Project Overview
Rapidscan is a multi-tool web vulnerability scanner written in Python. Instead of building its own detection engine, it orchestrates roughly twenty established security tools — nmap, Nikto, Wapiti, SSLyze, dnsrecon, and others — against a single target with one command, then parses their combined output into severity-ranked findings.
You point it at a domain and it works through a long checklist: open ports, outdated server banners, weak TLS configuration, DNS zone transfer exposure, SQL injection candidates, XSS-prone parameters, and common server misconfigurations. Each finding gets a severity level (critical, high, medium, low, info) plus a short remediation hint, and the run ends with an overall threat-level summary for the target.
Be clear about what you're getting: a wrapper, not a scanner. Detection quality is exactly the quality of the wrapped tools, and Rapidscan's value is sequencing, output parsing, and triage. It is a single-maintainer project with long quiet stretches between commits — check the commit history before you build any recurring workflow on it, because wrapped tools change their CLI flags and output formats over time, and a stale output matcher silently drops findings instead of erroring. As of 2026-06-12 the repo sits at about 2,060 stars with star growth of roughly 6.7% over the last ~6 months, so people still find and use it, but treat it as a convenience layer rather than a maintained product.
One more thing you must take seriously: this is an offensive security tool. Only scan systems you own or have written authorization to test. Unauthorized scanning is illegal in most jurisdictions, full stop.
Key Challenges Addressed
- Tool sprawl. A basic web recon pass means running a port scanner, a web server scanner, a TLS analyzer, a DNS enumerator, and a handful of fuzzers, each with its own flags. Rapidscan hardcodes a sensible invocation for each tool so you run one command instead of twenty.
- Output overload. Raw scanner output is thousands of lines of noise. Rapidscan matches known vulnerability signatures in each tool's output and surfaces only the lines that map to a real finding.
- Triage paralysis. Every matched finding carries a severity level and a remediation hint, so you get an ordered fix list instead of a wall of text.
- The beginner ramp. If you don't yet know what dnsrecon or SSLyze even test for, watching Rapidscan drive them — and reading the exact commands it runs — is a fast way to learn the standard recon toolbox.
Getting Started
Rapidscan is a single Python script with no package-install step:
git clone https://github.com/skavngr/rapidscan
cd rapidscan
chmod +x rapidscan.py
./rapidscan.py target-you-are-authorized-to-scan.com
Run it on Kali Linux if you can. Rapidscan does not bundle the tools it drives; it expects nmap, nikto, wapiti, dnsrecon, and the rest to already be on your PATH, and Kali ships nearly all of them.
Sharp edges you'll hit immediately:
- If a wrapped tool is missing, Rapidscan skips that check and keeps going — on a bare Ubuntu box most tools are absent, so the scan finishes looking "clean" while having tested almost nothing. Check the missing-tools list Rapidscan prints at startup and install those packages before trusting any result.
- Scans run sequentially, one tool at a time, so a full run against a slow target can take well over an hour. Press Ctrl+C to skip the currently running tool without aborting the whole scan — use it when a single scanner hangs.
- Old releases targeted Python 2. If you see
SyntaxErroron aprintstatement at launch, you're running a stale copy or fork — pull the latest from the official repo and run it withpython3.
Features and Use Cases
The core feature set is small and focused:
- One-command broad recon. Around 80 vulnerability checks executed via ~20 underlying tools, covering ports, web server software, TLS, DNS, and common web application flaws.
- Severity-ranked reporting. Findings are bucketed into critical, high, medium, low, and informational, with color-coded terminal output and a final threat-level meter.
- Remediation hints. Each detected issue includes a short note on how to fix it — enough to point a developer at the right config or patch.
- Skippable scanners. Per-tool skip via Ctrl+C keeps one misbehaving scanner from costing you the whole run.
Where it fits in practice: the first hour of an authorized penetration test, when you want broad surface coverage before going deep manually; a self-assessment of your own staging server before exposing it; CTF and lab environments; and learning, because the script shows you exactly which command produced each finding. Where it does not fit: CI pipelines and professional reporting. Output is colored terminal text with no JSON or XML export, so there is nothing for a pipeline or report generator to consume.
