A comprehensive web application discovery and asset tracking platform designed to help security professionals and organizations maintain visibility over their web application infrastructure at scale.
- Overview
- Features
- Demo
- Prerequisites
- Technology Stack
- Quick Start
- Docker Deployment
- Linux Deployment
- Usage
- LDAP Support
- Contributing
- Roadmap
- Support
- License
The OWASP Web Mapper Portal is a powerful web application that serves as the frontend interface for the OWASP Web Mapper Project. Built on Ruby on Rails, it provides an intuitive platform for discovering, mapping, and tracking web application assets across your infrastructure.
Key Benefits:
- 🔍 Automated Discovery: Systematically discover web applications and services
- 📊 Asset Tracking: Maintain comprehensive inventory of web assets
- 🎯 Scalable: Handle enterprise-level asset discovery operations
- 🔐 Security-Focused: Built with security best practices in mind
- 🌐 Enterprise-Ready: LDAP integration and role-based access control
To explore the full capabilities of the backend WMAP library, visit the WMAP gem repository.
- Web Asset Discovery: Automated scanning and discovery of web applications
- Domain Tracking: Comprehensive domain and subdomain enumeration
- Host Management: Track and manage discovered hosts and services
- Report Generation: Generate detailed reports on discovered assets
- Background Processing: Asynchronous task processing with Sidekiq
- User Management: Role-based access control with Devise authentication
- LDAP Integration: Enterprise single sign-on support
- RESTful API: JSON API endpoints for integration
Before installing WMAP Portal, ensure you have the following requirements:
- OS: Linux (Ubuntu 18.04+, CentOS 7+) or macOS 10.14+
- Memory: Minimum 4GB RAM (8GB+ recommended)
- Storage: At least 10GB free disk space
- Network: Internet connectivity for asset discovery
- Docker & Docker Compose (recommended) OR
- Ruby: 2.6+ with Bundler
- Database: MySQL 5.7+ or MariaDB 10.3+
- Redis: 5.0+ (for background job processing)
- Node.js: 14+ (for asset compilation)
WMAP Portal is built on modern, production-ready technologies:
- Ruby on Rails 5.x - Full-stack web application framework
- WMAP Gem - Core asset discovery and mapping engine
- Devise - Authentication and user session management
- devise_ldap_authenticatable - LDAP/AD integration
- Twitter Bootstrap - Responsive UI framework
- jQuery - JavaScript library for DOM manipulation
- CodeMirror - In-browser code editing component
- jsTree - Interactive tree component for hierarchical data
- Sidekiq - Efficient background job processing
- Redis - In-memory data store for job queues and caching
- MariaDB - Primary database (MySQL-compatible)
- Postfix - Email notification service
- Nginx - Web server and reverse proxy (in Docker setup)
Get WMAP Portal up and running in minutes:
# Clone the repository
git clone https://github.com/yangsec888/www_wmap.git
cd www_wmap
# Start all services
docker-compose up -d
# Access the application
open http://localhost# Clone and setup
git clone https://github.com/yangsec888/www_wmap.git
cd www_wmap
# Install dependencies
bundle install
yarn install # or npm install
# Setup database
rails db:create db:migrate db:seed
# Start the application
rails serverAccess the application at http://localhost:3000
Watch this comprehensive demonstration of the Web Mapper's asset discovery capabilities:
Experience the platform firsthand with our live demo instance:
🌐 Demo URL: www.wmap.cloud
👤 Demo Credentials:
- Username:
admin - Password:
admin123
Note: This is a shared demo environment. Please be respectful when testing features.
Docker provides a standardized development and deployment experience across different environments.
