Scanner Modules Reference - Vigolium Documentation

Vigolium ships with 325 scanner modules, 208 active and 117 passive, covering the OWASP Top 10 and beyond. Run vigolium module ls for the up-to-date enabled list (the registry can grow between releases without a docs refresh). Active modules send modified requests to detect vulnerabilities; passive modules analyze existing request/response pairs without generating traffic. Recent additions include sourcemap-ingest (v0.4.9), the v0.3.8 batch (ssi-injection, server-side-js-injection, smtp-header-injection, react-rsc-rce, dependent-response, path-relative-stylesheet), the GraphQL security suite, the Adobe Experience Manager (AEM) family, the SaaS data-exposure family (Salesforce / ServiceNow / Power Pages), the Model Context Protocol (MCP) suite, the expanded IIS family, the dependency-confusion and js-beautify passives, and the v0.2.1 batch (out-of-band SQLi, XPath injection, unauthenticated infra-service exposure, TLS protocol/cipher audit, session fixation, and the LLM-endpoint / payment-integration / DOM-clobbering / CSS-injection / cross-origin-isolation / reverse-tabnabbing passives) — filter the list by tag with vigolium module ls graphql, vigolium module ls aem, salesforce, servicenow, powerpages, mcp, or iis (the positional filter matches on id, name, description, and tag; vigolium module ls --tags dumps every known tag).

The Module ID column is the exact id -m / --module-id and --module-tag expect (vigolium scan-url -m xss-stored,sqli-error-based). Ids carry no active- / passive- prefix — --module-id requires an exact match and -m falls back to substring matching, so a prefixed name selects nothing.

Severity Scale

critical > high > medium > low > suspect > info

Confidence Scale

certain - Definitively confirmed (payload executed, error matched)
firm - Likely confirmed by behavioral analysis
tentative - Possible but unconfirmed (heuristic-based)

Hardening advisories (`hygiene`)

Fourteen modules tagged hygiene report a missing best-practice control rather than an exploitable condition: absent security headers, weak TLS protocol and cipher policy, cookie and session-cookie attributes, and the CSP / HSTS / SRI / Permissions-Policy / COOP audits. They are cheap to run and fire on nearly every response, so on a crawl of any size they contribute one near-identical Info/Low row per URL and bury the findings worth triaging.

They do not run below --intensity deep (v0.5.0). A report that counted on those rows will come back shorter until you turn them back on.

Severity	Modules
Info	`security-headers-missing`, `permissions-policy-detect`, `cross-origin-isolation-audit`, `subresource-integrity-detect`, `password-autocomplete-detect`
Low	`tls-protocol-cipher-audit`, `hsts-preload-audit`, `csp-weakness-audit`, `cors-vary-origin-missing`, `cookie-security-detect`, `mixed-content-detect`, `reverse-tabnabbing-detect`, `content-type-mismatch`, `express-session-audit`

Three ways to get them back:

vigolium scan -t https://example.com --intensity deep          # per scan
vigolium scan -t https://example.com --module-tag hygiene      # just this family
vigolium scan -t https://example.com --module-id security-headers-missing
vigolium config set dynamic-assessment.hygiene_modules true    # every scan

dynamic-assessment.hygiene_modules sets the default for a broad (["all"]) selection: true runs them at every intensity, false suppresses them even at deep. Naming them explicitly with --module-tag or --module-id always wins, the same way an explicit selection already bypasses the intensity tier ceiling.

The Info-tier fingerprints, the endpoint/param observers and surface-scoring are not in this set - their output feeds tech tags, scoring and active-module targeting, so they still run at every intensity. Neither is clickjacking-detect, which stays on at Medium.

Active Modules (208)

Active modules send modified requests to detect vulnerabilities via fuzzing, injection, and behavioral analysis. Every registered active module is listed below; vigolium module ls --type active prints the same set from your installed build.

XSS

Module ID	Name	Description	Severity	Confidence	Tags
`xss-light-url-params`	XSS Light - URL Parameters	Reflected XSS in URL parameters with POST→GET conversion	High	Firm	`xss`, `injection`
`xss-light-path`	XSS Light - Path Injection	Reflected XSS via path manipulation (recursive, cut, append)	High	Firm	`xss`, `injection`
`xss-light-param-discovery`	XSS Light - Parameter Discovery	Reflected XSS via echo parameter discovery	High	Firm	`xss`, `injection`
`xss-light-encoded`	XSS Light - Pre-encoded Injection	Detects XSS where the app decodes a parameter (base64 / double-URL) before reflecting	High	Firm	`injection`, `xss`, `light`, `encoded`
`xss-dom-confirm`	XSS DOM Confirm (Browser)	Confirms reflected and DOM-based XSS by observing alert() in a real browser	High	Certain	`xss`, `dom-xss`, `browser`, `slow`
`xss-stored`	Stored XSS (browser-confirmed)	Injects a canary, then confirms it executes on a later retrieval of the page	High	Firm	`injection`, `xss`, `stored`

SQL Injection

Module ID	Name	Description	Severity	Confidence	Tags
`sqli-error-based`	SQLi Error Based	Error-based SQLi via database error messages (MySQL, PostgreSQL, MSSQL, Oracle, SQLite)	Critical	Certain	`sqli`, `injection`
`sqli-boolean-blind`	Blind SQL Injection (Boolean-Based)	Boolean-based blind SQLi using a randomized boundary matrix with difflib-style page-similarity comparison, a multi-round/multi-factor logic battery (AND/OR oracle, alternating comparison operators, invalid-syntax probe), and WAF-adaptive payload mutation. Only reports 200-vs-200 differentials with a large body-size delta (rejects status-flip false positives)	High	Certain	`sqli`, `injection`, `heavy`
`sqli-out-of-band`	SQL Injection (Out-of-Band)	Blind SQLi confirmed via out-of-band DBMS callbacks (`LOAD_FILE` / `xp_dirtree` / `UTL_HTTP`) to a per-payload OAST subdomain — an unforgeable hit proves execution	Critical	Certain	`sqli`, `injection`, `oast`

NoSQL Injection

Module ID	Name	Description	Severity	Confidence	Tags
`nosqli-error-based`	NoSQLi Error Based	NoSQL injection via error messages (MongoDB, CouchDB, Cassandra)	High	Tentative	`nosqli`, `injection`
`nosqli-operator-injection`	NoSQL Operator Injection	MongoDB operator injection (`$ne`, `$gt`, `$regex`, `$where`) for auth bypass	High	Tentative	`nosqli`, `injection`

