/webscan

description: Web vulnerability scanning with multiple engines (nuclei, nikto, AI assessment)
allowed-tools: ToolSearch, Bash, Read, Write
argument-hint: <target-url>

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.

Web Vulnerability Scan

Target: `$ARGUMENTS`

Execute multi-engine web vulnerability scanning using Hexstrike MCP tools.

Step 1: Load Tools

Use ToolSearch to load:

• `nuclei_scan` — template-based vulnerability scanning
• `nikto_scan` — web server misconfiguration scanning
• `ai_vulnerability_assessment` — AI-powered vulnerability assessment

Step 2: Nuclei Scan

Run `nuclei_scan` against the target with:

• Severity filter: critical, high, medium
• Rate limiting appropriate for the target (lower for WAF-protected targets)
• Include technology-specific templates if tech stack is known

Step 3: Nikto Scan

Run `nikto_scan` for server misconfiguration, default files, and known vulnerable paths.

Step 4: AI Vulnerability Assessment

Run `ai_vulnerability_assessment` on the target for intelligent vulnerability detection that adapts to the target's technology stack and responses.

Step 5: Results

Consolidate findings from all three engines, deduplicate, and present sorted by severity:

• **CRITICAL**: Immediate exploitation possible
• **HIGH**: Significant impact, likely exploitable
• **MEDIUM**: Moderate impact or requires specific conditions
• **LOW/INFO**: Informational findings

Save consolidated report to `webscan-{target}.md` in the project directory. Flag any findings that warrant immediate manual investigation.