What we test
Every scan runs the same deterministic engine first — no randomness, no guessing. Baseline (8 tests) gives fast feedback on every push; Deep (430+ checks) runs the full pack on schedule or before release. On top of that: AI-assisted triage, autonomous hacker mode, and a code questionnaire (ask mode, SaaS+) for what no scanner can see from the outside.
430+ checks in total: 149 automated scan tests + 280+ hardening review questions.
Baseline — 8 tests on every run
Broken authentication
Checks whether an endpoint that requires authentication works without a token or with a garbage token.
How: Replays the request with no Authorization header and with a random token; 2xx means the auth check is missing or broken.
Example: GET /users/me returns 200 without any token → anyone can read the profile.
BOLA / IDOR
Checks whether swapping a resource ID gives access to somebody else’s data (broken object-level authorization).
How: Heuristics over ID-like parameters: tries other/typical identifiers and compares responses for data leakage.
Example: GET /orders/124 returns another customer’s order → critical data leak.
Mass assignment
Checks whether the server silently accepts extra fields that were never documented.
How: Adds extra fields to the payload and looks for their echo/persistence in the response.
Example: POST /users accepts {"is_admin": true} → privilege escalation.
Injection (SQL / NoSQL / JSON)
Probes query parameters and body fields for injection flaws.
How: Sends classic SQL/NoSQL/JSON payloads and matches error signatures and timing anomalies in responses.
Example: ' OR '1'='1 in ?search= triggers a SQL error → injectable parameter.
Rate limiting
Checks whether the API throttles repeated requests.
How: Fires a burst of identical requests at one endpoint; no 429 means brute-force and scraping are wide open.
Example: 12 rapid POST /login with no 429 → credential stuffing possible.
CORS misconfiguration
Checks whether the API reflects arbitrary Origins with credentials allowed.
How: Sends malicious Origin headers and inspects Access-Control-Allow-Origin / Allow-Credentials.
Example: Origin: https://evil.example reflected with credentials → session theft via browser.
Security headers
Checks for missing baseline HTTP security headers.
How: Reads response headers (nosniff, frame options, HSTS, CSP, referrer policy) on every target.
Example: Missing X-Content-Type-Options and frame protections → clickjacking / MIME-sniffing risk.
Sensitive parameters
Finds secrets, tokens and passwords passed in the URL query string.
How: Scans query names for secret-like keys (token, key, password, secret) that leak into logs and browser history.
Example: GET /reset?token=abc123 in the URL → secret ends up in proxy logs.
Deep — 141 more tests for scheduled and release scans
Shadow API discovery
Finds undocumented endpoints that answer behind your back (admin, debug, old versions, backups).
How: Probes common variants of documented paths plus global paths (/health, /swagger.json, /actuator); 2xx/3xx on an undocumented path is a finding.
Example: /admin/users responds 200 but is nowhere in the spec → hidden attack surface.
JWT weaknesses
Attacks the token itself: alg=none, unverified signature, weak HMAC secret, missing expiry, key-confusion.
How: Baseline first (valid token works, garbage rejected — otherwise it is plain broken auth); then replays mutated tokens on secured endpoints only.
Example: Token with alg=none accepted → anyone can forge sessions.
HTTP method tampering
Checks whether access control is wired only to the documented method.
How: Tries the same path with other verbs (GET→POST/PUT/DELETE); 2xx with content on an undeclared method is a bypass.
Example: GET /admin → 403, but POST /admin → 200 → authorization bypass.
Tech fingerprint + version freshness
Identifies the server stack from headers and error pages and flags end-of-life software.
How: Collects Server / X-Powered-By headers from GET / and a deliberate 404, matched against a built-in version table; EOL is high severity.
Example: Server: PHP/7.4 (end-of-life) → unpatched CVEs likely.
Mass assignment v2 (read-only escalation)
Goes one step further than v1: proves privilege escalation via read-only fields.
How: Sends canary probes, ignores schema-declared fields, and requires an exact value echo; only permission-ranked fields (role, is_admin) raise high.
Example: {"role":"admin"} echoed back exactly → confirmed escalation.
Information disclosure checklist
Sweeps known-sensitive paths (.git, .env, debug consoles, actuators, metrics).
How: Content counts, not status: a finding needs a real marker in the body; empty bodies and login pages stay silent. Plus stack-trace detection on a missing path.
Example: /.git/config leaks repository internals → high.
Rate-limit v2 (differential + bypass)
Asks the scarier questions: is login throttled when the rest is? Can the limit be bypassed with a spoofed IP header?
How: Compares an auth endpoint against a neutral one, then replays with X-Forwarded-For rotation under control conditions.
Example: Unlimited login next to a limited API → credential stuffing; XFF rotation dodges 429 → high.
Old API versions
Checks whether retired /v1/ endpoints still live with weaker protection.
How: For documented /vN/ paths tries /v(N-1)/ and /v1/ without auth; old 2xx vs new 401/403 is a bypass, old 2xx vs new 404 is a zombie endpoint.
Example: /v1/orders returns 200 while /v2/orders demands auth → old version bypasses access control.
GraphQL probing
Detects GraphQL endpoints, introspection left on in production, and missing query-cost limits.
How: Tries typical /graphql paths, sends an introspection query (schema dump = medium), then an expensive nested query (success = no cost limits).
Example: Introspection returns the full schema in prod → attacker gets the whole map for free.
OAuth2 / OIDC redirect check
Tests the client’s OAuth login for open-redirect on redirect_uri (stolen codes/tokens).