Template Injection

Module ID	Name	Description	Severity	Confidence	Tags
`reflected-ssti`	Reflected SSTI	SSTI via math expression evaluation (e.g., `{{7*7}}=49`)	High	Certain	`ssti`, `injection`
`ssti-detection`	SSTI Detection	Diff-based SSTI via Boolean Error-Based Blind technique	Info	Certain	`ssti`, `injection`
`csti-detection`	Client-Side Template Injection	CSTI in AngularJS/Vue.js applications via literal reflection	Medium	Firm	`ssti`, `injection`

File Inclusion

Module ID	Name	Description	Severity	Confidence	Tags
`lfi-generic`	LFI Generic	LFI via path traversal payloads; matches known OS file signatures	High	Certain	`lfi`, `injection`
`lfi-path-traversal`	LFI Path Traversal	Advanced LFI with null bytes, double encoding, Unicode bypass	High	Firm	`lfi`, `injection`

Code Execution & Injection

Module ID	Name	Description	Severity	Confidence	Tags
`code-exec`	Code Execution (RCE)	OS command injection via time-based blind (sleep/delay measurement), plus language-specific interpreter payloads across several string-breakout contexts	Critical	Certain	`rce`, `injection`
`command-injection-echo`	OS Command Injection (Results-Based)	In-band OS command injection confirmed by reflecting a unique arithmetic marker, baseline-compared over multiple rounds to suppress false positives	Critical	Certain	`rce`, `command-injection`, `injection`
`command-injection-oast`	OS Command Injection (Out-of-Band)	Blind OS command injection via DNS/HTTP OAST callbacks (classified distinctly from SSRF/XXE)	Critical	Certain	`rce`, `command-injection`, `oast`
`command-injection-timing`	OS Command Injection (Time-Based)	Time-based blind OS command injection with delay-scaling confirmation across rounds	Critical	Tentative	`rce`, `command-injection`, `injection`, `heavy`
`crlf-injection`	CRLF Injection	CRLF injection in HTTP headers via CR/LF character sequences	Medium	Firm	`injection`
`xxe-generic`	XXE Generic	XML external entity injection in generic XML endpoints; includes blind / out-of-band detection via external- and parameter-entity DTDs referencing a unique OAST URL	Critical	Certain	`xxe`, `injection`
`xpath-injection`	XPath Injection	XPath/XQuery injection detected via engine error signatures and a boolean oracle (e.g. `' or '1'='1`)	High	Firm	`xpath`, `injection`
`insecure-deserialization`	Insecure Deserialization	Error-based detection for Java, PHP, Python, Ruby, and .NET deserialization	High	Firm	`injection`
`input-behavior-probe`	Input Behavior Probe	Behavior change detection via header, path, debug param, and char probing	Info	Tentative	`injection`
`padding-oracle`	CBC Padding Oracle	Confirms a CBC padding oracle by flipping ciphertext bytes and observing a reproducible padding-error differential	High	Firm	`cryptography`, `injection`, `heavy`
`ldap-injection`	LDAP Injection	Detects LDAP injection via error-based and boolean-based techniques, including a negation oracle (match-all vs match-none divergence)	Medium	Firm	`injection`, `heavy`
`log4shell-probe`	Log4Shell Probe	Detects Log4Shell (CVE-2021-44228) via JNDI payload injection with OAST callbacks	Critical	Certain	`java`, `rce`, `heavy`
`struts-ognl-injection`	Struts OGNL Injection	Detects Apache Struts OGNL injection via Content-Type and parameter payloads	Critical	Firm	`java`, `rce`, `moderate`
`response-header-injection`	HTTP Response Header Injection	Detects HTTP response header injection via CRLF in parameters	Medium	Certain	`crlf`, `injection`, `header`, `response-splitting`, `moderate`
`ssi-injection`	Server-Side Includes (SSI) Injection	Injects a set/echo SSI directive whose value is emitted only when the server parses SSI, with the directive markup consumed — proving evaluation rather than reflection; also confirms `exec` out of band	High	Firm	`injection`, `ssi`, `rce`, `heavy`
`server-side-js-injection`	Server-Side JavaScript Injection	Server-side JavaScript (Node.js) code injection through `eval` / `Function` / `vm` / `$where`, confirmed via an OAST callback or a consistent busy-wait time differential	Critical	Firm	`injection`, `ssji`, `nodejs`, `rce`, `heavy`
`smtp-header-injection`	SMTP Header Injection	CRLF injection into a mail header via an email-bearing parameter, confirmed by grafting a `Bcc` at a unique collaborator address the mailer resolves on delivery	Medium	Firm	`injection`, `smtp`, `crlf`, `email`, `heavy`

SSRF & Out-of-Band (OAST)

Module ID	Name	Description	Severity	Confidence	Tags
`ssrf-detection`	SSRF Detection	SSRF via in-band probes (internal IPs, cloud metadata) with response differential	High	Tentative	`ssrf`, `injection`
`oast-probe`	OAST Probe	Blind vulnerabilities (blind SSRF, blind XXE, blind RCE) via DNS/HTTP callbacks, plus “Collaborator Everywhere” OAST headers	High	Certain	`ssrf`, `injection`
`proxy-pingback`	Proxy Pingback	Open proxy/callback endpoints via OAST URL injection	High	Certain	`ssrf`, `injection`
`ssrf-filter-bypass`	SSRF Filter Bypass (URL Parser Confusion)	SSRF that defeats URL allow/deny filters via parser confusion (`@`, `#`, backslash, embedded credentials)	High	Firm	`ssrf`, `injection`, `heavy`
`ssrf-protocol-smuggling`	SSRF Protocol Smuggling (CRLF in URL)	SSRF via CRLF-in-URL protocol smuggling against fetchers that don’t sanitize the target URL	High	Firm	`ssrf`, `injection`, `heavy`
`routing-ssrf`	Routing-Based SSRF (Request-Line)	Routing-based SSRF from PortSwigger’s “Cracking the Lens” — absolute-URI / `@` / `///` request-line targets with OAST + internal-marker confirmation	Info	Firm	`ssrf`, `proxy`, `routing`, `oast`, `heavy`
`upgrade-routing-ssrf`	WebSocket-Upgrade SSRF Filter Bypass	Routing SSRF that bypasses filters via a WebSocket `Upgrade`, confirmed by a with-vs-without differential	High	Tentative	`ssrf`, `proxy`, `websocket`, `heavy`
`pdf-generation-injection`	PDF Generation Injection	Detects HTML/JS injection into server-side PDF generation endpoints for SSRF/file read	High	Firm	`ssrf`, `injection`, `moderate`

