Project Overview

A Django based web application designed for automated reconnaissance and security analysis of web domains. The tool performs parallel, non-intrusive scanning and delivers detailed attack surface analysis through an interactive web interface and exportable PDF reports.

This project successfully delivers a fully functional domain analysis platform that automates OSINT gathering and basic security reconnaissance. The application runs locally, accepts target domains from web interface, executes reconnaissance tasks, and generates comprehensive reports suitable for penetration testing preparation and security audits.

Core Architecture

Technology Stack

• Backend Framework: Django(Python 3.12)
• Concurrency: ThreadPoolExecutor with 6 worker parallel execution
• Reporting: ReportLab PDF generation with templated layouts
• Web Scraping: BeautifulSoup4 for HTML parsing
• Security Libraries:
  • SSLyze for SSL/TLS inspection
  • python-nmap for port scanning
  • dnspython for DNS queries
  • python-whois for domain registration data

Project Structure

domain_analyzer/
├── domain_analyzer/
│ settings.py # Django configuration
│ urls.py # URL routing
│ wsgi.py
├── main/
│ views.py # Request handlers
│ forms.py # Input validation
│ pdf_exporter.py # PDF report generation
│ urls.py # App level routing
│ static/ # CSS, JavaScript files
│ css/domain_analyzer.css
│ js/scripts.js
│ templates/ # HTML files
│ index.html
│ domain-analyzer.html
│ tools/ # Reconnaissance modules
│ admin_panel_scanner.py
│ dns_records.py
│ email_harvester.py
│ form_detector.py
│ ip_address.py
│ port_scanner.py
│ robots_parser.py
│ ssl_scanner.py
│ subdomain_finder.py
│ whois_search.py
├── manage.py # Main runnable file
├── requirements.txt # Dependencies
└── README.md

Implemented Features

DNS Resolution Module (dns_records.py)

• Record Types: A, AAAA, MX, NS, TXT, SOA, CAA, CNAME
• Implementation: dnspython resolver
• Output: Structured list of tuples

IP Address Resolution (ip_address.py)

• Functionality: IPv4 address resolution
• Implementation: Python socket library
• Output: Primary IP address for target domain

WHOIS Lookup (whois_search.py)

• Data Retrieved:
  • Registrar information
  • Registration/expiration dates
  • Name servers
  • Registrant details (when not privacy-protected)
• Implementation: python-whois library
• Output: Key-value pairs of domain registration metadata

SSL/TLS Certificate Inspection (ssl_scanner.py)

• Capabilities:
  • Certificate chain retrieval
  • Validity period checking
  • Subject Alternative Names (SAN) extraction
  • Issuer identification
• Implementation: SSLyze server scanning
• Output: Certificate details + validity boolean

robots.txt Parser (robots_parser.py)

• Functionality: Fetches and returns raw robots.txt content
• Implementation: Simple HTTP GET request
• Output: Full robots.txt text

Port Scanner (port_scanner.py)

• Target Ports: 21, 22, 23, 80, 443, 445, 3306, 3389, 8080
• Implementation:
  • Single nmap execution
  • Arguments: -Pn -T4 --max-retries 1
• Output: List of (port, service_name) tuples for open ports only

Subdomain Enumeration (subdomain_finder.py)

• Wordlist: 100 common subdomain prefixes
• Concurrency: 15 parallel workers via ThreadPoolExecutor
• Probe Method: HTTPS GET requests with status code checking
• Output: List of discovered subdomain URLs

Admin Panel Discovery (admin_panel_scanner.py)

• Target Paths: 12 common admin endpoints
  • /admin, /login, /wp-admin, /administrator
  • /user/login, /cpanel, /dashboard, /cms
  • /panel, /auth, /backend, /manage
• Detection Logic:
  • HTTP status codes
  • Response body hints (login forms, WordPress signatures)
  • Header analysis (server technology)
• Output: URL, status code, redirect count, technology hints

Web Form Detector (form_detector.py)

• Capabilities:
  • Form extraction from main page HTML
  • Action URL resolution
  • Input field enumeration with types
  • Basic vulnerability flagging
• Vulnerability Checks:
  • Password fields in GET requests → credential leakage risk
  • File upload inputs → arbitrary file upload risk
  • Text inputs → XSS/SQL injection surface
  • Multiple password fields → brute-force targets
• Implementation: BeautifulSoup HTML parsing
• Output: Array of form objects with vulnerability annotations

Email Harvester (email_harvester.py)

• Scan Scope:
  • Common paths: /contact, /about, /team, /support
• Detection Methods:
  • Regex pattern matching
• Spam Filtering:
  • Excludes example.com, test.com, sample.com domains
  • Filters noreply@, no-reply@, donotreply@ addresses
  • Removes placeholder emails
• Concurrency: Sequential page checks
• Output: List of {email, source_page} objects

Web Interface

• Landing Page:
  • Clean, minimalist design
  • Single input field for target domain
  • "Analyze" button triggers reconnaissance
• Results Page (domain-analyzer.html):
  • Collapsible sections for each analysis module
  • Toggle buttons for expanding/collapsing results
  • Module specific descriptions explaining security implications

PDF Export System (pdf_exporter.py)

• Features:
  • Title page with target domain and generation timestamp
  • Per-module sections with explanatory text
  • Tabular data formatting with headers
• Implementation:
  • ReportLab library with custom ParagraphStyle
  • Dynamic table sizing based on data volume
• Export Trigger:
  • "Export PDF Report" button appears after scan completion
  • Download filename: {domain}_attack_surface_analysis.pdf

Deliverables

Originally Planned (All Completed)

• DNS Resolution - A/AAAA/MX/NS/TXT/SOA/CAA records
• IP Resolution & Context - Socket-based address lookup
• WHOIS Lookups - Registrar, dates, nameservers
• SSL/TLS Certificate Inspection - Chain, validity, SAN extraction
• HTTP Header Analysis - Implicit in admin panel scanner
• robots.txt Parsing - Full text retrieval and PDF rendering
• Port Visibility - 9 common service ports via nmap
• Subdomain Enumeration - Parallel wordlist-based probing
• JavaScript Collection - (Descoped - not critical for MVP)
• Technology Fingerprinting - Implemented via admin panel hints (WordPress, login forms, tech headers)
• Email Harvesting - Regex + mailto extraction with spam filtering
• Web Form Detection - BeautifulSoup parsing with vulnerability tagging
• Common Admin Panel Discovery - 12-path probe with hint extraction
• PDF Export and Polished Reporting - Full ReportLab integration with professional layout

Deployment and Maintenance

# Clone repository  
git clone <https://github.com/kelma01/domain-analyzer>  

# Create virtual environment  
python -m venv venv  
venv/Scripts/activate

# Install dependencies  
pip install -r requirements.txt  

# Run development server  
cd domain_analyzer  
python manage.py runserver  

# Server at <http://127.0.0.1:8000/>

Conclusion

This project successfully delivers a domain reconnaissance platform that meets all objectives and exceeds expectations with optimizations and features. The application provides security professionals and students with a safe, efficient, and legally compliant tool for attack surface analysis.

Appendix: Technical Specifications

Dependencies (requirements.txt)

Django==4.2.7
beautifulsoup4==4.14.3
python-nmap==0.7.1
dnspython==2.7.0
python-whois==0.9.27
sslyze==6.0.0
requests==2.32.3
urllib3==2.3.0
reportlab==4.4.6