How: Reads /.well-known/openid-configuration, then probes authorize with an evil redirect_uri without following redirects; 302 to a foreign host is high. Foreign identity providers are never attacked.
Example: authorize?redirect_uri=https://evil.example → 302 there → code theft.
CORS + CSRF chain
Attacks the allowlist logic itself, not just simple reflection.
How: Probes Origin: null, lookalike domains ({host}.evil.example), and preflight on write methods with credentials.
Example: null origin trusted with credentials → sandboxed-iframe session theft.
SSRF canary
Checks whether the API fetches attacker-supplied URLs (server-side request forgery) — safely, against our own listener.
How: Plants our canary URL into URL-shaped fields (webhook, avatar, import); a callback to our infrastructure proves SSRF. Nobody else is ever targeted.
Example: POST /webhooks with our URL → server calls back → confirmed SSRF.
Session cookie flags
Checks that session cookies on login endpoints carry Secure, HttpOnly and a strict SameSite policy.
How: Reads Set-Cookie on login responses; one finding per missing flag. Only Set-Cookie responses count — no cookie, no finding.
Example: POST /login sets session without HttpOnly → stolen via XSS.
Predictable ID enumeration
Checks whether sequential resource IDs can be scraped one by one (user enumeration).
How: Requests IDs 1/2/3 on templated paths; three distinct data sets mean enumerable IDs. Uniform 404s stay silent. Runs once per scan.
Example: /users/1, /users/2, /users/3 all return profiles → harvestable user base.
Response-time oracle
Checks whether response time on login depends on the secret (timing side-channel).
How: Alternates short/long passwords (4 rounds); non-overlapping timing bands with >200 ms gap raise a low-severity lead. Runs once per scan.
Example: Long passwords consistently 300 ms slower → timing oracle worth fixing.
Path traversal / LFI
Checks whether file parameters reach the server filesystem (local file inclusion).
How: Sends ../ and encoded variants; the /etc/passwd marker in the body is a high finding. Max 2 probes per target.
Example: ?file=../../../../etc/passwd returns root:x:0: → server files readable.
Open redirect
Checks redirect parameters for open-redirect to attacker hosts (phishing / token theft).
How: Plants https://evil.example in next/url/redirect-style params without following redirects; a 3xx Location there is high.
Example: /goto?next=https://evil.example → 302 there → login-code theft.
HTTP TRACE / TRACK
Checks whether the dangerous TRACE/TRACK methods are enabled (cross-site tracing).
How: Sends OPTIONS once per scan; an Allow header listing TRACE/TRACK raises a low finding.
Example: Allow: GET, POST, TRACE, TRACK → cookies readable via XST.
Backup / editor files
Checks whether backup copies (.bak, ~) of documented paths are served with source code.
How: Tries .bak and ~ suffixes; a 200 with source markers is a low finding. Capped at 8 requests per scan.
Example: /config.js.bak serves server source → secrets and logic leaked.
Default credentials
Checks whether factory logins (admin:admin, admin:password) still work.
How: Tries two default pairs on the login endpoint only, once per scan; a token-granting login is high. Never touches real user accounts.
Example: POST /session admin:admin → session token → full takeover.
Null-byte / unicode tricks
Checks whether null-byte and overlong-unicode encodings bypass input filters.
How: Compares a baseline probe against %00 and %c0%ae payloads; filesystem markers or a 404→200 flip raise a finding.
Example: ..%c0%ae/etc/passwd returns root:x:0: → filter bypass.
OAuth code reuse
Checks whether an authorization code can be exchanged twice (must be single-use).
How: Sends the same probe code twice to the token endpoint; two token grants mean reusable codes.
Example: Same code → two access tokens → intercepted code never dies.
OTP reuse
Checks whether a one-time code survives its first verification (must burn after use).
How: Submits the same code to verify/OTP endpoints twice; two successes mean reusable OTP. Burned codes stay silent.
Example: Same 000000 verifies twice → intercepted SMS code reusable.
Signed-cookie forgery
Checks whether the session cookie is client-controlled data that can be rewritten to admin.
How: Logs in, decodes a base64/JSON cookie, forges role→admin and replays it on gated paths; admin markers only with the forged cookie mean unsigned trust. Opaque tokens stay silent. Runs once per scan.
Example: Forged session cookie → /profile returns admin:true → full takeover.
Unsafe deserialization
Checks whether request data reaches a server-side deserializer (pickle / Java / PHP).
How: Sends magic bytes (pickle, Java STREAM_MAGIC, PHP serialized) into body fields; deserializer error markers are high. Clean 400s stay silent.
Example: Magic bytes → pickle.UnpicklingError → remote-code-execution path.
Blind SQL injection (time-based)
Detects SQL injection by response-time difference, not only error markers.
How: Compares a baseline GET with a SLEEP(2) payload on the same parameter; Δt over 1.5s without error means blind injection. Run-once, 2 requests.
Example: q=1' AND SLEEP(2)-- - → +2.0s delay → high.
OS / LDAP command markers
Checks whether input reaches a shell or directory server (`;id`, `|whoami`, LDAP filters).
How: Sends command separators and an LDAP filter into query params; uid=/gid= output or LDAP exceptions (without mere reflection) mean execution. Clean echoes stay silent.
Example: host=|whoami → uid=0(root) in body → high.
HTTP method-override bypass
Tests whether X-HTTP-Method-Override reroutes the request past verb checks.
