SCANNING REPORTING SCANNERS: -s string Scanners to run, comma-separated (e.g., xss,sqli,idor). Use 'all' to run all scanners, 'none' for crawling only. Available Scanners: • none • xss • sqli • lfi • openredirect • ssrf • exposed • idor • csrf • cmdinjection • ssti • securityheaders • cors • fileupload • bola • massassignment • graphql • blindssrf • domxss • subdomain AI-powered analysis & report generation LLM Analysis Console Display JSON Report 🤖AI Analysis: Sends each finding to configured LLM (Gemini, Groq, etc.) for detailed summary, root cause analysis, and code remediation advice ✅Complete security assessment delivered
- 13. ABOUT ME #IDSECCONF2025 DURSGO INSTALL GoLanguage: Requires Go version 1.23 or newer. To install Go, visit : https://golang.org/doc/install Clone the Repository: git clone https://github.com/roomkangali/dursgo.git cd dursgo Build the Application: go build -o dursgo ./cmd/dursgo (Optional) Copy the Binary to the System PATH sudo cp dursgo /usr/local/bin/ Next Ver. Install go install github.com/roomkangali/dursgo/cmd/dursgo@latest
- 14. ABOUT ME #IDSECCONF2025 AVAILABLE SCANNERSDURSGO - none - A special option to perform crawling only, without vulnerability scanning. - blindssrf - Detects Blind SSRF vulnerabilities (requires -oast flag). - cmdinjection - Detects Command Injection vulnerabilities (supports OAST - requires -oast flag). - domxss - Detects DOM-Based XSS vulnerabilities (requires --render-js flag). - bola - Detects Broken Object Level Authorization (BOLA) vulnerabilities. - cors - Detects Cross-Origin Resource Sharing (CORS) misconfigurations. - csrf - Detects Cross-Site Request Forgery (CSRF) vulnerabilities. - exposed - Detects exposed sensitive files, directories, and directory listings. - fileupload - Detects Unrestricted File Upload vulnerabilities. - graphql - Detects vulnerabilities in GraphQL APIs (e.g., introspection, injection). - idor - Detects Insecure Direct Object Reference (IDOR) vulnerabilities. - lfi - Detects Local File Inclusion (LFI) vulnerabilities. - massassignment - Detects Mass Assignment vulnerabilities. - openredirect - Detects Open Redirect vulnerabilities. - securityheaders - Detects missing or misconfigured HTTP security headers. - sqli - Detects SQL Injection vulnerabilities. - ssrf - Detects in-band Server-Side Request Forgery (SSRF) vulnerabilities. - ssti - Detects Server-Side Template Injection (SSTI) vulnerabilities. - xss - Runs both XSS scanners: xss-reflected and xss-stored. - xss-reflected - Detects Reflected XSS vulnerabilities. - xss-stored - Detects Stored XSS vulnerabilities.
- 15.
- 16. ABOUT ME #IDSECCONF2025 RUNNING DURSGO Thefollowing commands demonstrate how to quickly run DursGo with different scanning modes and features. Each example highlights specific use cases such as basic vulnerability detection Scan with OAST (Out-of-Band) To run a scanner that relies on OAST, use the --oast flag. Scan for DOM XSS using -render-js Scan with AI-Powered Analysis To enrich findings with analysis from an LLM, use the --enable-ai flag. This requires the ai section to be configured in config.yaml. ./dursgo -u http://example.com -c 10 -r 3 -s blindssrf --oast ./dursgo -u http://example.com -c 10 -r 3 -s cmdinjection --oast # Avoid: Running multiple OAST scanners together may lead to correlation issues. To detect DOM-based XSS, JavaScript rendering must be enabled. This requires a headless browser (Chrome/Chromium) to be installed. ./dursgo -u http://spa.example.com -c 10 -r 3 -s domxss -render-js Basic Scan ./dursgo -u http://example.com -c 10 -r 3 -s xss,sqli ./dursgo -u http://example.com/ -c 10 -r 3 -s ssrf --enable-ai -output-json report.json --enable-ai flag must be used in conjunction with the -output-json flag, as the AI analysis is only added to the JSON report file.
