What we test
Every scan runs the same deterministic engine first — no randomness, no guessing. Baseline (8 tests) gives fast feedback on every push; Deep (+12 tests) runs the full pack on schedule or before release. On top of that: AI-assisted triage, autonomous hacker mode, and a code questionnaire (ask mode) for what no scanner can see from the outside.
Baseline — 8 tests on every run
Broken authentication
Checks whether an endpoint that requires authentication works without a token or with a garbage token.
How: Replays the request with no Authorization header and with a random token; 2xx means the auth check is missing or broken.
Example: GET /users/me returns 200 without any token → anyone can read the profile.
BOLA / IDOR
Checks whether swapping a resource ID gives access to somebody else’s data (broken object-level authorization).
How: Heuristics over ID-like parameters: tries other/typical identifiers and compares responses for data leakage.
Example: GET /orders/124 returns another customer’s order → critical data leak.
Mass assignment
Checks whether the server silently accepts extra fields that were never documented.
How: Adds extra fields to the payload and looks for their echo/persistence in the response.
Example: POST /users accepts {"is_admin": true} → privilege escalation.
Injection (SQL / NoSQL / JSON)
Probes query parameters and body fields for injection flaws.
How: Sends classic SQL/NoSQL/JSON payloads and matches error signatures and timing anomalies in responses.
Example: ' OR '1'='1 in ?search= triggers a SQL error → injectable parameter.
Rate limiting
Checks whether the API throttles repeated requests.
How: Fires a burst of identical requests at one endpoint; no 429 means brute-force and scraping are wide open.
Example: 12 rapid POST /login with no 429 → credential stuffing possible.
CORS misconfiguration
Checks whether the API reflects arbitrary Origins with credentials allowed.
How: Sends malicious Origin headers and inspects Access-Control-Allow-Origin / Allow-Credentials.
Example: Origin: https://evil.example reflected with credentials → session theft via browser.
Security headers
Checks for missing baseline HTTP security headers.
How: Reads response headers (nosniff, frame options, HSTS, CSP, referrer policy) on every target.
Example: Missing X-Content-Type-Options and frame protections → clickjacking / MIME-sniffing risk.
Sensitive parameters
Finds secrets, tokens and passwords passed in the URL query string.
How: Scans query names for secret-like keys (token, key, password, secret) that leak into logs and browser history.
Example: GET /reset?token=abc123 in the URL → secret ends up in proxy logs.
Deep — 12 more tests for scheduled and release scans
Shadow API discovery
Finds undocumented endpoints that answer behind your back (admin, debug, old versions, backups).
How: Probes common variants of documented paths plus global paths (/health, /swagger.json, /actuator); 2xx/3xx on an undocumented path is a finding.
Example: /admin/users responds 200 but is nowhere in the spec → hidden attack surface.
JWT weaknesses
Attacks the token itself: alg=none, unverified signature, weak HMAC secret, missing expiry, key-confusion.
How: Baseline first (valid token works, garbage rejected — otherwise it is plain broken auth); then replays mutated tokens on secured endpoints only.
Example: Token with alg=none accepted → anyone can forge sessions.
HTTP method tampering
Checks whether access control is wired only to the documented method.
How: Tries the same path with other verbs (GET→POST/PUT/DELETE); 2xx with content on an undeclared method is a bypass.
Example: GET /admin → 403, but POST /admin → 200 → authorization bypass.
Tech fingerprint + version freshness
Identifies the server stack from headers and error pages and flags end-of-life software.
How: Collects Server / X-Powered-By headers from GET / and a deliberate 404, matched against a built-in version table; EOL is high severity.
Example: Server: PHP/7.4 (end-of-life) → unpatched CVEs likely.
Mass assignment v2 (read-only escalation)
Goes one step further than v1: proves privilege escalation via read-only fields.
How: Sends canary probes, ignores schema-declared fields, and requires an exact value echo; only permission-ranked fields (role, is_admin) raise high.
Example: {"role":"admin"} echoed back exactly → confirmed escalation.
Information disclosure checklist
Sweeps known-sensitive paths (.git, .env, debug consoles, actuators, metrics).
How: Content counts, not status: a finding needs a real marker in the body; empty bodies and login pages stay silent. Plus stack-trace detection on a missing path.
Example: /.git/config leaks repository internals → high.
Rate-limit v2 (differential + bypass)
Asks the scarier questions: is login throttled when the rest is? Can the limit be bypassed with a spoofed IP header?
How: Compares an auth endpoint against a neutral one, then replays with X-Forwarded-For rotation under control conditions.