How: POSTs a baseline, then repeats with X-HTTP-Method-Override: DELETE; error→success flip with a different body means the override is honored.
Example: POST → 405, same POST + override → 200 deleted:true → medium.
Nested mass assignment
Tests deep object binders with {"user":{"role":"admin"}} payloads.
How: POSTs a baseline and a nested role=admin body; admin markers only in the nested reply mean the binder has no recursive allowlist.
Example: Nested role=admin → "role":"admin" reflected → medium.
Actuator secret values
Reads /actuator/env, /actuator/configprops and /metrics for exposed secret values.
How: Fetches each path once per scan; a secret keyword plus a quoted value (not just a 200 status) means the actuator leaks credentials.
Example: /actuator/env → "db.password" with value → high.
PII in error pages
Checks whether 4xx bodies echo personal data (emails, IBAN, PESEL with context).
How: Requests one nonexistent path per scan and regexes the error body; image/static extensions excluded. Generic errors stay silent.
Example: 404 Traceback → [email protected] → medium (GDPR).
Secrets in sourcemaps
Crawls public *.map bundles for embedded API keys and tokens.
How: Fetches common map paths once per scan and runs the secret-pattern index over sourcesContent; maps without hits stay silent.
Example: main.js.map → AKIA… → high source leak.
Auth-to-RCE takeover chain
Replays the oracle-forge-escalate-deserialize kill-chain end-to-end: oracle → forge → escalate → deserialize in one run.
How: Logs in, forges the session cookie to admin, confirms the admin panel trusts it, then sends pickle magic bytes to the admin import as admin; every link must confirm or it stays silent. 3 requests, run-once.
Example: Forged cookie → /admin trusts it → /admin/import unpickles → critical full-chain takeover.
Server version → CVE lookup
Maps the fingerprinted server version to known CVEs from a local NVD cache (refreshed nightly).
How: Reads Server / X-Powered-By once per scan and matches release lines against the offline index; severity follows the CVSS score. Unknown stacks stay silent.
Example: Server: nginx/1.18.0 → CVE-2021-23017 (CVSS 7.7, high).
Bundled-library SCA
Finds outdated JavaScript libraries in your bundles and maps them to CVEs (OSV advisories).
How: Collects same-origin scripts (max 4 requests per scan), extracts versions (jQuery, lodash, React, Vue…) and looks each up in the offline index. Modern libs stay silent.
Example: jQuery 3.4.1 in bundle → CVE-2020-11022/11023 (XSS).
Batch IDOR
Checks whether bulk endpoints return other people’s objects without per-record authorization.
How: Sends ids [1,2,3] to batch fields and compares owner keys (user_id, email…); objects of 2+ owners in one response are a finding. Single-owner batches stay silent.
Example: POST /batch/orders → alice, bob and carol in one call → per-record auth missing.
SMS toll-fraud guard
Checks whether messaging endpoints accept unroutable numbers (missing premium-range guard).
How: Sends one fictional +1555 number that can never route or cost money; a “sent/queued” verdict means no toll-fraud guard. Rejected numbers stay silent.
Example: +15550001111 reported as sent → premium numbers likely billed too.
Secrets in responses
Scans response bodies for leaked keys, tokens and card numbers (AWS, GitHub, Stripe, Slack, PEM, PAN).
How: Deterministic patterns over up to 5 responses per scan; card numbers need a Luhn check plus nearby context, samples are masked to last 4 chars. Clean pages stay silent.
Example: ghp_… token in /page → high; rotate and purge.
security.txt disclosure policy
Checks whether the site publishes a security.txt contact for researchers.
How: Reads /.well-known/security.txt (fallback /security.txt), max 2 requests per scan; a file without Contact counts as missing. Published files stay silent.
Example: Both paths 404 → low; add Contact + disclosure policy.
DMARC enforcement
Checks whether the domain enforces DMARC (anti-spoofing for exact-from phishing).
How: Passive DNS TXT lookup for _dmarc (zero HTTP requests); missing record is medium, a policy without reject is low, p=reject stays silent.
Example: No _dmarc record → attackers can spoof your domain.
Certificate-transparency recon
Lists subdomains exposed in public Certificate Transparency logs.
How: One request to crt.sh per scan; discovered names (dev, staging…) are reported as attack-surface inventory. Offline or empty stays silent.
Example: dev.example.com in CT log → review or decommission.
Common-subdomain enumeration
Checks whether guessable names (www, api, dev, staging, admin…) resolve publicly.
How: DNS A lookups only (zero HTTP requests, 10-name wordlist); resolving names are reported as inventory. Nothing resolving stays silent.
Example: staging.example.com resolves → is it protected?
WAF/CDN fingerprint
Identifies the edge stack (Cloudflare, CloudFront, Akamai…) from passive markers.
How: One GET / per scan, header and cookie markers only (cf-ray, x-amz-cf-id…); informational, feeds the WAF-ruleset question in ask mode.
Example: Edge: Cloudflare → confirm SSRF rules in WAF.
API lifecycle (Sunset) headers
Checks whether versioned endpoints (/v1/…) announce deprecation.
How: Only versioned GET paths are probed; missing Sunset/Deprecation headers are informational. Announced lifecycles stay silent.
Example: /v1/orders without Sunset → stale version risk.
Secrets in OpenAPI examples
Scans published OpenAPI/Swagger specs for real-looking secrets in example values.
How: Reads openapi.json / swagger.json / api-docs (max 3 requests), matches key/token patterns; clean specs stay silent.