Ecosystem and Dependencies
Rapidscan is only as good as the toolbox underneath it. The wrapped tools include nmap for port and service discovery, Nikto for web server misconfiguration checks, Wapiti for black-box web vulnerability fuzzing, SSLyze for TLS configuration analysis, theHarvester for OSINT gathering, dnsrecon for DNS enumeration, WhatWeb for technology fingerprinting, and Golismero for additional web auditing, among others.
Two practical consequences. First, you inherit each tool's installation story — on Kali that's free, anywhere else you'll be installing packages one by one. Second, you inherit each tool's failure modes: if your distro ships a newer nikto whose output format changed, Rapidscan's matcher for that check quietly stops firing. When a finding you expected doesn't appear, run the underlying tool by hand and compare.
Architectural Overview
The whole project is essentially one Python script. Inside it, a static table defines each check: the shell command to run, the string or pattern that indicates a hit in that command's output, the severity to assign, and the remediation text to print. The main loop walks the table, launches each tool as a subprocess, captures stdout, and matches it against the signature.
This design has real virtues. You can read the entire codebase in one sitting, see precisely what every check executes, and add your own check by appending one entry to the table — no plugin API to learn. For a learning tool, that transparency is the point.
The same design sets hard limits. Signature matching against free-form tool output is brittle across tool versions. Sequential subprocess execution means no parallelism and long wall-clock times. There is no persistent state, no resume after a crash, and no structured output, so you can't diff two scans of the same target or feed results downstream. If you need any of those properties, you've outgrown the tool.
Pros and Cons
Pros:
- One command replaces twenty hand-built tool invocations for broad recon.
- Severity ranking and remediation hints give you an actionable fix list, not raw logs.
- Fully transparent: every executed command is visible in the script, which makes it a strong learning tool.
- Trivial to extend — adding a check is one table entry, no framework to learn.
- Runs anywhere Python 3 and the underlying tools exist; ideal on Kali.
Cons:
- Detection ceiling is set entirely by the wrapped tools; Rapidscan adds no detection of its own.
- No JSON/XML output, so no CI integration, scan diffing, or automated reporting.
- Sequential execution makes full scans slow against real targets.
- Output-signature parsing breaks silently when a wrapped tool's output format changes.
- Low maintenance velocity from a single maintainer; long gaps between commits.
Comparison and Alternatives
GitHub stars
Weekly star gains
Full metrics details
GitHub GraphQL current stargazer cohort, reconstructed from starredAt events and totalCount retrieved in one stable pagination walk. GitHub does not expose historical unstar events, so this is not an exact ledger of past star counts.
Rapidscan
GitHub GraphQL current stargazer cohort, reconstructed from starredAt events and totalCount retrieved in one stable pagination walk. GitHub does not expose historical unstar events, so this is not an exact ledger of past star counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Nuclei
GitHub GraphQL current stargazer cohort, reconstructed from starredAt events and totalCount retrieved in one stable pagination walk. GitHub does not expose historical unstar events, so this is not an exact ledger of past star counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OWASP ZAP
GitHub GraphQL current stargazer cohort, reconstructed from starredAt events and totalCount retrieved in one stable pagination walk. GitHub does not expose historical unstar events, so this is not an exact ledger of past star counts.
127 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Sn1per
GitHub GraphQL current stargazer cohort, reconstructed from starredAt events and totalCount retrieved in one stable pagination walk. GitHub does not expose historical unstar events, so this is not an exact ledger of past star counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Nikto
GitHub GraphQL current stargazer cohort, reconstructed from starredAt events and totalCount retrieved in one stable pagination walk. GitHub does not expose historical unstar events, so this is not an exact ledger of past star counts.
119 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Wapiti
GitHub GraphQL current stargazer cohort, reconstructed from starredAt events and totalCount retrieved in one stable pagination walk. GitHub does not expose historical unstar events, so this is not an exact ledger of past star counts.
125 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Issues opened
Weekly total
Full metrics details
GitHub API observation. Historical values render only when the source provides a real observation for that day.