Example: Unlimited login next to a limited API → credential stuffing; XFF rotation dodges 429 → high.
Old API versions
Checks whether retired /v1/ endpoints still live with weaker protection.
How: For documented /vN/ paths tries /v(N-1)/ and /v1/ without auth; old 2xx vs new 401/403 is a bypass, old 2xx vs new 404 is a zombie endpoint.
Example: /v1/orders returns 200 while /v2/orders demands auth → old version bypasses access control.
GraphQL probing
Detects GraphQL endpoints, introspection left on in production, and missing query-cost limits.
How: Tries typical /graphql paths, sends an introspection query (schema dump = medium), then an expensive nested query (success = no cost limits).
Example: Introspection returns the full schema in prod → attacker gets the whole map for free.
OAuth2 / OIDC redirect check
Tests the client’s OAuth login for open-redirect on redirect_uri (stolen codes/tokens).
How: Reads /.well-known/openid-configuration, then probes authorize with an evil redirect_uri without following redirects; 302 to a foreign host is high. Foreign identity providers are never attacked.
Example: authorize?redirect_uri=https://evil.example → 302 there → code theft.
CORS + CSRF chain
Attacks the allowlist logic itself, not just simple reflection.
How: Probes Origin: null, lookalike domains ({host}.evil.example), and preflight on write methods with credentials.
Example: null origin trusted with credentials → sandboxed-iframe session theft.
SSRF canary
Checks whether the API fetches attacker-supplied URLs (server-side request forgery) — safely, against our own listener.
How: Plants our canary URL into URL-shaped fields (webhook, avatar, import); a callback to our infrastructure proves SSRF. Nobody else is ever targeted.
Example: POST /webhooks with our URL → server calls back → confirmed SSRF.
Hacker mode (AI) — autonomous human-style pentest
Destructive authorized test — dev/staging only, never production. Verified domain required (localhost and private IPs exempt).
Plan & revise: the LLM keeps an explicit attack plan (IDOR → escalation → secrets → injections) and revises it as it learns — you see the plan and every revision in the scan report.
Probe & adapt: the agent sends requests, reads redacted response snippets, and corrects itself after blocks (401/404/429) — including writing and running its own exploit code in a restricted sandbox (15 s timeout, 30 requests, no system access).
Guided goals: aim it at “check /users for IDOR” or “try to escalate to admin”; with saved credentials it tests authenticated access control (your data vs another user’s).
Privacy by design: the model only ever sees anonymized relative paths, statuses and snippets — never your URLs or credentials. Requests run server-side with auth attached outside the model’s context.
Verdict: the session ends with an AI evaluation (risk level, narrative of how the test ran, recommendations) plus every step saved in the scan report.
AI layer — payloads, triage, interpretation
Smart payloads
Before the scan, the LLM reads your OpenAPI shapes and generates tailored payloads per endpoint (IDs, extra fields, injections) — the deterministic engine then fires them. No key or outage? The engine falls back to built-in defaults.
Triage & verdicts
Each finding gets an AI second opinion (severity suggestion, false-positive flag, priority). Results are cached per finding signature and capped by a per-scan token budget — the deterministic core always works without AI.
Agent discovery
An LLM-driven browser agent (Playwright) walks the site like a human, suggests extra probe paths, and feeds discovered endpoints into the scan — even with no OpenAPI provided.
Ask mode — 270 security questions for your code
The scanner never sees your code — so ask mode asks you (or your coding assistant) instead: 270 checkable questions across authentication, authorization, input validation, data protection, business logic, tenant isolation, sessions, API design, logging, supply chain and SDLC — each with a severity (critical → low) and a how-to-verify fix note. The AI adds tailored follow-up questions for your endpoints and drills into failed answers over multiple rounds. Answer pass / fail / n/a with file-and-function evidence, gate CI on the result, and export a Markdown report.
Run it from the CLI (liveapisec ask) or the dashboard questionnaire — no source code ever leaves your machine.
Everything else around the tests
Discovery & drift
Automatic endpoint discovery (OpenAPI auto-detect, JS bundles, sitemaps, AI probe paths) plus drift detection between scans (regressions, fixed, new high/critical, config fingerprint changes) — and a CI verdict endpoint that fails only on new findings vs baseline.
External tools & compliance
Optional ZAP and Nuclei integrations feed extra findings into the same report; every open finding maps to PCI DSS 4.0, SOC 2, ISO 27001, GDPR and NIS2 requirements in the compliance view.