Misconfiguration

Module ID	Name	Description	Severity	Confidence	Tags
`cors-misconfiguration`	CORS Misconfiguration	Permissive CORS policies (reflected origins, null origin, wildcard+credentials), plus a single-mutation trusted-origin probe gated on a negative control so a blanket reflector isn’t re-reported	Low	Firm	`misconfiguration`
`host-header-injection`	Host Header Injection	Host header injection via value reflection (password reset/cache poisoning)	Medium	Firm	`misconfiguration`
`web-cache-poisoning`	Web Cache Poisoning	Cache poisoning via unkeyed header injection (`X-Forwarded-Host`, `X-Forwarded-Scheme`, `X-Host`, `X-Forwarded-Server`, `X-Original-Host`, `X-Forwarded-Prefix`)	High	Tentative	`misconfiguration`
`cache-poisoned-dos`	Cache-Poisoned Denial of Service (CPDoS)	CPDoS via header-only HMO/HHO variants that make a shared cache store and replay an origin error; safe unique-buster oracle, never affects shared keys	Medium	Firm	`cache-poisoning`, `cpdos`, `dos`
`unauth-service-exposure`	Unauthenticated Infrastructure Service Exposure	Unauthenticated Docker / Kubernetes / datastore APIs exposed over HTTP, confirmed by a service-specific structural signature and re-verified	Critical	Certain	`exposure`, `infrastructure`, `misconfiguration`
`tls-protocol-cipher-audit`	TLS Protocol & Cipher Audit	Grades a host’s TLS by directly negotiating deprecated protocols and weak cipher suites	Low	Certain	`tls`, `crypto`, `transport`, `misconfiguration`
`cache-deception`	Web Cache Deception	Detects web cache deception via path confusion with static file extensions and delimiter-confusion variants	Medium	Tentative	`cache-poisoning`, `auth-bypass`, `moderate`
`oauth-misconfiguration`	OAuth/OIDC Misconfiguration	Detects common OAuth/OIDC misconfigurations including open redirect and missing state	Low	Firm	`authentication`, `session`, `moderate`
`common-directory-listing`	Common Directory Listing	Detects directory listing exposure on common web servers (Apache, Nginx, IIS, Jetty, Python)	Low	Firm	`info-disclosure`, `misconfiguration`, `directory-listing`, `light`
`dashboard-exposure`	Exposed Third-Party Dashboard	Probes for exposed third-party dashboards/consoles (Grafana, Airflow, GitLab, Jenkins, Ollama, …) and unauthenticated version/config/data leaks	Medium	Firm	`dashboard`, `exposure`, `discovery`, `info-leak`, `default-login`, `light`
`go-debug-endpoint-exposure`	Go Debug Endpoint Exposure	Detects exposed Go net/http/pprof and expvar debug endpoints	Medium	Firm	`golang`, `pprof`, `expvar`, `debug`, `info-disclosure`, `misconfiguration`, `light`
`subdomain-takeover`	Subdomain Takeover	Detects dangling DNS records pointing to deprovisioned cloud services	High	Firm	`cloud`, `misconfiguration`, `moderate`
`tls-cert-recon`	TLS Certificate Recon	Reads each host’s live TLS certificate for recon: self-signed / private-CA certs and the subdomains and internal names in their SANs	Info	Certain	`recon`, `tls`, `certificate`, `fingerprint`, `light`
`path-relative-stylesheet`	Path-Relative Stylesheet Import (PRSSI)	A page carrying a path-relative stylesheet that the server also serves at a path-info-confused URL without `X-Content-Type-Options: nosniff`, so attacker content can resolve as CSS	Low	Firm	`client-side`, `css-injection`, `prssi`, `moderate`

Access Control

Module ID	Name	Description	Severity	Confidence	Tags
`forbidden-bypass`	403/401 Forbidden Bypass	Bypass via path manipulation, header injection, method tampering	Medium	Firm	`auth-bypass`
`http-method-tampering`	HTTP Method Tampering	Unexpectedly enabled HTTP methods (PUT, DELETE, PATCH) and overrides	Info	Firm	`auth-bypass`
`csrf-verify`	CSRF Token Verification	Verifies CSRF token enforcement by removing, emptying, or randomizing tokens	High	Firm	`auth-bypass`
`idor-detection`	IDOR Detection	Missing authorization on object ID parameters via neighbor ID probing	High	Tentative	`auth-bypass`
`mass-assignment`	Mass Assignment	Mass assignment via injecting privilege keys into JSON APIs	High	Firm	`auth-bypass`
`open-redirect`	Open Redirect	Open redirect via injected external URL in Location/meta refresh, across a wide set of leading separators that catch blocklist-bypass redirect targets	Medium	Firm	`auth-bypass`
`open-redirect-confusion`	Open Redirect via URL Parser Confusion	Open redirect reached through URL-parser-confusion payloads (`@`, backslash, embedded host) that slip past naive redirect validation	High	Firm	`open-redirect`, `ssrf`, `moderate`
`session-fixation`	Session Fixation	Permissive session mechanism that adopts an attacker-supplied session ID across authentication	Medium	Firm	`session`, `auth`, `session-fixation`
`authz-compare`	Cross-Session Authorization Compare	Compares responses across authenticated sessions to detect IDOR/BOLA	High	Firm	`idor`, `bola`, `auth-bypass`, `access-control`, `api-security`, `moderate`
`bfla-detection`	BFLA Detection	Detects Broken Function-Level Authorization on privileged endpoints	High	Tentative	`auth-bypass`, `api-security`, `moderate`
`idor-guid`	IDOR GUID Predictability	Detects predictable GUID patterns like UUIDv1 with extractable timestamps	Medium	Firm	`idor`, `auth-bypass`, `moderate`