Example: "example": "ghp_…" in spec → medium; developers copy it.
JWT algorithm confusion
Checks whether the verifier pins one algorithm (RS→HS confusion, alg=none with signature, missing aud).
How: On endpoints with a working Bearer JWT: replays the RS/EC signature under an HS256 header, an alg=none token with signature bytes, and flags a missing aud claim. Clean verifiers only get the low aud note.
Example: RS256 signature accepted as HS256 → forge tokens with the public key.
Session fixation
Checks whether the session ID is rotated on login.
How: Takes a pre-login sid cookie, logs in with it attached, and compares: the same sid after login is medium. Rotated or rejected logins stay silent. Max 2 requests per scan.
Example: sid=abc before and after /login → attacker-planted sessions survive.
Refresh-token validation
Checks whether the refresh endpoint mints tokens for garbage input.
How: Sends one invalid refresh_token to refresh endpoints; an access_token in a 200 response is high. Reuse-of-valid-token needs a real token → ask fallback.
Example: Garbage refresh → 200 with access_token → validation broken.
PKCE downgrade
Checks whether the authorize endpoint issues codes without PKCE.
How: Reads openid-configuration, then requests authorize with no code_challenge (no redirects followed); a code in Location is medium. No discovery stays silent.
Example: 302 with ?code= and no challenge → interception risk for public clients.
Logout replay
Checks whether POST /logout actually invalidates the token.
How: Baselines a working token on /me, calls logout, replays: still-200 is medium. Works with the scan-provided token only (your own). Max 3 requests.
Example: Token alive after logout → stolen tokens stay usable.
Host-header poisoning
Checks whether reset/verify links are built from the attacker-supplied Host.
How: Sends Host: evil.com and X-Forwarded-Host to login/reset endpoints; the evil host inside a reset/verify/token link is high. Max 2 requests per scan.
Example: Reset mail links to evil.com → account takeover.
Magic-header auth bypass
Checks whether proxy-trust headers (X-Forwarded-For, X-Original-URL…) skip authorization.
How: Baselines a working token vs anonymous 401, then replays anonymously with 4 magic headers; a 200 is high. Public endpoints stay silent. Max 6 requests.
Example: X-Original-URL as anonymous → 200 → gateway trust bug.
Redirect validation evasions
Checks redirect validation against backslash and whitespace tricks.
How: Replays 5 encoded payloads (/\, %5c, tab…) into redirect params without following redirects; evil host in Location is high. Extends the plain open-redirect test.
Example: ?next=%5cevil.com → 302 there → naive validator.
Mass-assignment via query string
Checks whether ?role=admin in the query merges into privileged fields.
How: POSTs the same body twice (clean vs ?role=admin&isAdmin=true) and diffs: new admin markers only in the query variant are high. 2 requests per target.
Example: POST /users?role=admin → "role":"admin" in response.
Error oracle (403 vs 404)
Checks whether error codes reveal which objects exist.
How: Compares same-shape IDs (1 vs 999999999) with a token: a 403/404 split is informational. Uniform responses stay silent.
Example: 403 on /orders/1, 404 on /orders/9… → ID enumeration.
Sort/filter injection
Checks whether sort/filter parameters reach the query engine.
How: Probes ?sort=password and filter[$ne]; a 500 with database markers is medium. Clean 200s stay silent. Max 3 requests per target.
Example: ?sort=password → psycopg SyntaxError → injection surface.
Secret in URL query
Flags GET endpoints that carry secrets in the query string.
How: Passive spec analysis (zero requests): token/reset_token/session in query params is medium. Secrets belong in headers or body.
Example: GET /reset?reset_token=… → medium; Referer/log leakage.
MFA flag bypass
Checks whether the step-up endpoint trusts a client-supplied MFA flag.
How: Sends mfa_passed/mfa_verified flags to verify endpoints (max 3 requests); a token/success verdict is critical.
Example: {"mfa_passed":true} → 200 with token → decorative 2FA.
OAuth scope/grant audit
Audits advertised scopes and the token endpoint for open issuance.
How: Reads openid-configuration (admin-like scopes → info), then tries client_credentials with wrong secret + scope=admin; a token is critical. Max 2 requests.
Example: Garbage secret → access_token → credential check missing.
OTP brute-force guard
Checks whether verify endpoints throttle guessing.
How: Sends 5 wrong codes; any 429/lockout/cooldown verdict stays silent, five plain rejections are medium. Max 5 requests per scan.
Example: 5× wrong code, no 429 → 6-digit space enumerable.
MFA push fatigue guard
Checks whether push challenges have a cooldown.
How: Sends 3 push requests back-to-back; a cooldown/429 stays silent, 3 accepts are medium. Max 3 requests.
Example: 3 pushes accepted instantly → fatigue/phishing risk.
Step-up signal on sensitive actions
Flags sensitive actions (transfer, payout, admin) accepted with tokens lacking amr/acr.
How: Passive JWT claim check on sensitive POST paths (zero requests); tokens with amr/acr stay silent. Informational hardening signal.
Example: POST /transfer, no amr/acr → verify step-up server-side.
SSTI probe
Checks whether template expressions are evaluated server-side.
How: Sends {{7*7}} and ${7*7} into text fields; a bare 49 without echo is high. Max ~6 requests per scan.
Example: {{7*7}} → 49 → RCE-adjacent template injection.
SSTI engine fingerprint
Identifies the template engine behind an SSTI with per-engine syntax.
How: Tries ERB/Ruby/Smarty/Twig markers once each; evaluation is high with the engine named in evidence.
