Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Introduction

DARWIS Taka is a fast, modular web vulnerability scanner built in Rust. It combines a rule-based detection engine with optional AI-assisted verification, an intelligent crawler, and a web UI for managing scans and reviewing results.

This documentation covers the self-hosted Docker deployment of DARWIS Taka, maintained in the taka-docker repository. It is the recommended way to run Taka on your own infrastructure.

Docker Hub: cysecurity/darwis-taka

What is Taka?

Taka discovers web-application vulnerabilities using a YAML-based rule engine. Detection rules span common OWASP Top 10 categories, weighted scoring and differential detection keep false positives low, and safe defaults (circuit breakers and per-host rate limiting) are on out of the box.

Key Features

  • Broad vulnerability coverage: SQL injection, XSS, SSRF, LFI, command injection, XXE, SSTI, open redirects, CORS and CSRF issues, insecure headers and cookies, cache poisoning, request smuggling, GraphQL flaws, and more.
  • AI-assisted verification: an LLM reviews the evidence behind each finding to cut false positives, and can optionally suggest additional HTTP probes to confirm a vulnerability. Anthropic and OpenAI are supported from the Web UI.
  • Intelligent crawler: scope-aware crawling with robots.txt and sitemap support; optional headless Chromium crawl for JavaScript-rendered applications.
  • Reports: downloadable HTML and JSON reports for every scan.
  • Web UI: run and monitor scans, configure AI verification, inspect raw HTTP traffic, and browse findings from a browser.

Warning

Taka serves plain HTTP and has no built-in authentication. Do not expose it to the public internet. Bind it to a private network. For remote access, place it behind a proxy that provides TLS and authentication.

Getting Started

  • Quick Start: install and run your first scan in under five minutes
  • Running a Scan: walk through the Web UI
  • AI Verification: connect an LLM to validate findings
  • Configuration: environment variables and Compose overrides (for later, if you need to tweak ports, timezone, etc.)