andresriancho/w3af ? reverse-engineered prompt

Build me a web security scanner for testing websites and web apps.

I want it to crawl a site, run common checks for things like cross site scripting, SQL injection, and other dangerous input handling issues, then show me clear results with what was found and how serious it is. It should be useful for both developers and security testers, so please make it easy to run from a command line, and also include a simple GUI and an API if that fits the project.

Keep it focused on real vulnerability discovery, not just a toy demo. I’d like sensible defaults, the ability to run scans against a target URL, save results, and review findings afterward. If there are existing docs or current best practices that help with how this kind of scanner should behave, look them up online and follow them.