Example: <%= 7*7 %> → 49 → ERB fingerprint.
XXE probe
Checks whether XML input resolves external entities.
How: POSTs a DOCTYPE with an internal-entity canary as application/xml; expansion is high, parser-error disclosure medium. Max 2 requests.
Example: &xxe; → XXE_PROBE in response → file/SSRF risk.
CRLF/header injection
Checks whether CRLF in parameters becomes a response header.
How: Injects %0d%0a payloads into query params; an X-Scan-Probe response header is high. Max 3 requests.
Example: Injected CRLF → response header → splitting risk.
Prototype pollution
Checks whether __proto__/constructor keys persist server-side.
How: POSTs polluted keys then reads back the object; the marker in read-back is high. 2 requests.
Example: __proto__ survives into GET → object pollution.
HTTP Parameter Pollution
Checks how the server resolves duplicated query parameters.
How: Compares single vs duplicated (?id=1&id=2) responses; a parser error from the duplicate is low and flags manual review of auth paths.
Example: Duplicate → 500 with DB error → parser confusion.
SQL dialect fingerprint
Identifies the database engine from error text.
How: Sends a single quote once per scan; a dialect marker (psycopg, mysql, sqlite, mssql, oracle, mongodb) is informational and targets follow-up payloads.
Example: ' → psycopg2.SyntaxError → PostgreSQL.
Second-order injection
Plants a stored marker and checks whether it returns unescaped.
How: Writes a canary with quote/bracket characters, then reads back; raw special chars verbatim are medium. 2 requests. HTML-escaped output stays silent.
Example: Stored note returns raw quotes → export/admin sinks at risk.
Type-juggling login
Tries non-string passwords (true, array, $gt, 0) on login.
How: Baselines with a wrong password (must be 4xx), then sends 4 typed probes; any accepted login is high. Max 5 requests.
Example: password=true → token → loose-comparison auth bug.
Batch atomicity
Checks whether a batch with one invalid operation is rejected or swallowed.
How: Sends [valid, invalid] in one batch (1 request); full acceptance with no per-item error is medium.
Example: Invalid op silently absorbed → partial execution.
Replay guard
Checks whether Idempotency-Key is honored on money-moving endpoints.
How: POSTs twice with the same key (2 requests); two different resource ids are high, the same id stays silent.
Example: Same key, two order ids → double charge.
Cart/price tamper
Checks whether client-side money fields are trusted.
How: Mutates price/amount/total/qty (max 3 requests); an accepted 0.01 price or -1 qty-adjacent mutant is high.
Example: price=0.01 accepted → totals not recomputed.
Coupon guess
Checks whether a first-try coupon string yields a discount.
How: Sends coupon=SCAN10 once; discount markers in the response are low.
Example: Guessed code → discount → test codes live.
Sub-cent amount
Checks whether fractional money is normalized.
How: Sends 0.9999999 once; acceptance without error is low (rounding-drift surface).
Example: 0.9999999 accepted → use integer cents.
Concurrent duplicates
Sends two identical mutations in parallel on use-once flows.
How: Two parallel POSTs (2 requests); both succeeding is low and flags a TOCTOU review (locks/idempotency).
Example: Double redeem accepted → atomicity review.
Negative money
Checks whether negative qty/amount is rejected.
How: Sends -1 and -5 (max 2 requests); acceptance is high (refund/credit vector).
Example: qty=-1 accepted → credit manipulation.
Currency swap
Checks whether a bogus currency code is accepted at face value.
How: Sends currency=XXX/xxx (max 2 requests); acceptance is medium.
Example: XXX accepted → allowlist ISO-4217.
Shipping tamper
Checks whether a client-chosen method zeroes the shipping fee.
How: Sends shipping_method=pickup once; a zero fee in the response is low.
Example: Client method → shipping 0 → server price tables.
CSV formula at export
Checks export endpoints for unescaped formula-leading cells.
How: Requests CSV once; cells starting with =/+/-/@ are medium (spreadsheet injection at the sink).
Example: =1+1 in export → sanitize sinks.
Integer boundary
Probes numeric fields with 32-bit boundary values.
How: Sends 2^31 and -(2^31)-1 (max 2 requests); a 500 or silent acceptance is low.
Example: 2^31 → 500 → overflow surface.
Unknown-field tolerance
Checks whether write paths reject unknown fields.
How: Adds one extra field (1 request); acceptance is informational (drift/mass-assignment surface).
Example: Extra field 2xx → strict schemas?
Legacy version reachable
Checks whether /v{n-1} answers alongside /v{n}.
How: Requests the legacy path once; a 2xx is low (legacy auth/validation gaps).
Example: /v1 alive next to /v2 → sunset or backport.
Workflow state skip
Tries to set a terminal workflow state directly.
How: Sends status=completed/approved (max 2 requests); acceptance is medium — transitions must be server-driven.
Example: status=completed accepted → guard transitions.
UUID IDOR + predictability
Swaps a UUID in the path for a null UUID and compares objects.
How: Baseline 200, then an alternate UUID (max 3 requests); a different object at 200 is high — UUIDs are identifiers, not capabilities.
Example: Foreign UUID → 200 with data → missing authz.
Request-smuggling shape
Checks whether a body is processed despite Content-Length: 0.
How: Sends a body with CL:0 once; echoed processing is medium and flags a raw-socket confirmation (CL/TE desync).
Example: Body acted on with CL:0 → desync surface.