Path Analysis

Module ID	Name	Description	Severity	Confidence	Tags
`path-normalization`	Path Normalization	Path normalization vulnerabilities via traversal payloads against middleware/reverse proxy	High	Firm	`misconfiguration`
`nginx-off-by-slash`	Nginx Off-by-Slash	Nginx alias traversal via missing trailing slash	High	Tentative	`misconfiguration`
`nginx-path-escape`	Nginx Path Escape Detection	Diff-based detection for alias traversal, URL encoding bypass, semicolon injection	Info	Tentative	`misconfiguration`
`reverse-proxy-path-confusion`	Reverse Proxy Path Confusion	Reaches access-controlled backend paths the reverse proxy and origin normalize differently (encoded slashes, dot-segments, semicolons)	High	Firm	`proxy`, `access-control`, `heavy`
`client-path-traversal-confirm`	Client-Side Path Traversal Confirm	Browser-confirms a URL-controlled value escaping a client-side request path prefix	Medium	Firm	`cspt`, `dom`, `browser`, `heavy`
`cdn-object-traversal-listing`	CDN Object-Storage Traversal Listing	Detects bucket object enumeration via ..; path traversal on CDN-fronted object storage	High	Firm	`cloud`, `cloud-storage`, `path-traversal`, `info-disclosure`, `light`

Differential & Behavior Detection

Module ID	Name	Description	Severity	Confidence	Tags
`smart-behavior-detection`	Smart Behavior Detection	Diff-based injection detection via true/false behavioral payload pairs	Info	Tentative	`detection`
`suspect-transform`	Suspect Transform Detection	Expression evaluation, quote consumption, and unicode normalizations	Suspect	Firm	`detection`
`backslash-transformation`	Backslash Transformation	Escape sequence interpretation, backslash consumption, character handling	Suspect	Firm	`detection`
`internal-header-probe`	Internal Header Probe	Fuzzes custom/internal request headers advertised via Access-Control-Allow-Headers and reports value-dependent response changes	Suspect	Tentative	`cors`, `header`, `recon`, `ssrf`, `intrusive`
`dependent-response`	Referer / User-Agent Dependent Response	Response content that varies on a spoofable `Referer` or `User-Agent` — ineffective gating, cloaking, or weak access control — with each variant re-sampled to rule out dynamic-content noise	Info	Firm	`recon`, `behavior`, `cloaking`, `moderate`

Prototype Pollution

Module ID	Name	Description	Severity	Confidence	Tags
`prototype-pollution`	Prototype Pollution	Server-side prototype pollution via `__proto__` and `constructor.prototype` JSON injection	High	Firm	`javascript`, `injection`
`client-prototype-pollution`	Client-Side Prototype Pollution	Client-side prototype pollution via JavaScript static analysis (source + gadget patterns)	Medium	Tentative	`javascript`, `injection`

Race Conditions

Module ID	Name	Description	Severity	Confidence	Tags
`race-interference`	Race Interference Detection	Race conditions via parallel request analysis (input storage, cross-contamination, TOCTOU)	Medium	Firm	`injection`

XML, JWT & HTTP Protocol

Module ID	Name	Description	Severity	Confidence	Tags
`xml-saml-security`	XML SAML Security	XXE and DTD injection in SAML XML processing	High	Firm	`injection`
`jwt-vulnerability`	JWT Vulnerability	JWT algorithm confusion (`none` algorithm, empty signature, RS256→HS256)	Critical	Certain	`injection`
`http-request-smuggling`	HTTP Request Smuggling	CL.TE and TE.CL desync via conflicting Content-Length and Transfer-Encoding	Suspect	Tentative	`injection`

API & Endpoint Security

Module ID	Name	Description	Severity	Confidence	Tags
`graphql-scan`	GraphQL Security Scanner	Runs only against a confirmed GraphQL endpoint: introspection & schema exercise, exposed IDE/console (GraphiQL/Playground/Altair), error- and boolean-based SQLi, field-level authorization (IDOR/BOLA), reflected XSS in errors, uncapped query batching, and DoS via deeply-nested/aliased/circular queries. Endpoint discovery walks endpoint names over parent-path prefixes and nested `api`/version permutations	Medium	Certain	`graphql`, `injection`, `idor`, `bola`, `xss`, `dos`, `batching`, `console`
`file-upload-scan`	File Upload Scanner	File upload bypass (extension, null byte, magic bytes, SVG XXE, HTML XSS); a PHP web shell is confirmed by an arithmetic execution marker that proves evaluation, not mere storage	High	Certain	`injection`
`default-credentials`	Default Credentials	Login endpoints tested with common credential pairs; CAPTCHA/lockout aware	High	Certain	`auth-bypass`
`sensitive-file-discovery`	Sensitive File Discovery	~25 marker-based sensitive files and ~1,350 generic paths (.env, .git, logs)	Medium	Tentative	`info-disclosure`
`jsonp-callback`	JSONP Callback Injection	JSONP endpoints via callback injection enabling cross-origin data theft	Medium	Firm	`injection`
`grpc-surface-audit`	gRPC-Web Surface Audit	gRPC-Web (HTTP/1.1) endpoints with missing authorization and exposed reflection/health services	High	Firm	`grpc`, `api`, `authorization`, `heavy`
`llm-boundary-probe`	LLM Boundary Probe	Probes LLM endpoints for system-prompt / secret disclosure and tool abuse	High	Firm	`llm`, `ai`, `prompt-injection`, `heavy`
`api-key-url-exposure`	API Key in URL	Detects API keys that work when moved from headers to URL parameters	Medium	Firm	`info-disclosure`, `api-security`, `light`
`api-spec-ingest`	API Spec Ingest	Discovers API specs (OpenAPI/Swagger/Postman) and ingests endpoints for scanning	Info	Firm	`api`, `discovery`, `spec-ingest`, `light`
`sourcemap-ingest`	Source Map Ingest	Fetches an exposed `.map`, recovers the original pre-build source, secret-scans it and ingests the routes it reveals. Found via `sourceMappingURL`, a `SourceMap` header, or the conventional `<bundle>.map` sibling	Medium	Certain	`sourcemap`, `information-disclosure`, `javascript`, `discovery`, `spec-ingest`, `light`
`swagger-exposure`	Exposed API Documentation	Detects publicly exposed Swagger/OpenAPI/Redoc documentation routes	Low	Firm	`api`, `discovery`, `swagger`, `openapi`, `exposure`, `info-leak`, `light`
`ws-cswsh`	WebSocket CSWSH	Tests for Cross-Site WebSocket Hijacking via insufficient origin validation	Medium	Firm	`csrf`, `session`, `moderate`
`ws-injection`	WebSocket Injection	Tests for injection vulnerabilities in parameters forwarded to WebSocket message processing	Medium	Firm	`injection`, `xss`, `moderate`

