# stark0de/nginxpwner

Nginxpwner is a simple tool to look for common Nginx misconfigurations and vulnerabilities.

Repository: https://github.com/stark0de/nginxpwner
Canonical: https://ross.abutalabs.com/products/nginxpwner
Language: Python
License: Apache-2.0
License Family: permissive
Archived: true
Last push: 2024-03-04T21:16:15+00:00

## Health v2 (maintenance only)
Score: 10/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 1975, "days_push": 912, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, archived
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1599, forks 149 (observed 2026-08-28T04:05:09.449907+00:00)

## What it is
Nginxpwner is a Python command-line tool that scans Nginx servers for common misconfigurations and known vulnerabilities, such as CRLF injection, path traversal, off-by-slash issues, and CVE-2017-7529. It integrates with tools like searchsploit, gobuster, and Kyubi to enumerate and exploit Nginx-specific weaknesses.

## Use cases
- audit nginx servers for misconfigurations
- find nginx vulnerabilities during a pentest
- check if nginx version is outdated and exploitable
- test for CRLF injection in nginx redirects
- detect path traversal via misconfigured alias
- test 401/403 bypass with X-Accel-Redirect
- check for CVE-2017-7529 range filter overflow

## When to choose
- you are pentesting a site known or suspected to run Nginx
- you want an automated check for common nginx.conf mistakes
- you run Kali/Burp workflows and want a targeted Nginx scanner

## When to avoid
- the target does not run Nginx or a Nginx-based stack
- you need web cache poisoning, request smuggling, or general web app scanning
- you need a passive or production-safe monitoring tool rather than an active scanner

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security, penetration-testing, vulnerability-scanning, http-client, cli
- domain: security, penetration-testing, web-development, developer-tools
- platform: python, cli
- tags: nginx, misconfiguration-scanner, offensive-security, burp-suite, web-security, cve-scanning, command-line, linux, docker

## Member repositories
- stark0de/nginxpwner (main) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:09.449907+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:53:14.674148+00:00, confidence not recorded.
  - readme: https://github.com/stark0de/nginxpwner (fetched 2026-08-28T04:05:09.449907+00:00, sha 24041c458c5d)
- Data as of 2026-08-30T08:39:29.467469+00:00.