Every scan runs real security checks drawn from years of penetration testing. Not checkbox compliance - the same methodology a researcher would use against your app.
How to fix these findingsLast 7 days
We don't just detect these vulnerabilities. We prove they're exploitable on your app with safe, non-destructive proof-of-concept payloads.
Detects Page Builder CK for Joomla installations vulnerable to unauthenticated arbitrary file write leading to remote code execution. In every version before 3.6.0 the component runs each front-end task with no authorization check at all, so the fonts.save task is reachable by any anonymous visitor who first reads the Joomla form token out of the site's own markup. That task fetches a URL taken straight from the request, scans the response for font references, and writes every referenced file into media/com_pagebuilderck/gfonts/ under the name the response supplies, with no extension filter. A stylesheet pointing at a PHP file therefore drops executable code into the web root, which is exactly where shells were found on compromised sites. The verifier reaches the task without credentials, proves the server performed the fetch it asked for by reading the per-run hostname back out of the server's own transfer error, and confirms an analyzer-named file appeared under the document root. CVSS 9.8, CISA KEV. Upgrade Page Builder CK to 3.6.0 or later.
Added yesterday
Detects Apache Roller 6.1.5 blog servers whose XML-RPC endpoint deserializes untrusted bytes before anyone has logged in. Roller wires the XML-RPC servlet up with its library's vendor extension value types switched on, and one of those types carries a base64 blob that Java turns back into a live object while the request is still being read. Because the endpoint is wired in unconditionally, that happens even on sites that left XML-RPC switched off, so no unusual configuration is needed. The verifier posts one such value whose payload starts with four random bytes and no serialized object at all, then confirms the server quotes those exact four bytes back as the object header it refused. Only Java's deserialization routine can produce that reply, which proves attacker-controlled bytes reach it with no credentials, the first half of a remote code execution chain. Upgrade to Apache Roller 6.1.6 or later, which turns the extension types off and closes the endpoint while the XML-RPC feature is disabled.
Added 2d ago
Detects Zammad helpdesk installations that hand their live list of connected clients, session cookies included, to anyone who can open a websocket. In versions 6.3.0 through 6.5.4 the websocket server passes the whole connected-client registry into every event handler, and it returns the raw text of any exception that handler throws straight back to the caller. Asking for the event named base selects the abstract handler class, which has no run method, so Ruby raises an error whose text includes a dump of the handler object and with it the registry: every live connection's handshake headers, Cookie header and all. An attacker replays a harvested cookie against the REST API or through the login websocket event, which accepts a session id verbatim, and inherits that user's session. An administrator session then reaches code execution as the zammad user. The verifier opens one unauthenticated websocket carrying a freshly minted per-scan marker cookie, sends the single base event, and confirms the reply carries the registry with that marker read back out of it. A control event that resolves to no handler class comes back through the same error envelope with nothing attached, so the finding is the leak and not merely an endpoint that answers errors. CVSS 9.8, CISA KEV, exploited in the wild. Upgrade to Zammad 7.2.0 or later and invalidate every active session.
Added 3d ago
Exposed files, secrets, technology fingerprinting, and active vulnerability probing
Probes for accidentally exposed files like .env, .git directories, and database backups
Example: .env file publicly accessible with database credentials
Fingerprints frameworks, libraries, and server versions to identify known vulnerabilities
Example: Running Laravel 10.48 with 3 known CVEs
Checks WordPress plugins and themes against known vulnerability databases
Example: Contact Form 7 plugin has known XSS vulnerability
Finds API keys, tokens, and credentials exposed in JavaScript and HTML source code
Example: API key found in client-side JavaScript bundle
Detects stack traces, debug pages, and verbose error messages that reveal internals
Example: Full stack trace exposed in 500 error response
Actively proves whether known CVEs are exploitable on your app, not just present
Example: CVE-2024-1234 confirmed exploitable on this server
Tests for technology-specific misconfigurations like debug modes and exposed admin panels
Example: Laravel debug mode enabled, exposing environment variables
Analyzes JSON Web Token signing configuration and algorithm weaknesses
Example: JWT accepts 'none' algorithm, bypassing signature verification
Tests whether URL parameters can redirect users to malicious external domains
Example: Redirect parameter accepts arbitrary external URLs
Finds framable pages with forms that change state, where an invisible overlay can make a visitor submit them
Example: Password change form can be framed from another origin
Detects vulnerable JavaScript libraries loaded from CDN URLs with known CVEs
Example: jQuery 3.4.1 loaded from cdnjs has 6 known CVEs
HTTP response headers, caching policies, content security, and cookie settings
Checks for missing or misconfigured HTTP security headers like X-Frame-Options and HSTS
Example: Missing Content-Security-Policy header
Deep analysis of CSP directives for bypasses and unsafe-inline usage
Example: CSP allows unsafe-inline scripts
Identifies caching misconfigurations that could leak sensitive data to shared caches
Example: Cache-Control missing on authenticated page
Validates Content-Type headers and MIME sniffing protection
Example: Missing X-Content-Type-Options header
Checks cookie security flags including Secure, HttpOnly, and SameSite attributes
Example: Session cookie missing HttpOnly flag
Fingerprints CDN and WAF providers from response headers and behavior
Example: Cloudflare WAF detected with default ruleset
Probes for dangerous HTTP methods like PUT, DELETE, and TRACE that should be disabled
Example: TRACE method enabled, echoing request headers back to the caller (XST)
Checks .well-known endpoints for security.txt and exposed configuration files
Example: Missing security.txt contact information
Transport-level checks covering DNS, TLS, and email security configuration
Analyzes DNS configuration for dangling records, missing entries, and subdomain takeover risks
Example: Dangling CNAME pointing to unclaimed cloud service
Checks whether DNSSEC is configured and validates correctly
Example: Domain is not signed with DNSSEC
Validates SSL/TLS certificate chain, expiry dates, and cipher configuration
Example: TLS certificate expires in 12 days
Checks SPF, DKIM, and DMARC records for protection against forged email
Example: Missing DMARC record allows forged email from your domain
Tests Cross-Origin Resource Sharing policy for overly permissive rules
Example: CORS allows any origin to read responses
Repeats the CORS checks against endpoints that need a login, using real credentials
Example: Any origin can read a logged-in user's data
Analyzes HTTP redirect chains for missing HTTPS upgrades and redirect loops
Example: HTTP to HTTPS redirect missing on main domain
Start with a free 14-day Starter trial. Active probing that proves what's actually exploitable, not just a checklist.