Proxy & Utility

Module ID	Name	Description	Severity	Confidence	Tags
`proxy-header-trust`	Proxy Header Trust	Cross-framework proxy header trust issues via X-Forwarded-* manipulation	High	Firm	`misconfiguration`, `moderate`
`api-rate-limit-bypass`	API Rate Limit Bypass	Rate limiting bypass via IP spoofing headers	Medium	Firm	`auth-bypass`, `moderate`
`backup-file-discovery`	Backup File Discovery	Exposed backup archives derived from hostname and year variants	Medium	Tentative	`sensitive-file`, `moderate`
`angular-template-injection`	Angular Template Injection	Angular template injection via expression evaluation	High	Firm	`angular`, `injection`, `ssti`

SQL Injection (Time-Based)

Module ID	Name	Description	Severity	Confidence	Tags
`sqli-time-blind`	Blind SQL Injection (Time-Based)	Time-based blind SQLi with a per-target statistical delay threshold and multi-round confirmation that the delay scales with the injected sleep value (rejects fixed/jitter delays); prioritizes payloads by any DBMS identified for the host	Suspect	Tentative	`injection`, `sqli`, `heavy`

Module ID	Name	Description	Severity	Confidence	Tags
`ssrf-blind`	Blind SSRF Detection	Blind SSRF via OAST callbacks	High	Firm	`ssrf`, `injection`, `heavy`
`ssti-blind`	Blind SSTI	Blind SSTI via OAST callbacks and time-delay payloads; JVM template stacks are confirmed with a pure-JVM DNS/URL callback that needs no shell on the target	Critical	Firm	`injection`, `ssti`, `heavy`

Framework Security

Next.js

Module ID	Name	Description	Severity	Confidence	Tags
`nextjs-data-leakage`	Next.js Data Route Leakage	Unauthorized access to `/_next/data/<buildId>/<path>.json`	High	Firm	`nextjs`, `javascript`
`nextjs-middleware-bypass`	Next.js Middleware Bypass	CVE-2025-29927 and path normalization bypasses	Critical	Firm	`nextjs`, `javascript`
`nextjs-image-ssrf`	Next.js Image Optimizer SSRF	SSRF via `/_next/image` with OAST and in-band probes	High	Firm	`nextjs`, `javascript`
`nextjs-draft-mode-exposure`	Next.js Draft Mode Exposure	Insecure or unprotected Draft/Preview Mode endpoints	High	Firm	`nextjs`, `javascript`
`nextjs-version-audit`	Next.js Version Audit	Fingerprints Next.js version and maps to known CVE advisories	High	Firm	`nextjs`, `javascript`, `fingerprint`
`js-devserver-exposure`	JS Dev Server Exposure	Exposed webpack HMR, Vite, Nuxt, Remix dev server endpoints	Medium	Firm	`javascript`
`fastify-hono-probe`	Fastify/Hono Probe	Detects exposed Fastify and Hono framework endpoints	Medium	Firm	`nodejs`, `misconfiguration`, `light`
`metaframework-probe`	Metaframework Probe	Detects exposed Remix, Astro, and SvelteKit internal files and endpoints	Low	Firm	`javascript`, `misconfiguration`, `light`
`nextjs-chunk-audit`	Next.js Static Chunk Audit	Fetches Next.js static JS chunks and extracts routes, domains, and embedded secrets	Info	Certain	`nextjs`, `javascript`, `intel`, `info-disclosure`, `medium`, `light`
`react-rsc-rce`	React Server Components RCE	The React Flight server-action decoder RCE (CVE-2025-55182 / CVE-2025-66478) — a crafted colon-delimited object reference makes the decoder dereference a missing property, surfacing as a Next.js error digest while a well-formed control request does not	Critical	Firm	`nextjs`, `react`, `rce`, `deserialization`, `heavy`

Spring / Java

Module ID	Name	Description	Severity	Confidence	Tags
`spring-actuator-misconfig`	Spring Actuator Misconfiguration	Exposed Spring Boot actuator endpoints leaking env vars, health, config	High	Firm	`spring`, `java`, `misconfiguration`, `info-disclosure`, `light`
`spring-boot-admin-exposure`	Spring Boot Admin Exposure	Exposed Spring Boot Admin dashboards	High	Firm	`spring`, `java`
`spring-cloud-config-exposure`	Spring Cloud Config Exposure	Exposed Config Server endpoints leaking secrets	Critical	Firm	`spring`, `java`
`spring-data-rest-exposure`	Spring Data REST Exposure	Auto-exposed repository endpoints with HAL/HATEOAS	Medium	Firm	`spring`, `java`
`spring-debug-exposure`	Spring Debug Exposure	Debug endpoints, Whitelabel errors, stack traces	Medium	Firm	`spring`, `java`
`spring-gateway-exposure`	Spring Gateway Exposure	Exposed Cloud Gateway actuator revealing routes	High	Firm	`spring`, `java`
`spring-h2-console-exposure`	Spring H2 Console Exposure	Exposed H2 database web consoles	Medium	Firm	`spring`, `java`, `rce`
`spring-jolokia-exposure`	Spring Jolokia Exposure	Exposed Jolokia JMX endpoints	High	Firm	`spring`, `java`
`java-appserver-console`	Java App Server Console	Exposed admin consoles (WildFly, WebLogic, GlassFish)	High	Firm	`java`, `tomcat`
`java-sensitive-files`	Java Sensitive Files	Java config files, WEB-INF, META-INF, build artifacts	Medium	Tentative	`java`, `sensitive-file`
`tomcat-manager-exposure`	Tomcat Manager Exposure	Exposed Tomcat Manager and Host Manager interfaces	High	Firm	`tomcat`, `java`

Django / Flask / FastAPI (Python)

Module ID	Name	Description	Severity	Confidence	Tags
`django-admin-exposure`	Django Admin Exposure	Exposed Django admin panel and login page	Low	Firm	`django`, `python`
`django-browsable-api-exposure`	Django Browsable API Exposure	DRF browsable API detected via Accept header	Info	Firm	`django`, `python`
`django-debug-exposure`	Django Debug Exposure	Django DEBUG=True information disclosure	High	Firm	`django`, `python`
`django-debug-toolbar-exposure`	Django Debug Toolbar Exposure	Exposed django-debug-toolbar panels	High	Firm	`django`, `python`
`flask-werkzeug-debugger`	Flask Werkzeug Debugger	Exposed Werkzeug interactive debugger (RCE)	Critical	Certain	`flask`, `python`, `rce`
`fastapi-docs-exposure`	FastAPI Docs Exposure	Exposed FastAPI interactive API documentation	Info	Firm	`fastapi`, `python`
`fastapi-auth-inconsistency`	FastAPI Auth Inconsistency	Unprotected operations found via OpenAPI schema	Medium	Firm	`fastapi`, `python`