- Consistency: Identical development, testing, and production environments
- Portability: Deploy to any Docker-compatible infrastructure
- Isolation: Containerized services prevent dependency conflicts
- Scalability: Easy to scale individual services
The application runs as a multi-container setup:
wmap_web: Main Rails application serverwmap_db: MariaDB database serverwmap_redis: Redis for background job queuingwww_wmap_sidekiq_1: Background job processorwww_wmap_nginx_1: Reverse proxy and static file server
-
Clone and start services:
git clone https://github.com/yangsec888/www_wmap.git cd www_wmap docker-compose up -d -
Verify deployment:
docker-compose ps
Expected output:
Name State Ports ---------------------------------------- wmap_db Up 0.0.0.0:3306->3306/tcp wmap_redis Up 6379/tcp wmap_web Up 0.0.0.0:3000->3000/tcp www_wmap_nginx_1 Up 0.0.0.0:80->80/tcp www_wmap_sidekiq_1 Up 3000/tcp -
Access the application: Open your browser to
http://localhost
Check container status:
docker-compose psView service logs:
# All services
docker-compose logs
# Specific service
docker-compose logs wmap_webRestart services:
docker-compose restartClean restart:
docker-compose down
docker-compose up -dFor customization or development:
-
Modify the application code
-
Rebuild the web container:
docker build . -t yangsec888/www_wmap_web:latest -
Update docker-compose.yml if needed
-
Restart with new image:
docker-compose up -d --build
For native Linux deployment without Docker, detailed instructions are available in the Setup.md guide.
- Ubuntu 18.04+ or CentOS 7+
- Ruby 2.6+ with development headers
- MySQL/MariaDB server
- Redis server
- Node.js and Yarn
# Install system dependencies (Ubuntu)
sudo apt-get update
sudo apt-get install -y ruby ruby-dev build-essential mysql-server redis-server nodejs npm
# Install application
git clone https://github.com/yangsec888/www_wmap.git
cd www_wmap
bundle install
yarn install
# Configure database and start
rails db:setup
rails server-
Access the Portal
- Navigate to the application URL in your browser
- Log in with your credentials (or demo credentials for the test instance)
-
Initial Setup
- Click the "Start" button on the home page
- Follow the guided setup wizard
-
Asset Discovery
- Configure discovery parameters (target domains, IP ranges)
- Launch discovery scans
- Monitor progress in real-time
-
View Results
- Navigate to the "Discovery" menu tab
- Review discovered assets and services
- Generate reports and export data
- Dashboard: Overview of discovered assets and recent activity
- Domains: Manage and track domain assets
- Hosts: Detailed host information and services
- Reports: Generate comprehensive asset reports
- Settings: Configure discovery parameters and user preferences
WMAP Portal supports enterprise LDAP/Active Directory integration for single sign-on.
-
Enable LDAP authentication in your Rails environment
-
Configure LDAP settings in
config/ldap.yml:production: host: ldap.company.com port: 636 encryption: simple_tls base: ou=people,dc=company,dc=com uid: sAMAccountName bind_dn: CN=ldapuser,OU=Service Accounts,DC=company,DC=com password: your_ldap_password
-
Restart the application to apply changes
The integration uses devise_ldap_authenticatable for seamless enterprise authentication.
We welcome contributions to the OWASP Web Mapper Portal! Here's how to get involved:
- Fork the repository
- Create a feature branch:
git checkout -b feature/amazing-feature - Make your changes and add tests
- Run the test suite:
rails test - Commit your changes:
git commit -m 'Add amazing feature' - Push to your branch:
git push origin feature/amazing-feature - Create a Pull Request
- Follow Ruby style guidelines
- Write comprehensive tests
- Update documentation for new features
- Ensure all CI checks pass
- Use GitHub Issues for bug reports
- Provide detailed reproduction steps
- Include system information and error logs
- ✅ Docker containerization - Complete
- ✅ LDAP integration - Complete
- ✅ RESTful API - Complete
- 🔄 Integration & deployment tests - In Progress
- 🔄 Performance optimization - In Progress
- 📅 Rails 6.x upgrade - Planned
- 📅 Enhanced reporting - Planned
- 📅 API rate limiting - Planned
- 📅 Advanced asset correlation - Planned
- Cloud-native deployment options (Kubernetes, AWS ECS)
- Machine learning for asset classification
- Integration with popular security tools
- Multi-tenancy support
- GitHub Issues: Report bugs and request features
- OWASP Project Page: Official project information
- Documentation: Setup guides and tutorials
For enterprise support and custom development, please contact the project maintainers.
This project is licensed under the MIT License - see the LICENSE file for details.
⭐ Star this repository if you find it useful! ⭐