Rapidscan
GitHub API observation. Historical values render only when the source provides a real observation for that day.
131 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Nuclei
GitHub API observation. Historical values render only when the source provides a real observation for that day.
178 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OWASP ZAP
GitHub API observation. Historical values render only when the source provides a real observation for that day.
81 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Sn1per
GitHub API observation. Historical values render only when the source provides a real observation for that day.
144 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Nikto
GitHub API observation. Historical values render only when the source provides a real observation for that day.
81 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Wapiti
GitHub API observation. Historical values render only when the source provides a real observation for that day.
81 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Issues closed
Weekly total
Full metrics details
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
Rapidscan
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
131 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Nuclei
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
178 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OWASP ZAP
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
81 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Sn1per
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
144 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Nikto
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
81 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Wapiti
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
81 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Pull requests opened
Weekly total
Full metrics details
GitHub API observation. Historical values render only when the source provides a real observation for that day.
Rapidscan
GitHub API observation. Historical values render only when the source provides a real observation for that day.
131 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Nuclei
GitHub API observation. Historical values render only when the source provides a real observation for that day.
178 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OWASP ZAP
GitHub API observation. Historical values render only when the source provides a real observation for that day.
81 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Sn1per
GitHub API observation. Historical values render only when the source provides a real observation for that day.
144 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Nikto
GitHub API observation. Historical values render only when the source provides a real observation for that day.
81 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Wapiti
GitHub API observation. Historical values render only when the source provides a real observation for that day.
81 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Pull requests closed
Weekly total
Full metrics details
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
Rapidscan
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
131 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Nuclei
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
178 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OWASP ZAP
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
81 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Sn1per
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
144 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Nikto
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
81 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Wapiti
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
81 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Pull requests merged
Weekly total
Full metrics details
GitHub API observation. Historical values render only when the source provides a real observation for that day.
Rapidscan
GitHub API observation. Historical values render only when the source provides a real observation for that day.
131 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Nuclei
GitHub API observation. Historical values render only when the source provides a real observation for that day.
178 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OWASP ZAP
GitHub API observation. Historical values render only when the source provides a real observation for that day.
81 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Sn1per
GitHub API observation. Historical values render only when the source provides a real observation for that day.
144 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Nikto
GitHub API observation. Historical values render only when the source provides a real observation for that day.
81 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Wapiti
GitHub API observation. Historical values render only when the source provides a real observation for that day.
81 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Open/closed pull request ratio
Weekly average
Full metrics details
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
Rapidscan
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Nuclei
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OWASP ZAP
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
127 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Sn1per
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Nikto
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
119 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Wapiti
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
125 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Open/closed issues ratio
Weekly average
Full metrics details
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
Rapidscan
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Nuclei
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OWASP ZAP
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
127 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Sn1per
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Nikto
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
119 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Wapiti
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
125 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Releases
Weekly total
Full metrics details
GitHub release published_at events bucketed by UTC day; drafts are excluded.
Rapidscan
GitHub release published_at events bucketed by UTC day; drafts are excluded.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Nuclei
GitHub release published_at events bucketed by UTC day; drafts are excluded.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
OWASP ZAP
GitHub release published_at events bucketed by UTC day; drafts are excluded.
127 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Sn1per
GitHub release published_at events bucketed by UTC day; drafts are excluded.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Nikto
GitHub release published_at events bucketed by UTC day; drafts are excluded.
119 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Wapiti
GitHub release published_at events bucketed by UTC day; drafts are excluded.
125 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Hotness score
Weekly average
Full metrics details
Derived only from GitHub GraphQL starredAt events after daily star totals are reconciled.
Rapidscan
Derived only from GitHub GraphQL starredAt events after daily star totals are reconciled.
180 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.40 × Hot today + 0.40 × Hot week + 0.20 × Breakout.