Laravel / Symfony / PHP

Module ID	Name	Description	Severity	Confidence	Tags
`laravel-admin-exposure`	Laravel Admin Exposure	Exposed admin panels, API docs, GraphQL endpoints	High	Tentative	`laravel`, `php`
`laravel-devtool-exposure`	Laravel Developer Tool Exposure	Exposed Web Tinker, Clockwork, Pulse, Log Viewer	High	Firm	`laravel`, `php`
`laravel-ignition-rce`	Laravel Ignition RCE	CVE-2021-3129 RCE via exposed Ignition endpoints	Critical	Firm	`laravel`, `php`, `rce`
`laravel-misconfig`	Laravel Misconfiguration	Debug mode, exposed debugbar, application logs	High	Firm	`laravel`, `php`
`laravel-sensitive-files`	Laravel Sensitive Files	PHPUnit config, SQLite DB, storage internals	Medium	Tentative	`laravel`, `php`
`symfony-misconfig`	Symfony Misconfiguration	Exposed profiler, debug toolbar, dev front controller	High	Firm	`symfony`, `php`
`php-composer-exposure`	PHP Composer Exposure	Exposed Composer manifests, vendor directory	High	Firm	`php`
`php-debug-exposure`	PHP Debug Exposure	Exposed phpinfo, PHP-FPM status, phpMyAdmin	Medium	Firm	`php`
`php-framework-debug`	PHP Framework Debug Exposure	Debug endpoints for Yii, CodeIgniter, CakePHP	Medium	Firm	`php`
`php-path-info-misconfig`	PHP PATH_INFO Misconfiguration	cgi.fix_pathinfo routing ambiguity	Medium	Firm	`php`
`php-source-disclosure`	PHP Source Disclosure	PHP source code via .phps handlers	High	Firm	`php`

Rails (Ruby)

Module ID	Name	Description	Severity	Confidence	Tags
`rails-info-exposure`	Rails Info Exposure	Exposed Rails dev/debug endpoints in production	High	Firm	`rails`, `ruby`
`rails-admin-dashboard`	Rails Admin Dashboard	Exposed Rails ecosystem admin panels	High	Firm	`rails`, `ruby`
`rails-sensitive-files`	Rails Sensitive Files	Exposed Rails config, credentials, artifacts	Medium	Tentative	`rails`, `ruby`
`rails-action-mailbox-probe`	Rails Action Mailbox Probe	Exposed Action Mailbox ingress endpoints	Medium	Firm	`rails`, `ruby`
`rails-active-storage-probe`	Rails Active Storage Probe	Exposed Active Storage direct upload endpoints	Medium	Tentative	`rails`, `ruby`

Express (Node.js)

Module ID	Name	Description	Severity	Confidence	Tags
`express-debug-probe`	Express Debug Probe	Stack trace and debug info leakage	Low	Firm	`express`, `javascript`
`express-directory-listing`	Express Directory Listing	Directory listing via serve-index middleware	Low	Firm	`express`, `javascript`
`express-trust-proxy-misconfig`	Express Trust Proxy Misconfiguration	Trust proxy misconfiguration via X-Forwarded-*	Medium	Firm	`express`, `javascript`

ASP.NET / IIS

Module ID	Name	Description	Severity	Confidence	Tags
`aspnet-blazor-exposure`	ASP.NET Blazor Exposure	Exposed Blazor WebAssembly assemblies and Server endpoints	Medium	Firm	`aspnet`
`aspnet-health-exposure`	ASP.NET Health Endpoint Exposure	Exposed health checks, monitoring dashboards, metrics	Medium	Firm	`aspnet`
`aspnet-identity-probe`	ASP.NET Identity Probe	Exposed Identity endpoints and IdentityServer	Medium	Firm	`aspnet`
`aspnet-misconfig`	ASP.NET Misconfiguration	Exposed diagnostics, debug endpoints, verbose errors	High	Firm	`aspnet`
`aspnet-sensitive-files`	ASP.NET Sensitive Files	Exposed config files, backups, sensitive directories	Medium	Tentative	`aspnet`
`aspnet-service-exposure`	ASP.NET Service Exposure	Exposed ASMX, WCF, OData, legacy service paths	Medium	Firm	`aspnet`
`aspnet-viewstate-scan`	ASP.NET ViewState Scan	ViewState MAC disabled, event validation bypass	High	Firm	`aspnet`
`iis-shortname-discovery`	IIS Short Filename Discovery	IIS 8.3 short-filename enumeration via a tilde-based oracle, resolving names to feed content discovery	Medium	Certain	`iis`, `aspnet`, `info-disclosure`, `heavy`
`iis-cookieless-source-disclosure`	IIS Cookieless Source/Config Disclosure	Downloads protected ASP.NET config/source via cookieless (`S(X)`) path-confusion	High	Firm	`iis`, `aspnet`, `info-disclosure`, `heavy`
`iis-extension-confusion-bypass`	IIS Extension Confusion Bypass	NTFS `::$DATA` source disclosure and trailing-dot / `::$INDEX_ALLOCATION` access-control bypass	High	Firm	`iis`, `aspnet`, `access-control`, `info-disclosure`, `heavy`

Firebase

Module ID	Name	Description	Severity	Confidence	Tags
`firebase-auth-misconfig`	Firebase Auth Misconfiguration	Firebase Authentication misconfigurations	Medium	Firm	`firebase`
`firebase-functions-exposure`	Firebase Functions Exposure	Unauthenticated Cloud Functions	Medium	Firm	`firebase`
`firebase-misconfig`	Firebase Misconfiguration	Exposed Firebase config, security rules, credentials	High	Firm	`firebase`
`firebase-rtdb-exposure`	Firebase RTDB Exposure	Publicly readable Realtime Database	Medium	Certain	`firebase`
`firebase-storage-exposure`	Firebase Storage Exposure	Publicly accessible Cloud Storage buckets	High	Certain	`firebase`, `cloud`

Cloud Infrastructure

Module ID	Name	Description	Severity	Confidence	Tags
`cloud-bucket-takeover`	Cloud Bucket Takeover	Dangling cloud storage buckets vulnerable to takeover	High	Firm	`cloud`
`cloud-origin-bypass`	Cloud Origin Bypass	Direct access to origins bypassing CDN security	Medium	Firm	`cloud`
`cloud-public-read`	Cloud Public Read	Publicly readable sensitive paths on cloud storage	High	Firm	`cloud`
`cloud-storage-listing`	Cloud Storage Listing	Publicly listable S3 buckets and Azure containers	High	Certain	`cloud`