- 17. ABOUT ME #IDSECCONF2025 CONFIGURATION (CONFIG.YAML) GeneralSettings This section contains the core parameters for the scan. target: The URL to be scanned. concurrency: The number of concurrent threads to use for the scan. max_depth: The maximum depth for the crawler. scanners_to_run: A comma-separated string of the scanners to be executed (e.g., "xss,sqli"). oast: A boolean (true/false) to enable or disable Out-of-Band Application Security Testing (OAST). render_js: A boolean (true/false) to enable or disable JavaScript rendering in a headless browser. user_agent: The User-Agent string to be used for all HTTP requests. verbose: A boolean (true/false) to enable or disable verbose logging. format: The output format for the report (e.g., "json"). output_file: The name of the file where the report will be saved (e.g., "report-scan.json"). AI (LLM) Integration Settings enabled: A boolean (true/false) to enable or disable AI analysis. Can be overridden by the --enable-ai flag. provider: The LLM provider to use. Supported: "gemini", "groq". api_key: Your API key for the selected provider. model: The specific model name to use (e.g., "gemini-2.0-flash", "meta-llama/llama-4-scout-17b-16e-instruct"). Authentication Configuration Form-Based Authentication (Dynamic Login) Cookie-Based Authentication (Static) Header-Based Authentication (Static) Auth-Token Based Authentication (Static)
- 18.
- 19. ABOUT ME #IDSECCONF2025 DEMO SCAN- TEST SITE FOR ACUNETIX WVS. Using the classic test target http://testphp.vulnweb.com/, we’ll demonstrate how Dursgo can quickly crawl, discover parameters, and scan for vulnerabilities. JSON REPORT
- 20. ABOUT ME #IDSECCONF2025 DEMO SCAN- VULNLAB Using the VulnLab we’ll show how Dursgo can efficiently crawl, discover parameters, and detect multiple classes of web application vulnerabilities. SSTI (Server-Side Template Injection)
- 21. ABOUT ME #IDSECCONF2025 Using theVulnLab we’ll show how Dursgo can efficiently crawl, discover parameters, and detect multiple classes of web application vulnerabilities. File Upload Vulnerability DEMO SCAN - VULNLAB
- 22. ABOUT ME #IDSECCONF2025 OAST BLINDVULNERABILITY Contains both Blind SSRF and Blind Command Injection vulnerabilities, detectable via OAST. Blind SSRF Blind Command Injection
- 23. ABOUT ME #IDSECCONF2025 LAB PORTSWIGGERPART I Usinghands-on labs from PortSwigger Web Security Academy, we’ll showcase how Dursgo can efficiently crawl, discover parameters, and detect common vulnerabilities. Detecting client-side vulnerabilities where untrusted web messages can trigger DOM-based XSS.
- 24. ABOUT ME #IDSECCONF2025 Authentication Login Scanneridentifies endpoints lacking CSRF protection without auto-exploitation. LAB PORTSWIGGER PART I
- 25. ABOUT ME #IDSECCONF2025 With theAI analysis agent enabled, Dursgo not only scans for vulnerabilities but also provides intelligent insights and reports in JSON format. We’ll run three different scenarios to showcase how Dursgo can detect LFI, GraphQL, and SSRF vulnerabilities. AI-POWERED ANALYSIS I
- 26. ABOUT ME #IDSECCONF2025 Interactive HTMLreport Showcasing AI insights AI-POWERED ANALYSIS I
- 27. ABOUT ME #IDSECCONF2025 For thisdemonstration IDOR & Stored XSS Lab, which requires authentication and is designed to simulate real-world access control and persistent injection flaws. DursGo delivers high-performance scanning combined with AI-powered analysis (enabled via config.yaml) to provide intelligent and actionable insights. AI-POWERED ANALYSIS II
- 28. ABOUT ME #IDSECCONF2025 Interactive HTMLreport Showcasing AI insights AI-POWERED ANALYSIS II With the AI analysis agent enabled, Dursgo not only scans for vulnerabilities but also provides intelligent insights and reports in JSON format.
- 29. ABOUT ME #IDSECCONF2025 PLAYLIST YOUTUBEDURSGO https://github.com/roomkangali/LabVulnerDursGo https://www.youtube.com/@RoomKangAli
- 30. ABOUT ME #IDSECCONF2025 DEVELOPMENT ROADMAP LLM& AI Integration Enhancements API Scanning Enhancements Enhancements to Existing Scanner Modules New Scanner Modules Reporting & Output Improvements New Scanner : subdomain finder
- 31. ABOUT ME #IDSECCONF2025 FAQ DURSGO Whyis the scan taking so long, especially with -s all ? The total number of tests is a product of (URLs) x (Parameters) x (Payloads) x (Scanners). On large sites, this can result in a very high number of HTTP requests, leading to long scan times. What do I need to install to use the -render-js or -s domxss flags ? These features require a headless browser to execute JavaScript. Either Google Chrome or Chromium must be installed on the system. The scanner will automatically detect the installed browser. Why dursgo not build scanner with AI ? After research for now AI just suport with analysis because im not LLM support to scanner vulnerability with AI. Contributing Contributions are welcome! Please create an issue or pull request to report bugs or add new features.
- 32. ABOUT ME #IDSECCONF2025 #DOA UNTUKALMARHUM OM ARIF PAK IWAN
- 33. thank you [ QUESTION] WWW.2025.IDSECCONF.ORG DURSGO