- Same-day multiplier = stars 1d ÷ max(1, stars 7d ÷ 7)
- Weekly multiplier = stars 7d ÷ max(1, stars 30d ÷ 30 × 7)
- Fortnight multiplier = stars 14d ÷ max(1, stars 90d ÷ 90 × 14)
- Hot today = clamp(70 × log-scale(stars 1d, 1000) + 30 × breakout-scale(same-day, 4))
- Hot week = clamp(75 × log-scale(stars 7d, 5000) + 25 × breakout-scale(weekly, 3))
- Breakout = clamp(35 × breakout-scale(same-day, 4) + 40 × breakout-scale(weekly, 3) + 25 × breakout-scale(fortnight, 2.5))
| Date | Stars | Stars 1d | Stars 7d | Stars 14d | Stars 30d | Stars 90d | Same-day multiplier | Weekly multiplier | Fortnight multiplier | Hot today | Hot week | Breakout | Stored score |
|---|
Nuclei
Derived only from GitHub GraphQL starredAt events after daily star totals are reconciled.
180 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.40 × Hot today + 0.40 × Hot week + 0.20 × Breakout.
- Same-day multiplier = stars 1d ÷ max(1, stars 7d ÷ 7)
- Weekly multiplier = stars 7d ÷ max(1, stars 30d ÷ 30 × 7)
- Fortnight multiplier = stars 14d ÷ max(1, stars 90d ÷ 90 × 14)
- Hot today = clamp(70 × log-scale(stars 1d, 1000) + 30 × breakout-scale(same-day, 4))
- Hot week = clamp(75 × log-scale(stars 7d, 5000) + 25 × breakout-scale(weekly, 3))
- Breakout = clamp(35 × breakout-scale(same-day, 4) + 40 × breakout-scale(weekly, 3) + 25 × breakout-scale(fortnight, 2.5))
| Date | Stars | Stars 1d | Stars 7d | Stars 14d | Stars 30d | Stars 90d | Same-day multiplier | Weekly multiplier | Fortnight multiplier | Hot today | Hot week | Breakout | Stored score |
|---|
OWASP ZAP
Derived only from GitHub GraphQL starredAt events after daily star totals are reconciled.
127 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.40 × Hot today + 0.40 × Hot week + 0.20 × Breakout.
- Same-day multiplier = stars 1d ÷ max(1, stars 7d ÷ 7)
- Weekly multiplier = stars 7d ÷ max(1, stars 30d ÷ 30 × 7)
- Fortnight multiplier = stars 14d ÷ max(1, stars 90d ÷ 90 × 14)
- Hot today = clamp(70 × log-scale(stars 1d, 1000) + 30 × breakout-scale(same-day, 4))
- Hot week = clamp(75 × log-scale(stars 7d, 5000) + 25 × breakout-scale(weekly, 3))
- Breakout = clamp(35 × breakout-scale(same-day, 4) + 40 × breakout-scale(weekly, 3) + 25 × breakout-scale(fortnight, 2.5))
| Date | Stars | Stars 1d | Stars 7d | Stars 14d | Stars 30d | Stars 90d | Same-day multiplier | Weekly multiplier | Fortnight multiplier | Hot today | Hot week | Breakout | Stored score |
|---|
Sn1per
Derived only from GitHub GraphQL starredAt events after daily star totals are reconciled.
180 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.40 × Hot today + 0.40 × Hot week + 0.20 × Breakout.
- Same-day multiplier = stars 1d ÷ max(1, stars 7d ÷ 7)
- Weekly multiplier = stars 7d ÷ max(1, stars 30d ÷ 30 × 7)
- Fortnight multiplier = stars 14d ÷ max(1, stars 90d ÷ 90 × 14)
- Hot today = clamp(70 × log-scale(stars 1d, 1000) + 30 × breakout-scale(same-day, 4))
- Hot week = clamp(75 × log-scale(stars 7d, 5000) + 25 × breakout-scale(weekly, 3))
- Breakout = clamp(35 × breakout-scale(same-day, 4) + 40 × breakout-scale(weekly, 3) + 25 × breakout-scale(fortnight, 2.5))
| Date | Stars | Stars 1d | Stars 7d | Stars 14d | Stars 30d | Stars 90d | Same-day multiplier | Weekly multiplier | Fortnight multiplier | Hot today | Hot week | Breakout | Stored score |
|---|
Nikto
Derived only from GitHub GraphQL starredAt events after daily star totals are reconciled.
