Web application security requires proactive auditing to detect misconfigured server headers, information leaks, and common software weaknesses before deployment. Hirudo Security Scanner provides Ubuntu administrators with an open-source, automated command-line scanner designed to audit local web applications and verify server configurations. This tutorial walks you through preparing Ubuntu 24.04 or 22.04 LTS, setting up an isolated Python environment, installing Hirudo, and executing baseline defensive security assessments.
Understanding Hirudo Security Scanner
Automated vulnerability scanners serve as an initial line of defense in modern server administration. Developed as a Python-based utility, Hirudo Security Scanner on GitHub automates the process of checking web servers for common operational oversights. Unlike heavy enterprise suites that demand gigabytes of memory and complex database configurations, Hirudo operates as a lightweight CLI utility tailored for rapid assessments and continuous deployment pipelines.
The scanner focuses on core security vectors that frequently leave servers exposed to automated discovery. These checks include inspecting HTTP response headers for missing protective policies, identifying publicly exposed configuration artifacts such as dot-files and backup directories, detecting outdated web server banners, and verifying that administrative entry points are adequately protected. For system administrators managing Ubuntu servers hosting Nginx, Apache, or Python WSGI applications, running these checks locally helps identify misconfigurations prior to internet-facing deployments.
Comparing Web Auditing Tools on Ubuntu
Choosing the right scanning tool on Ubuntu depends on resource constraints, target environments, and operational goals. The table below illustrates how Hirudo positions itself alongside traditional CLI vulnerability scanners available in the Linux ecosystem:
| Feature / Metric | Hirudo Scanner | Nikto | OWASP ZAP (CLI) |
|---|---|---|---|
| Core Runtime | Python 3 | Perl | Java (JVM) |
| Memory Footprint | Very Low (< 60 MB) | Low (~ 100 MB) | High (> 512 MB) |
| Ubuntu Delivery | Git Source + Virtualenv | Ubuntu Universe APT | Snap / Flatpak / Archive |
| Primary Focus | Headers & File Exposure | Legacy Server CGI & Flaws | Full Dynamic App Testing |
System Prerequisites and Environment Preparation
Hirudo requires a modern Python runtime and Git to fetch the source repository. Recent Ubuntu releases, including Ubuntu 24.04 LTS (Noble Numbat) and Ubuntu 22.04 LTS (Jammy Jellyfish), enforce PEP 668. Under this standard, running direct pip installations globally is disabled to prevent conflicts with native APT-managed packages. Setting up an isolated Python virtual environment ensures system stability and clean dependency isolation.
Open your terminal and update the local package index, then install the required base tools:
sudo apt update && sudo apt install -y git python3 python3-pip python3-venvVerify that your Python version meets modern specifications by checking the installed version string:
python3 --versionStep-by-Step Installation on Ubuntu
With the prerequisite packages active, clone the source repository from GitHub into a local directory under your user account. We recommend storing custom utilities within an organized directory path such as ~/tools or /opt for multi-user systems.
1. Clone the Source Code
Clone the repository using Git and navigate into the newly created folder:
git clone https://github.com/bagusuns/hirudo-scanner.git
cd hirudo-scanner2. Create an Isolated Virtual Environment
Generate an isolated Python virtual environment to store Hirudo and its external package dependencies without altering system libraries:
python3 -m venv venv
source venv/bin/activateYour shell prompt will now reflect the active virtual environment by displaying a (venv) prefix.
3. Install Python Dependencies
Use the localized pip binary to install all third-party modules specified in the repository manifest:
pip install --upgrade pip
pip install -r requirements.txtIf the repository contains an executable entry point, confirm the tool launches correctly by requesting its help menu:
python3 hirudo.py --help~/.local/bin pointing to the virtual environment's Python interpreter, allowing you to invoke Hirudo from anywhere on your Ubuntu system without manually running the activation script each session.Executing Defensive Audits on Local Infrastructure
Hirudo is built for defensive self-assessment. When deploying new web applications on an Ubuntu server, executing an automated baseline audit against your local staging address verifies that your web server configuration complies with security standards before traffic reaches production.
To execute a scan against a locally hosted test instance running on standard development ports, pass the target URL to the main execution script:
python3 hirudo.py -u http://127.0.0.1:8080The scanner evaluates the target by sending specialized HTTP probes. It catalogs response statuses, parses headers for security attributes, and tests for known directory traversal risks or exposed administrative panels. For comprehensive logs, redirect the standard output into a text file for review:
python3 hirudo.py -u http://127.0.0.1:8080 > audit_report_$(date +%F).txtRemediating Findings on Ubuntu Web Servers
A scanner is only as useful as the defensive actions taken from its findings. When Hirudo flags missing security headers on an Ubuntu server hosting Nginx, administrators can immediately resolve the issue by appending defensive directives to their server block.
Edit your site configuration file, typically found at /etc/nginx/sites-available/default, and add the missing security headers within the server block:
# Add protective HTTP response headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self';" always;
# Prevent server version leakage
server_tokens off;Test the Nginx configuration syntax and reload the service to apply the fixes on Ubuntu:
sudo nginx -t
sudo systemctl reload nginxAfter applying these hardening parameters, re-run Hirudo against the service. The scanner should confirm that the previously flagged header omissions are resolved, demonstrating a hardened server posture.
Maintaining and Updating the Scanner
Because web standards and vulnerability patterns change over time, keep your local Hirudo installation updated with upstream commits. Navigate into the cloned directory, pull recent changes, and refresh the virtual environment dependencies:
cd ~/hirudo-scanner
git pull origin main
source venv/bin/activate
pip install -r requirements.txt --upgradeIntegrating regular security assessments into your Ubuntu system maintenance routine ensures that configuration drift does not inadvertently expose your web applications to preventable security risks.