Subdomain-takeover fingerprint
Checks the root response for dangling-host fingerprints.
How: One GET / per scan; a 404/410 with GitHub-Pages/S3/Heroku markers is high — audit the CNAME.
Example: Dangling CNAME markers → reclaim the DNS.
TLS posture (HSTS + expiry)
Checks HSTS on HTTPS and certificate expiry.
How: Missing HSTS is low; a cert expiring within 30 days is medium (best-effort socket check, offline-safe).
Example: No HSTS → SSL-stripping surface.
Path confusion
Tries /../, //, case, trailing-slash and semicolon variants of gated paths.
How: Baselines a 401/403/404 path, then 6 variants; any 200 is high (gateway/auth normalization split).
Example: //ADMIN → 200 → canonicalize before auth.
Double-encoding bypass
Tries %252e, %c0%ae and unicode-slash paths.
How: Three encoded probes per scan; a 200 is high — authorization runs on the raw form.
Example: %252e%252e → 200 → decode-then-authorize.
WAF representation bypass
Replays a WAF-blocked attack with a representation tweak.
How: Baselines a 403 with WAF markers, then percent/case variants (max 3 requests); a 200 is high.
Example: Same payload passes encoded → normalize at the WAF.
WebSocket handshake auth
Checks whether WS endpoints upgrade without credentials.
How: Sends a WS handshake to hint paths plus /ws and /socket (max 2 reached); a 101 is medium — verify Origin + auth.
Example: 101 with no token → handshake auth review.
gRPC surface + verbose errors
Probes for gRPC framing and reflection-shaped errors.
How: Sends a reflection-shaped frame with application/grpc (max 2 requests); grpc-status is info, stack/SQL disclosure medium.
Example: grpc-status + traceback → generic messages.
GraphQL alias overloading
Checks whether 200 aliased fields are answered inline.
How: One aliased __typename query; 100+ inline answers are medium (CPU/DoS — separate from depth limits).
Example: 200 aliases inline → cap field counts.
Cache poisoning (unkeyed input)
Checks whether unkeyed headers end up in cached responses.
How: Sends an X-Forwarded-Host/UA canary, then a clean request (max 3); a HIT with reflection is high, persistence to the second client medium.
Example: Evil host cached → key caches safely.
Private-Network-Access policy
Checks whether Allow-Private-Network is granted broadly.
How: One preflight with a public origin; a true grant is informational — scope to an allowlist.
Example: PNA true for any origin → allowlist it.
Cookie Domain scope
Flags leading-dot or suffix-wide cookie Domains.
How: One passive Set-Cookie inspection per scan; broad scope is low — pin to the exact host.
Example: Domain=.example.com → subdomain sharing.
Upload polyglot / traversal zip
Uploads double-extension, scriptable SVG and traversal-zip probes.
How: Three inert uploads (shell.php.jpg, SVG with onload, zip with ../../ entry); acceptance without rejection is medium (low for the zip, as extraction is not confirmed). Max 3 requests.
Example: shell.php.jpg stored → sniff types + sandbox.
Stored XSS via API
Plants scriptable markup and checks the read-back.
How: Writes an SVG-onload canary, then GETs the object (2 requests); raw return is high, escaped output stays silent.
Example: Raw <svg onload> in GET → encode sinks + CSP.
Content-Type confusion
Replays a JSON body as form and XML on the same endpoint.
How: Two alternate–Content-Type requests per scan; a success verdict is medium (parser/validation split).
Example: Form body 2xx on JSON endpoint → one parser.
EICAR upload (AV check)
Uploads the inert EICAR test signature to file endpoints.
How: One upload per scan; a malware/quarantine verdict stays silent (good), storage without any verdict is low.
Example: EICAR stored silently → scan uploads.
PII in URL path / redirect
Flags e-mail, PESEL-shapes and secrets in paths and Locations.
How: Passive path check plus one redirect inspection (follow_redirects=False); a match is medium — move identifiers to headers/body.
Example: /users/[email protected] → opaque IDs instead.
Open-proxy relay
Checks whether ?url=/redirect parameters serve foreign hosts.
How: Points relay params at an unroutable evil host (max 2 requests); a redirect there is medium, a server-side fetch high.
Example: ?url=evil → 302 there → C2-relay shape.
SSRF via feature (error oracle)
Checks whether webhook/import features fetch arbitrary URLs.
How: Submits a dead-host URL (max 2 requests); a fetch-attempt error (DNS/socket text) is medium — no listener needed.
Example: getaddrinfo canary → egress confirmed.
Callback channel validation
Checks whether foreign callback domains are accepted.
How: Registers a canary callback once per scan; acceptance is low and flags a listener confirmation in hacker mode (N2/S9).
Example: Evil callback stored → DNS-exfil shape.
Presigned-URL TTL and scope
Flags eternal or wildcard-scoped signed URLs.
How: Passive spec analysis (zero requests): expiry beyond 7 days or wildcard scope is medium.
Example: se=+30d → shorten TTL per link.
Unbounded export
Flags huge unpaginated list/export responses.
How: One GET per candidate; bodies over 500KB without paging markers (head and tail) are low — paginate and cap.
Example: 546KB flat list → bulk-exfil shape.
LOL-endpoint file read
Checks whether export/preview features read outside their directory.
How: Sends traversal and file:// probes to feature params (max 2 requests); /etc/passwd markers are high.
Example: /preview?path=…/passwd → root:x: → LFI.
Anonymous dead-drop
Checks whether anonymous writes are anonymously readable.