119 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.40 × Hot today + 0.40 × Hot week + 0.20 × Breakout.
- Same-day multiplier = stars 1d ÷ max(1, stars 7d ÷ 7)
- Weekly multiplier = stars 7d ÷ max(1, stars 30d ÷ 30 × 7)
- Fortnight multiplier = stars 14d ÷ max(1, stars 90d ÷ 90 × 14)
- Hot today = clamp(70 × log-scale(stars 1d, 1000) + 30 × breakout-scale(same-day, 4))
- Hot week = clamp(75 × log-scale(stars 7d, 5000) + 25 × breakout-scale(weekly, 3))
- Breakout = clamp(35 × breakout-scale(same-day, 4) + 40 × breakout-scale(weekly, 3) + 25 × breakout-scale(fortnight, 2.5))
| Date | Stars | Stars 1d | Stars 7d | Stars 14d | Stars 30d | Stars 90d | Same-day multiplier | Weekly multiplier | Fortnight multiplier | Hot today | Hot week | Breakout | Stored score |
|---|
Wapiti
Derived only from GitHub GraphQL starredAt events after daily star totals are reconciled.
125 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.40 × Hot today + 0.40 × Hot week + 0.20 × Breakout.
- Same-day multiplier = stars 1d ÷ max(1, stars 7d ÷ 7)
- Weekly multiplier = stars 7d ÷ max(1, stars 30d ÷ 30 × 7)
- Fortnight multiplier = stars 14d ÷ max(1, stars 90d ÷ 90 × 14)
- Hot today = clamp(70 × log-scale(stars 1d, 1000) + 30 × breakout-scale(same-day, 4))
- Hot week = clamp(75 × log-scale(stars 7d, 5000) + 25 × breakout-scale(weekly, 3))
- Breakout = clamp(35 × breakout-scale(same-day, 4) + 40 × breakout-scale(weekly, 3) + 25 × breakout-scale(fortnight, 2.5))
| Date | Stars | Stars 1d | Stars 7d | Stars 14d | Stars 30d | Stars 90d | Same-day multiplier | Weekly multiplier | Fortnight multiplier | Hot today | Hot week | Breakout | Stored score |
|---|
Reliability score
Weekly average
Full metrics details
Derived from the displayed continuity, closure, shipping, liveness, and support-burden components.
Rapidscan
Derived from the displayed continuity, closure, shipping, liveness, and support-burden components.
180 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.30 × Continuity + 0.30 × Closure + 0.20 × Shipping + 0.10 × Liveness + 0.10 × Support burden.
- Continuity = 35% active ratio 90d + 20% active ratio 30d + 15% PR efficiency 90d + 10% PR efficiency 30d + 10% liveness + 10% observed-history coverage
- Closure = 55% PR merge efficiency 90d + 45% issue close efficiency 90d
- Shipping = 100 × (20% × release ratio 30d + 30% × release ratio 90d + 50% × release ratio 180d); ratios are releases ÷ 2, 6, and 12, capped at 1
- Support burden = 100 − 2 × open issues per 1,000 stars
- Liveness = 100 × exp(−pushed days ago ÷ 120)
Stars, issues, pull requests, and releases are daily observations. Pushed-days and license are repository snapshot-derived inputs and are not independent historical GitHub events.
| Date | Issues opened | Issues closed | PRs opened | PRs merged | Releases | Stars | Open issues | Pushed days ago | Continuity | Closure | Shipping | Liveness | Support burden | License | Observed days | Missing days | Needs healing | Stored score |
|---|
Nuclei
Derived from the displayed continuity, closure, shipping, liveness, and support-burden components.
180 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.30 × Continuity + 0.30 × Closure + 0.20 × Shipping + 0.10 × Liveness + 0.10 × Support burden.