CMS (WordPress, Drupal, Joomla, Magento)

Module ID	Name	Description	Severity	Confidence	Tags
`wp-misconfig`	WordPress Misconfiguration	Exposed config files, debug logs, dangerous endpoints	High	Firm	`wordpress`, `php`
`wp-user-enum`	WordPress User Enumeration	User enumeration via author archives and REST API	Info	Certain	`wordpress`, `php`
`wp-xmlrpc`	WordPress XML-RPC Abuse	XML-RPC multicall brute-force and pingback abuse	Medium	Firm	`wordpress`, `php`
`wp-ajax-exposure`	WordPress AJAX Action Exposure	Publicly accessible AJAX actions from plugins	High	Firm	`wordpress`, `php`
`drupal-misconfig`	Drupal Misconfiguration	Exposed config files, update scripts, installer	High	Firm	`drupal`, `php`
`drupal-user-enum`	Drupal User Enumeration	User enumeration via user profiles and JSON:API	Info	Certain	`drupal`, `php`
`joomla-misconfig`	Joomla Misconfiguration	Exposed config backups, log/temp dirs, debug settings	High	Firm	`joomla`, `php`
`joomla-user-enum`	Joomla User Enumeration	User enumeration via registration, API, admin login	Info	Firm	`joomla`, `php`
`magento-misconfig`	Magento Misconfiguration	Exposed setup wizard, downloader, version files	High	Firm	`magento`, `php`
`cms-installer-exposure`	CMS Installer Exposure	Exposed WordPress, Drupal, and Joomla install wizards	Critical	Firm	`wordpress`, `drupal`, `joomla`

Adobe Experience Manager (AEM)

Every module gates on a confirmed AEM instance (passive-aem-fingerprint), is detection-only, and confirms across multiple rounds.

Module ID	Name	Description	Severity	Confidence	Tags
`aem-dispatcher-bypass`	AEM Dispatcher ACL Bypass	Differential confirmation: a protected servlet blocked on the direct path but reachable through a path-normalization trick	High	Certain	`aem`, `adobe`, `dispatcher`, `cms`
`aem-sensitive-servlet`	AEM Sensitive Servlet Disclosure	Info disclosure via AEM servlets (QueryBuilder password-hash leak, GQL/DefaultGetServlet dumps, userinfo, loginstatus, truststore), incl. dispatcher-bypass reachability	High	Firm	`aem`, `adobe`, `info-disclosure`, `cms`
`aem-console-exposure`	AEM Console & Admin Panel Exposure	Internet-reachable AEM developer/admin consoles (CRXDE Lite, CRX Package Manager, CRX Explorer, admin dashboards) and ACL bypasses to them	High	Firm	`aem`, `adobe`, `misconfiguration`, `cms`
`aem-content-discovery`	AEM Repository Content Discovery	Routing-aware JCR enumeration via Sling selectors (`.1.json`) and QueryBuilder predicates, harvesting config secrets, user accounts, and writable nodes (`rep:password` → Critical)	High	Firm	`aem`, `adobe`, `info-disclosure`, `jcr`, `cms`
`aem-default-credentials`	AEM Default Credentials	AEM default and demo-account credentials on the Granite login and Felix Web Console	High	Certain	`aem`, `adobe`, `default-credentials`, `cms`
`aem-cloudsettings-injection`	AEM Cloud Settings Node Write / EL Injection	BulkImportConfigServlet pre-auth node write (CVE-2025-54246) and the EL injection it enables (CVE-2025-54247/54248), proven with a benign marker / `7*7` read-back	Critical	Firm	`aem`, `adobe`, `el-injection`, `rce`, `cms`
`aem-xss`	AEM Reflected XSS	Reflected XSS in AEM-specific sinks (childlist selector, CRXDE setPreferences, DAM merge-metadata, WCM contentfinder) with headless popup confirmation	High	Firm	`aem`, `adobe`, `xss`, `cms`
`aem-ssrf`	AEM SSRF-Capable Proxy Servlet Exposure	Reachable AEM proxy/fetch servlets known for SSRF (ContentInsight proxy, opensocial/shindig, SalesforceSecretServlet, accesstoken/verify) — surface detection, no OAST fired	Medium	Tentative	`aem`, `adobe`, `ssrf`, `cms`
`aem-oob-injection`	AEM Blind SSRF / XXE (Out-of-Band)	Out-of-band probes for the AccessTokenServlet full-read SSRF (CVE-2025-54249) and CRX Package Manager blind XXE (CVE-2025-54251), confirmed by collaborator callback	High	Firm	`aem`, `adobe`, `ssrf`, `xxe`, `oob`, `cms`
`aem-xxe`	AEM Adaptive Forms XXE	XML external-entity processing in Adaptive Forms `guideContainer` internalsubmit (CVE-2019-8086) via an exploit-free internal-entity expansion proof	High	Firm	`aem`, `adobe`, `xxe`, `cms`
`aem-rce-surface`	AEM RCE-Capable Surface Exposure	Exposed AEM code-execution surfaces (Groovy Console, ACS Fiddle, Forms GetDocumentServlet, WebDAV PUT) — detection only, no exec/write payload sent	Critical	Firm	`aem`, `adobe`, `rce`, `cms`

SaaS Platforms (Salesforce / ServiceNow / Power Pages)

Each family gates on a live per-vendor fingerprint, pairs a catch-all negative control with the positive, and confirms across multiple rounds.

