SmartScanner Reversal
Completed — source published
SmartScanner Reversal is a reverse engineering project by fauxrouge: a reconstruction of the source code of SmartScanner 3.0.0, a web vulnerability scanner written in C++17 with Qt 6. The reconstructed source is published on GitHub for educational purposes.
View the SmartScanner source code on GitHubWhat SmartScanner is
SmartScanner is a web vulnerability scanner. Version 3.0.0 ships as two executables built on the same shared library: sms.exe, a command-line interface, and gui.exe, a Qt WebEngine graphical interface. A scan crawls a target, runs detection modules against what it finds, and writes a JSON report.
What the reverse engineering covers
The reconstruction rebuilds the scanner's engine and both front ends:
- Crawling engine — link and form analysis,
robots.txtand sitemap handling, configurable crawl depth and scope. - Injection testing — SQL injection, XSS, XXE, OS command injection, file inclusion and SSRF.
- Configuration checks — HTTP headers, HTTPS/TLS, redirects, exposed files and directory listing.
- Technology detection — with targeted checks for WordPress, Joomla and Drupal.
- Exposed secrets and vulnerable JavaScript library detection.
- JSON reporting — severity levels, HTTP evidence, recommendations, and CWE, OWASP, CVE and GHSA classifications where available.
- Transport options — HTTP Basic authentication, proxy support and custom User-Agent strings.
Stack and build
- Language
- C++17
- Framework
- Qt 6.2+ (Core, Gui, Widgets, Network, WebChannel, WebEngineWidgets, Xml)
- Build
- CMake 3.21+ with Ninja
- Platform
- Windows, MSVC build tools
- Status
- Completed — source code public
The GUI entry point calls the Windows API directly, so building the full project on Linux or macOS requires modifications. Build scripts (build.ps1, deploy.ps1) and smoke tests are included in the repository.
Source code
The full SmartScanner source reconstruction is available on GitHub: github.com/fauxrougee/SmartScanner-Source. The original project is proprietary; this reconstruction is published for educational purposes and carries no separate license file.