- Continuity = 35% active ratio 90d + 20% active ratio 30d + 15% PR efficiency 90d + 10% PR efficiency 30d + 10% liveness + 10% observed-history coverage
- Closure = 55% PR merge efficiency 90d + 45% issue close efficiency 90d
- Shipping = 100 × (20% × release ratio 30d + 30% × release ratio 90d + 50% × release ratio 180d); ratios are releases ÷ 2, 6, and 12, capped at 1
- Support burden = 100 − 2 × open issues per 1,000 stars
- Liveness = 100 × exp(−pushed days ago ÷ 120)
Stars, issues, pull requests, and releases are daily observations. Pushed-days and license are repository snapshot-derived inputs and are not independent historical GitHub events.
| Date | Issues opened | Issues closed | PRs opened | PRs merged | Releases | Stars | Open issues | Pushed days ago | Continuity | Closure | Shipping | Liveness | Support burden | License | Observed days | Missing days | Needs healing | Stored score |
|---|
OWASP ZAP
Derived from the displayed continuity, closure, shipping, liveness, and support-burden components.
127 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.30 × Continuity + 0.30 × Closure + 0.20 × Shipping + 0.10 × Liveness + 0.10 × Support burden.
- Continuity = 35% active ratio 90d + 20% active ratio 30d + 15% PR efficiency 90d + 10% PR efficiency 30d + 10% liveness + 10% observed-history coverage
- Closure = 55% PR merge efficiency 90d + 45% issue close efficiency 90d
- Shipping = 100 × (20% × release ratio 30d + 30% × release ratio 90d + 50% × release ratio 180d); ratios are releases ÷ 2, 6, and 12, capped at 1
- Support burden = 100 − 2 × open issues per 1,000 stars
- Liveness = 100 × exp(−pushed days ago ÷ 120)
Stars, issues, pull requests, and releases are daily observations. Pushed-days and license are repository snapshot-derived inputs and are not independent historical GitHub events.
| Date | Issues opened | Issues closed | PRs opened | PRs merged | Releases | Stars | Open issues | Pushed days ago | Continuity | Closure | Shipping | Liveness | Support burden | License | Observed days | Missing days | Needs healing | Stored score |
|---|
Sn1per
Derived from the displayed continuity, closure, shipping, liveness, and support-burden components.
180 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.30 × Continuity + 0.30 × Closure + 0.20 × Shipping + 0.10 × Liveness + 0.10 × Support burden.
- Continuity = 35% active ratio 90d + 20% active ratio 30d + 15% PR efficiency 90d + 10% PR efficiency 30d + 10% liveness + 10% observed-history coverage
- Closure = 55% PR merge efficiency 90d + 45% issue close efficiency 90d
- Shipping = 100 × (20% × release ratio 30d + 30% × release ratio 90d + 50% × release ratio 180d); ratios are releases ÷ 2, 6, and 12, capped at 1
- Support burden = 100 − 2 × open issues per 1,000 stars
- Liveness = 100 × exp(−pushed days ago ÷ 120)
Stars, issues, pull requests, and releases are daily observations. Pushed-days and license are repository snapshot-derived inputs and are not independent historical GitHub events.
| Date | Issues opened | Issues closed | PRs opened | PRs merged | Releases | Stars | Open issues | Pushed days ago | Continuity | Closure | Shipping | Liveness | Support burden | License | Observed days | Missing days | Needs healing | Stored score |
|---|
Nikto
Derived from the displayed continuity, closure, shipping, liveness, and support-burden components.
119 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.30 × Continuity + 0.30 × Closure + 0.20 × Shipping + 0.10 × Liveness + 0.10 × Support burden.
- Continuity = 35% active ratio 90d + 20% active ratio 30d + 15% PR efficiency 90d + 10% PR efficiency 30d + 10% liveness + 10% observed-history coverage
- Closure = 55% PR merge efficiency 90d + 45% issue close efficiency 90d
- Shipping = 100 × (20% × release ratio 30d + 30% × release ratio 90d + 50% × release ratio 180d); ratios are releases ÷ 2, 6, and 12, capped at 1
- Support burden = 100 − 2 × open issues per 1,000 stars
- Liveness = 100 × exp(−pushed days ago ÷ 120)
Stars, issues, pull requests, and releases are daily observations. Pushed-days and license are repository snapshot-derived inputs and are not independent historical GitHub events.
| Date | Issues opened | Issues closed | PRs opened | PRs merged | Releases | Stars | Open issues | Pushed days ago | Continuity | Closure | Shipping | Liveness | Support burden | License | Observed days | Missing days | Needs healing | Stored score |
|---|
Wapiti
Derived from the displayed continuity, closure, shipping, liveness, and support-burden components.
