🔍 LoginScout

LoginScout is a production-quality, async Python tool for discovering login and authentication pages across a target website — inspired by Nessus, built for the modern web.

---

✨ Features

Feature	Details
BFS Crawler	Breadth-first, scope-aware, depth-configurable
Multi-technique Detection	Password fields, form analysis, URL/content keywords, confidence scoring
Admin Panel Detection	Separately flags admin panels
Subdomain Scanning	DNS brute force with customisable wordlist
Robots.txt Handling	Respect or probe disallowed paths
JS Rendering	Playwright-powered for SPA / React / Vue apps
Rate Limiting	Configurable delay + exponential backoff on 429/503
Rich Reports	JSON, TXT, and styled interactive HTML
Async + Concurrent	asyncio + aiohttp, bounded concurrency
Security Auditing	Flags missing HTTPS, absent CSRF tokens

---

📁 Project Structure

loginscout/
├── main.py                        # CLI entry point
├── requirements.txt               # Python dependencies
├── README.md                      # This file
│
├── loginscout/                    # Core package
│   ├── __init__.py
│   ├── config.py                  # ScanConfig dataclass + all defaults
│   ├── crawler.py                 # Async BFS crawler (aiohttp)
│   ├── detector.py                # Login page detection engine
│   ├── subdomain_scanner.py       # DNS brute-force subdomain discovery
│   ├── reporter.py                # JSON / TXT / HTML report generation
│   └── utils.py                   # URL normalisation, logging, robots.txt
│
├── wordlists/
│   └── subdomains.txt             # Built-in subdomain wordlist
│
├── reports/                       # Output reports (auto-created)
└── logs/                          # Log files (auto-created)

---

⚙️ Installation

1 — Clone / copy the project

git clone https://github.com/yourorg/loginscout.git
cd loginscout

2 — Create a virtual environment (recommended)

python3 -m venv .venv
source .venv/bin/activate        # Linux / macOS
.venv\Scripts\activate           # Windows

3 — Install Python dependencies

pip install -r requirements.txt

4 — Install Playwright browsers (only needed with --enable-js)

playwright install chromium

---

🚀 Usage

python main.py -t TARGET [options]

Required

Flag	Description
-t, --target	Target domain or IP (e.g. example.com, 192.168.1.10)

Crawl Options

Flag	Default	Description
--depth N	3	Maximum BFS crawl depth
--threads N	10	Maximum concurrent requests
--delay S	0.2	Seconds between requests
--timeout S	15	Request timeout (seconds)
--max-pages N	500	Hard page crawl cap
--user-agent UA	Chrome/122	Custom User-Agent
--no-respect-robots	—	Ignore robots.txt
--scan-disallowed	—	Also probe disallowed paths

Feature Flags

Flag	Description
--enable-js	Render pages with Playwright (slower, more thorough)
--enable-subdomain-scan	Discover subdomains via DNS brute force
--subdomain-wordlist FILE	Custom wordlist file path

Output Options

Flag	Default	Description
--output FORMAT	all	json, txt, html, or all
--output-dir DIR	./reports	Directory for saved reports
--log-file FILE	auto	Custom log file path
-v, --verbose	—	Enable DEBUG logging
-q, --quiet	—	Suppress console output

---

📖 Example Commands

# Basic scan of a domain (depth 3, 10 threads)
python main.py -t example.com

# Deep scan with JS rendering
python main.py -t example.com --depth 5 --threads 20 --enable-js

# Scan an IP address
python main.py -t 192.168.1.1 --depth 3

# Full scan: subdomains + JS + all outputs
python main.py -t example.com \
  --enable-subdomain-scan \
  --enable-js \
  --depth 4 \
  --threads 15 \
  --delay 0.3 \
  --output all \
  --verbose

# Probe robots.txt disallowed paths (often exposes admin/staging endpoints)
python main.py -t example.com --scan-disallowed --no-respect-robots

# Custom subdomain wordlist, JSON output only
python main.py -t example.com \
  --enable-subdomain-scan \
  --subdomain-wordlist ./wordlists/subdomains.txt \
  --output json

# Quiet mode — only save reports, no console noise
python main.py -t example.com -q --output all

---

📊 Output Formats

JSON (loginscout_<target>_<timestamp>.json)

Full machine-readable output including metadata, configuration, statistics, and detailed per-page results.

TXT (loginscout_<target>_<timestamp>.txt)

Human-readable summary with confidence labels, detection methods, and security issues.

HTML (loginscout_<target>_<timestamp>.html)

Interactive dark-themed report with:

• Summary statistics dashboard
• Filterable results table (by confidence / admin / insecure)
• Full-text search
• Security issue highlights

---

🔍 Detection Engine

Each page is scored across multiple techniques:

Technique	Weight
<input type="password"> found	0.45
Form with username + password fields	0.35
URL contains login keyword	0.25
Page body contains login phrases	0.20
Admin URL keyword detected	0.20
<title> contains auth keyword	0.15
Form action URL matches login keyword	0.10

The raw score is normalised to [0.0 – 1.0]:

• HIGH ≥ 0.75
• MEDIUM ≥ 0.40
• LOW > 0.0

---

⚠️ Security Checks

LoginScout flags:

• No HTTPS — login page served over plain HTTP
• No CSRF token — form has no detectable CSRF protection

---

🛡️ Legal Disclaimer

LoginScout is intended for authorised security assessments only.
Only scan systems you own or have explicit written permission to test.
Unauthorised scanning may be illegal in your jurisdiction.

---

🔧 Extending LoginScout

Custom detection keywords

Edit loginscout/config.py — modify LOGIN_URL_KEYWORDS, LOGIN_CONTENT_KEYWORDS, or ADMIN_URL_KEYWORDS.

Adding a new output format

Subclass or extend loginscout/reporter.py and add a save_<format>() method.

Using with Burp / proxy

Set HTTP_PROXY / HTTPS_PROXY environment variables — aiohttp respects them automatically.

---

📋 Requirements

• Python 3.11+
• See requirements.txt for full package list