# Hello everyone, I'm glad to see you Today, I want to share my new experience with building **[Kafka HTTP Scanner](https://github.com/aymaneallaoui/kafka-http-scanner)**, an **HTTP vulnerability scanner** that is fully developed in **Go**. Initially, a security testing weekend challenge turned out to be a complete Command Line Interface Tool (lmao), something I am (half) proud to say I created. --- ## 🔍 Why Another Security Scanner? With the rapid development of IT technology, we are surrounded by multiple security tools, so I ask myself and you: **"Why?"** I have two answers:

An opportunity to learn – I wanted to strengthen my understanding of Web security vulnerabilities as well as develop my competency in Go.
Flexibility – I needed a tool that could be{" "} tailored for specific needs without going through over-complicated enterprise-grade tools.

Moreover, let us refuse to lie to one another,{" "} building security systems is quite an enjoyable task to partake . --- ## ⚡ Core Features That Make It Stand Out The tool is capable of identifying a{" "} wide array of threats to security:

HTTP Request Smuggling
SQL Injections
Cross-Site Scripting (XSS)
CORS Misconfigurations
Security Headers Neglection
SSL/TLS Vulnerable Areas
And plenty more...

In addition to detection of vulnerabilities, I wanted it to be:

✅ Fast – Able to scan concurrently (Go’s goroutines served well for this function)
✅ Modular – Having an{" "} easily deployable architecture to introduce new vulnerability scan checks
✅ Friendly – With detailed instructions{" "} to fix the problems instead of just the pointers containing the problems

--- ## 🏗️ The Technical Architecture ### Building Blocks The project follows a clean, modular structure: ### The Module System The heart of the scanner is its module system. Each vulnerability check is implemented as a separate module that implements a simple interface: This made it incredibly easy to add new vulnerability checks. Here's a simplified example of the XSS module: alert(1)", nil, nil) if strings.Contains(bodyStr, "") { return []model.Vulnerability{{ ID: "XSS-01", Name: "Reflected Cross-Site Scripting", Severity: model.SeverityHigh, // ...details, remediation info, etc. }}, nil } return nil, nil }`, }, ]} /> --- ## ⚙️ Technical Challenges I Tackled ### 1. HTTP Request Smuggling Detection Identifying HTTP request smuggling was surprisingly intricate. I had to design synthetic HTTP requests that had mismatched and contradictory ‘Content-Length’ and ‘Transfer-Encoding’ headers, then examine the server’s responses. ### 2. Concurrency Control ### 3. Robust Error Handling When you're sending malformed requests and probing security boundaries, things break. A lot. Graceful error handling was critical to prevent the scanner from crashing mid-scan: --- ## 🔁 Reflections I learned much more than I initially planned from this project:

Security vulnerabilities are nuanced – detection requires understanding both attack techniques and server-side behavior.
Go's concurrency model shines – network tools benefit massively from goroutines and channels.
CLI UX matters – a friendly interface with clean output makes developer tools more usable.

--- ## 🧭 What's Next? I have a lot of ideas to work on for Kafka HTTP Scanner:

Active Exploitation Modules (with safeguards)
CI/CD integration
Custom reporting designs
API fuzzing

--- ## 🚀 Try It Out! Since the tool is open-sourced, feel free to make any changes that fit your requirements. I would gladly welcome any feedback and contributions as well. In case you created any security tools using Go, what were some of the obstacles that you had to overcome? Share your thoughts in the comments!