How: Writes a canary anonymously and reads it back anonymously (2 requests); a match is medium.
Example: Anon note readable → attacker dead-drop.
Webhook confused deputy
Checks whether intranet webhook URLs are accepted at registration.
How: Registers loopback and dead-host URLs (max 2 requests); acceptance is medium — allowlist at registration.
Example: http://127.0.0.1:9 stored → deputy SSRF.
JWT kid traversal / jku fetch
Probes kid path-traversal and jku fetch via error oracle.
How: Sends alg=none tokens with ../../ kid and dead-host jku on login (max 2 requests); filesystem/network errors are medium.
Example: ENOENT on kid → sink confirmed.
Cache deception (auth vs anon)
Compares an authenticated response with an anonymous one for cacheability.
How: Fetches the same URL with and without credentials (2 requests); identical PII bodies plus a HIT marker are high. Needs an auth context, otherwise skipped.
Example: Anon gets cached /me → user data public.
Cache-key confusion (Host)
Checks whether a spoofed Host lands in the shared cache.
How: Sends Host/X-Forwarded-Host evil, then a clean request (max 3); reflection in a HIT is high, persistence to the clean client medium.
Example: Evil Host cached → poisons others.
CORS cache poisoning
Checks whether a reflected attacker Origin gets cached.
How: Sends Origin evil, then a clean request (max 3); reflected ACAO in a HIT is high, persistence medium.
Example: Evil ACAO cached → victim CORS poison.
Throttle signal on rapid pair
Checks whether rapid requests show any throttling signal.
How: Two rapid GETs per scan; a 429 stays silent (good), no counter and no 429 is low and flags a boundary-burst review.
Example: No 429, no counters → verify limits.
Redirect + CORS combo
Checks whether a foreign redirect also carries a trusted CORS grant.
How: Points a relay param at an evil host with an evil Origin (max 2 requests); a 302 there plus reflected ACAO is medium.
Example: 302 evil + ACAO evil → phishing combo.
OAuth device flow
Checks whether a device-code poll mints tokens without approval.
How: Reads discovery (endpoint advertised → info), then polls with a fabricated code (max 2 requests); a token is high.
Example: Fake device_code → token → bind approval.
OAuth state/nonce required
Checks whether authorize issues codes with no state.
How: Calls authorize without state/nonce (max 2 requests); a code without echoed state is medium.
Example: Code, no state → login-CSRF surface.
JWT x5c trust
Checks whether a self-supplied x5c certificate is trusted.
How: Sends a login token with an attacker x5c (1 request); acceptance is high — pin keys server-side.
Example: Own cert accepted → key confusion.
JWE/plaintext confusion
Checks whether an unsigned plaintext token shape is accepted.
How: Sends an alg:dir plaintext-shaped token on login (1 request); acceptance is high.
Example: Unsigned shape passes → one token type.
DPoP downgrade
Checks whether DPoP-hinted paths accept a plain bearer.
How: Requests a dpop path without a DPoP proof (1 request); a 200 is medium.
Example: No proof, 200 → enforce binding.
Eternal session cookie
Flags session/auth cookies valid for months.
How: One passive Set-Cookie inspection per scan; Max-Age beyond 90 days is low — shorten with step-up re-auth.
Example: Max-Age 10y → rotate sessions.
Presigned-URL method reuse
Checks whether a signature works with another HTTP method.
How: Replays a sig-URL with the opposite method (max 2 requests); success is high — bind method+path+expiry.
Example: GET sig works as POST → bind it.
Deep-JSON nesting
Sends a 100-level nested JSON body once per scan.
How: A 500 is medium, a slow 2xx (>5s) low; fast rejections stay silent. Small body, big shape.
Example: Nesting → 500 → cap depth.
Schema/boundary fuzz
Mutates a text field with type swaps and boundary values.
How: Five probes (2^63, bool, null, 10k string, 5k array); a 500 with internals or silent wrong-type acceptance is low.
Example: bool for string 2xx → strict types.
GraphQL suggestion leak
Checks whether a typo triggers field suggestions.
How: One misspelled query; didYouMean/password hints are informational — disable suggestions in prod.
Example: Typo → did you mean password?.
Persisted-query auth bypass
Checks whether a stored query hash answers anonymously.
How: Sends an APQ sha256 hash without credentials (max 2 requests); data without error is medium.
Example: Hash → data, no auth → gate hashes.
WAF evasion (3 representations)
Replays a blocked XSS payload double-encoded and case-mutated.
How: Baselines a 403 with WAF markers, then two mutated replays (max 4 requests); an echoed 200 is high.
Example: Same payload passes encoded → canonicalize.
Framework mass-assignment
Tries Rails/Laravel/Django binder shapes (brackets, _method, __dict__).
How: Three mutants per scan; privilege markers in the response are medium.
Example: user[admin] → admin:true → lock binders.
Cursor tampering
Checks whether a foreign/negative cursor returns data.
How: Compares a baseline page with cursor=-1 (2 requests); distinct data is low — sign and scope cursors.
Example: cursor=-1 → other rows → opaque cursors.
Mail recipient control
Checks whether the mail recipient comes from input.
How: Injects an evil address (max 2 requests); an echo or blind sent is medium, a fixed recipient stays silent.
Example: To: from input → allowlist it.
Token in external URL / error
Flags tokens embedded in external links or error pages.
How: Inspects a normal page plus a 404 with a token probe (max 2 requests); token-bearing hrefs are medium, error echoes low.
