Checks for outdated/vulnerable protocols like SSL 3.0, TLS 1.0, TLS 1.1.
Validity, expiration, chain trust, hostname match, key size, signature algorithm.
Reviews HSTS, X-Content-Type-Options, CSP, and Referrer-Policy hardening headers.
Checks TRACE handling, version-banner disclosure, and exposed directory listings.
Maps common externally reachable services for business-need, patch, and authentication review.
Analyzes whether high-risk ports are properly restricted.
Checks if AXFR zone transfers are allowed.
Flags legacy-looking Apache, nginx, IIS, PHP, OpenSSL, and ASP.NET banners for version verification.
Publicly accessible files like web.config, .env, wp-config.php, phpinfo.php, backups, admin panels.
Reviews plaintext HTTP-to-HTTPS handling and literal mixed-content references.
phpMyAdmin, cPanel, Plesk, Webmin, WHM, DirectAdmin, WordPress admin, Tomcat, etc.
Scans page source for leaked AWS, Google, Stripe, GitHub, Slack, SendGrid, Twilio keys, and private keys.
Verifies X-Frame-Options or CSP frame-ancestors prevent your site from being framed by attackers.
Checks homepage cookies for applicable Secure, HttpOnly, SameSite, and cookie-prefix protections.
Probes for verbose error pages leaking stack traces, file paths, or framework internals.
Checks AWS S3, Google Cloud Storage, and Azure Blob containers advertised by the homepage for public listing.
Probes the OpenID Connect discovery endpoint for weak signing algorithms and missing PKCE support.
Flags non-test Luhn-valid PAN candidates and SSN patterns in sampled homepage source for manual validation.
Detects references to MD5, SHA-1, DES, RC4, and insecure JS patterns like Math.random for tokens.
Probes common admin paths (/admin, /wp-login, /manager, etc.) for exposed login forms that should be IP-restricted.
Sends a foreign Origin header and distinguishes exploitable credentialed reflection from invalid or public CORS policies.
Scans page references for ws:// (unencrypted) versus wss:// (TLS) WebSocket endpoints. Plain ws:// traffic is readable on the wire.
Inspects POST forms on the homepage for a hidden anti-forgery token field. Forms without tokens may allow cross-site request forgery.
Samples linked JSON/API endpoints for top-level arrays without anti-hijack guards - an older but still-exploitable class of bug.
Sends bounded, non-destructive quote probes to common GET parameters and checks for exposed database errors or new server failures.
Uses bounded, non-executing HTML markers to detect common GET parameters that are reflected without output encoding.
Targets POODLE, BEAST-era CBC, SWEET32, RC4, FREAK, NULL ciphers, CRIME compression, static RSA, and insecure renegotiation.
Compares direct and duplicated GET parameters for validation bypasses, concatenation, inconsistent precedence, or new server errors.
Uses a controlled public HTTPS canary to detect URL parameters that fetch and return remote content server-side.
Discovers public XML/SOAP processors and uses one controlled external HTTPS entity to test whether remote content is expanded.
Looks for exposed serialized object formats and deserializer-specific errors using non-executable GET probes.
Uses command-free expansion canaries and incomplete shell syntax to detect unsafe command processing.
Uses the target's public robots.txt as a safe canary to test file-like GET inputs for directory traversal.
Discovers public upload forms, methods, type hints, storage listings, and visible security controls without submitting a file.
Uses malformed, non-broadening LDAP filter and DN syntax to detect directory-service error leakage.
Uses malformed, non-broadening data values to detect NoSQL database and query-parser error leakage.
Uses side-effect-free arithmetic canaries to detect server-side template evaluation and engine-specific errors.
Passively reviews public forms and links for client-authoritative fields, mutable GET routes, and predictable sensitive identifiers.
Reviews public mutation forms and client scripts for privileged bindable fields, broad property containers, and risky object serialization.
Reviews SOAP/WSDL schemas and uses a uniquely named nonexistent operation to detect unsafe dispatch and verbose faults.
Confirms whether the target's DNS service resolves unrelated internet names for unauthenticated clients.
Uses non-destructive OPTIONS and PROPFIND requests to detect exposed WebDAV collections and risky method advertisement.
Checks FTP, Telnet, SMTP, POP3, and IMAP for anonymous access or credential flows exposed before transport encryption.
Uses soft-404 baselines plus binary and text signatures to find downloadable archives, backup configs, deployment files, source maps, and legacy WebDAV metadata.