125 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.30 × Continuity + 0.30 × Closure + 0.20 × Shipping + 0.10 × Liveness + 0.10 × Support burden.
- Continuity = 35% active ratio 90d + 20% active ratio 30d + 15% PR efficiency 90d + 10% PR efficiency 30d + 10% liveness + 10% observed-history coverage
- Closure = 55% PR merge efficiency 90d + 45% issue close efficiency 90d
- Shipping = 100 × (20% × release ratio 30d + 30% × release ratio 90d + 50% × release ratio 180d); ratios are releases ÷ 2, 6, and 12, capped at 1
- Support burden = 100 − 2 × open issues per 1,000 stars
- Liveness = 100 × exp(−pushed days ago ÷ 120)
Stars, issues, pull requests, and releases are daily observations. Pushed-days and license are repository snapshot-derived inputs and are not independent historical GitHub events.
| Date | Issues opened | Issues closed | PRs opened | PRs merged | Releases | Stars | Open issues | Pushed days ago | Continuity | Closure | Shipping | Liveness | Support burden | License | Observed days | Missing days | Needs healing | Stored score |
|---|
The closest analogue is Sn1per, another orchestrator that chains recon and scanning tools into one workflow — it covers more ground (OSINT, brute forcing, workspace management) at the cost of being heavier to install and run. Nuclei takes a different approach: instead of wrapping other tools, it runs thousands of community-maintained YAML detection templates with its own fast engine, produces machine-readable output, and is actively maintained — it's what most teams now reach for in automated scanning. OWASP ZAP is a full DAST platform with an intercepting proxy, active scanner, and automation API, suited to deeper application testing than Rapidscan attempts. Nikto — which Rapidscan itself wraps — is worth running standalone when you only need web server misconfiguration checks. Wapiti, also wrapped by Rapidscan, is a self-contained black-box web scanner with its own fuzzing engine and report formats.
| Project | Repo | Hotness (~6mo) | PRs merged (~6mo) | Star growth (~6mo) |
|---|---|---|---|---|
| Rapidscan | https://github.com/skavngr/rapidscan | 4.47 | 0 | 129 |
| Nuclei | https://github.com/projectdiscovery/nuclei | 65.02 | 61 | 4877 |
| OWASP ZAP | https://github.com/zaproxy/zaproxy | 51.05 | 100 | 1136 |
| Sn1per | https://github.com/1N3/Sn1per | 51.90 | 3 | 1132 |
| Nikto | https://github.com/sullo/nikto | 68.53 | 3 | 795 |
| Wapiti | https://github.com/wapiti-scanner/wapiti | 71.22 | 71 | 288 |
The best overall alternative is Nuclei: it is actively maintained with frequent releases, backed by a large community template library, and emits structured output you can wire into automation — three things Rapidscan cannot offer.
Conclusion
If you're a student, CTF player, or developer running a first authorized security pass against your own staging server, use Rapidscan — one command gets you the output of twenty recon tools with a ranked fix list, and the official repo README covers everything you need. I would not use it for professional engagement reporting or CI, because the output is colored terminal text with no structured export. For learning what the standard recon toolbox actually does, it's one of the most readable entry points available.
Do not point ./rapidscan.py at any host you lack written authorization to test — the wrapped nmap and web fuzzing scans are loud, will trip intrusion detection systems immediately, and unauthorized scanning is a criminal offense in many jurisdictions. Do this first: stand up a deliberately vulnerable local target with docker run --rm -it -p 80:80 vulnerables/web-dvwa and run Rapidscan against 127.0.0.1.