Example: href with ?token= → Referer leak.
Invite-code enumeration
Tries first-guess invite/referral codes.
How: Sends 000000/123456/invite-1/test (max 4 requests); a validation verdict is medium.
Example: 000000 valid → entropy + expiry.
Open storage bucket
Checks whether bucket URLs from API bodies list anonymously.
How: Extracts S3/GCS/Azure URLs from a page and fetches one anonymously (max 2 requests); a listing is medium.
Example: S3 URL → ListBucketResult → close it.
Password-spray signal
Checks whether cross-account guessing is observable.
How: Tries one password on three users (3 requests); plain rejections with no 429/CAPTCHA are low.
Example: No spray signal → velocity checks.
Version negotiation
Checks whether legacy versions answer through headers.
How: Compares a baseline with an X-API-Version:1 request (2 requests); a distinct 200 is low.
Example: v1 via header → sunset it.
Cookie tossing shape
Flags session cookies without the __Host- prefix.
How: One passive Set-Cookie inspection per scan; a prefix-less session cookie is low — subdomains could plant it.
Example: sess without __Host- → prefix it.
Tenant-header replay
Checks whether client tenant headers steer data access.
How: Replays a request with X-Tenant-ID/X-Org-ID swapped (max 2 requests); different data on the same token is medium — full cross-token replay is a hacker mission.
Example: other9 header leaks foreign rows → derive tenant server-side.
Token claims hygiene
Flags scan tokens without expiry or audience.
How: Zero requests: decodes the scan Bearer JWT; missing exp is medium, missing aud low — cross-API replay itself needs a second API (hacker).
Example: No exp/aud → short TTL + pinned audience.
Attack-path chaining
Chains findings across kill-chain stages in the report.
How: Zero requests: the engine groups findings (auth-bypass → data-access → exfil) and emits an informational chain — input for the TTP graph.
Example: juggling → export → fix the head.
Hacker mode (AI) — autonomous human-style pentest
Destructive authorized test — dev/staging only, never production. Verified domain required (localhost and private IPs exempt).
Plan & revise: the LLM keeps an explicit attack plan (IDOR → escalation → secrets → injections) and revises it as it learns — you see the plan and every revision in the scan report.
Probe & adapt: the agent sends requests, reads redacted response snippets, and corrects itself after blocks (401/404/429) — including writing and running its own exploit code in a restricted sandbox (15 s timeout, 30 requests, no system access).
Chain playbooks: goal it at cookies, sessions or oracles and it runs the oracle → forge → escalate chain (timing-oracle → decode session cookie → forge role→admin → confirm on gated endpoints), with deserialization confirmed by error markers only — never RCE payloads. Business-logic missions work the same way: price/coupon/quantity abuse, race/double-spend, toll-fraud (fictional numbers only), indirect prompt-injection canaries, stored-value loops and model-extraction fidelity — each with safety rules baked into the plan.
Guided goals: aim it at “check /users for IDOR” or “try to escalate to admin”; with saved credentials it tests authenticated access control (your data vs another user’s).
Privacy by design: the model only ever sees anonymized relative paths, statuses and snippets — never your URLs or credentials. Requests run server-side with auth attached outside the model’s context.
Verdict: the session ends with an AI evaluation (risk level, narrative of how the test ran, recommendations) plus every step saved in the scan report.
AI layer — payloads, triage, interpretation
Smart payloads
Before the scan, the LLM reads your OpenAPI shapes and generates tailored payloads per endpoint (IDs, extra fields, injections) — the deterministic engine then fires them. No key or outage? The engine falls back to built-in defaults.
Triage & verdicts
Each finding gets an AI second opinion (severity suggestion, false-positive flag, priority). Results are cached per finding signature and capped by a per-scan token budget — the deterministic core always works without AI.
Agent discovery
An LLM-driven browser agent (Playwright) walks the site like a human, suggests extra probe paths, and feeds discovered endpoints into the scan — even with no OpenAPI provided.
Ask mode — 320 security questions for your code (SaaS+)
The scanner never sees your code — so ask mode asks you (or your coding assistant) instead: 270 checkable questions across authentication, authorization, input validation, data protection, business logic, tenant isolation, sessions, API design, logging, supply chain and SDLC — each with a severity (critical → low) and a how-to-verify fix note. The AI adds tailored follow-up questions for your endpoints and drills into failed answers over multiple rounds. Answer pass / fail / n/a with file-and-function evidence, gate CI on the result, and export a Markdown report.
Run it from the CLI (liveapisec ask) or the dashboard questionnaire — no source code ever leaves your machine.
Everything else around the tests
Discovery & drift
Automatic endpoint discovery (OpenAPI auto-detect, JS bundles, sitemaps, AI probe paths) plus drift detection between scans (regressions, fixed, new high/critical, config fingerprint changes) — and a CI verdict endpoint that fails only on new findings vs baseline.
Risk-based prioritization (KEV + EPSS)
Every finding carries CVE IDs, a CISA Known-Exploited flag (auto-escalated severity, panel only — never the public Trust Page), the EPSS exploitability score and a risk score (0.55·severity + 0.30·CVSS + 0.15·EPSS·10). The findings API supports ?sort=risk so the most exploitable issues surface first. Feeds refresh nightly; scans always read the local cache, so they never wait on the network.
External tools & compliance
Optional ZAP and Nuclei integrations feed extra findings into the same report; every open finding maps to PCI DSS 4.0, SOC 2, ISO 27001, GDPR and NIS2 requirements in the compliance view.