Sitadel – An Open Source Tool for Finding Web Application Vulnerabilities

Sitadel is a python based web application scanner. It’s flexible and has many different scanning options. It can get a full fingerprint of a server and bruteforce directories, admin pages, files etc. Also, it can search for injection type attacks (slq, html, xss, rfi, ldap and more), other information disclosures and popular vulnerabilities.

Installing Sitadel

Let’s first clone the repo from Github.

git clone

After that go inside the folder and run the setup script in python3.

cd Sitadel/

python3 install

After that you are good to go.

Running Sitadel

To run sitadel simply type the command below.


Let’s run the scanner against a vulnerable server to see what data we get back. The basic scan command is pretty straightforward. Just type this command and the scan will start. Give it some time for the script to complete.

python3 [target]

At first we get some basic fingerprinting about the target (x-frame options, headers, server version). Then it starts crawling the website. After that the scanner launches some basic attacks against the target. We got many different results. We can now search them manually for false positives. In our example we can see that our server is vulnerable to HTML injection and SQL injection, which is correct, we didn’t get any false positives for this particular test.

Leave a Reply

Your email address will not be published. Required fields are marked *