Module ID	Name	Description	Severity	Confidence	Tags
`salesforce-aura-object-exposure`	Salesforce Aura Guest Object Enumeration	An Experience Cloud Guest user can invoke the Aura `getConfigData` action and enumerate accessible SObjects (incl. custom `__c`) — an over-permissive Guest profile	Medium	Firm	`salesforce`, `aura`, `lightning`, `info-disclosure`
`salesforce-aura-record-exposure`	Salesforce Aura Guest Record Exposure	Unauthenticated read of SObject records (User, Contact, Case, Lead, custom `__c`) through the Aura `getItems` action	High	Certain	`salesforce`, `aura`, `lightning`, `idor`, `info-disclosure`
`salesforce-aura-apex-execution`	Salesforce Aura Guest Apex Execution	An unauthenticated Guest user can invoke `@AuraEnabled` Apex via `ApexActionController.execute` — the pivot for guest-driven SSRF, DML, and exfiltration	High	Firm	`salesforce`, `aura`, `lightning`, `apex`, `ssrf`
`salesforce-lightning-debug-mode`	Salesforce Lightning Debug Mode Enabled	A Lightning/Experience Cloud site served in an Aura debug mode (`PRODDEBUG`/`DEV`/`JSTESTDEBUG`) leaking un-minified code and backend stacktraces	Medium	Firm	`salesforce`, `aura`, `lightning`, `debug`, `info-disclosure`
`servicenow-widget-data-exposure`	ServiceNow Public Widget Data Exposure	Unauthenticated read of arbitrary ServiceNow tables (`sys_user`, `incident`, `cmdb_ci`, attachments, OAuth) via the public Simple/Unordered List widgets	High	Certain	`servicenow`, `idor`, `info-disclosure`, `api`
`servicenow-kb-widget-exposure`	ServiceNow Knowledge Base Widget Exposure	Unauthenticated read of KB article contents via the public KB Article Page widget (not covered by the 2023 ACL hardening — KB access is gated by User Criteria, not ACLs)	High	Certain	`servicenow`, `idor`, `info-disclosure`, `api`
`powerpages-dataverse-exposure`	Power Pages Dataverse Web API Data Exposure	Unauthenticated read of Microsoft Dataverse tables (contacts, accounts, leads, cases, custom) via a Power Pages portal’s `/_api/` Web API	High	Certain	`powerpages`, `dataverse`, `idor`, `info-disclosure`, `api`

Model Context Protocol (MCP)

Audited against OWASP; every active probe gates on a reachable MCP endpoint (passive-mcp-endpoint-detect).

Module ID	Name	Description	Severity	Confidence	Tags
`mcp-server-probe`	MCP Server Probe	Probes for exposed MCP servers, enumerates tools, and attempts unauthenticated invocation	High	Firm	`mcp`, `api-security`, `misconfiguration`
`mcp-tool-fuzz`	MCP Tool Argument Fuzzer	Fuzzes every enumerable MCP tool’s arguments for OS command injection, LFI, SSRF (OAST), and prompt injection	High	Firm	`mcp`, `rce`, `lfi`, `ssrf`, `injection`
`mcp-resource-fuzz`	MCP Resource URI Fuzzer	Probes `resources/read` with `file://`, cloud-metadata, path-traversal, and OAST SSRF payloads	High	Firm	`mcp`, `lfi`, `ssrf`, `path-traversal`
`mcp-prompt-fuzz`	MCP Prompt Argument Fuzzer	Fuzzes `prompts/get` arguments for SSTI, command injection, and reflective prompt injection	High	Firm	`mcp`, `ssti`, `rce`, `prompt-injection`
`mcp-completion-enum`	MCP Completion Enumeration	Uses `completion/complete` to leak valid resource URIs and prompt argument values	Medium	Firm	`mcp`, `info-disclosure`, `enumeration`
`mcp-method-enum`	MCP JSON-RPC Method Enumeration	Wordlist enumeration of undocumented JSON-RPC methods on MCP servers	Medium	Firm	`mcp`, `enumeration`, `info-disclosure`
`mcp-session-checks`	MCP Session Hardening Checks	Tests `Mcp-Session-Id` entropy, attacker-supplied SID acceptance (fixation), and post-handshake reuse	Medium	Firm	`mcp`, `session`, `auth-bypass`
`mcp-batch-abuse`	MCP JSON-RPC Batch Abuse	Tests JSON-RPC batch handling: a smuggled `tools/call` inside an `initialize` batch	High	Firm	`mcp`, `auth-bypass`
`mcp-origin-rebinding`	MCP Origin / DNS-Rebinding Check	Verifies an MCP server enforces Origin validation on streamable HTTP transports	High	Firm	`mcp`, `dns-rebinding`, `origin`
`mcp-tool-definition-drift`	MCP Tool Definition Drift	Detects MCP servers serving mutating, non-deterministic tool definitions (rug-pull risk)	Medium	Tentative	`mcp`, `rug-pull`, `integrity`
`mcp-dos-amplification`	MCP DoS Amplification	An unbounded oversized `ping` batch processed with no size or rate limit	Medium	Firm	`mcp`, `dos`, `rate-limit`

Passive Modules (117)

Passive modules analyze existing request/response pairs without sending new traffic.

XSS

Module ID	Name	Description	Severity	Confidence	Tags
`dom-xss-detect`	DOM XSS Detect	DOM XSS source-to-sink data flows (location.hash, innerHTML, eval, document.write)	Low	Firm	`xss`
`css-injection-detect`	CSS Injection	Request values reflected into a `<style>` block or `style=` attribute	Info	Tentative	`client-side`, `css-injection`, `reflection`
`dom-clobbering`	DOM Clobbering Gadget	JavaScript that feeds a named-property global (`window.x` / `id`-addressed element) into a dangerous sink	Info	Tentative	`client-side`, `dom-clobbering`, `javascript`
`client-path-taint`	Client-Side Path Traversal (taint candidate)	URL-controlled source flowing into a client-side request path	Low	Firm	`cspt`, `dom`, `javascript`, `light`
`dom-xss-taint`	DOM XSS (taint analysis)	Reports DOM XSS where a controllable source provably flows into a dangerous sink	Low	Firm	`xss`, `dom`, `taint`

Authentication & Session

Module ID	Name	Description	Severity	Confidence	Tags
`auth-headers-detect`	Auth Headers Detect	Authorization headers (Bearer tokens, API keys) in requests	Info	Tentative	`session`, `auth`
`jwt-weak-secret`	JWT Weak Secret Detection	Offline brute-force of JWT HMAC secrets against ~104K wordlist	High	Firm	`session`, `auth`
`cookie-security-detect`	Cookie Security Detect	Insecure cookie attributes (missing Secure, HttpOnly, SameSite)	Low	Certain	`session`, `auth`
`password-autocomplete-detect`	Password Autocomplete	Password fields without `autocomplete="off"`	Info	Certain	`session`, `auth`

Injection Signals

Module ID	Name	Description	Severity	Confidence	Tags
`sql-syntax-detect`	SQL Syntax in Request	SQL statements/keywords in HTTP request parameter values	Info	Firm	`injection`
`serialized-object-detect`	Serialized Object Detection	Serialized Java/PHP/.NET/Python objects in request parameters	Low	Firm	`injection`
`input-reflection-detect`	Input Reflection Detect	Request parameter values reflected verbatim in response bodies	Info	Tentative	`injection`
`base64-data-detect`	Base64 Data Detect	Interesting base64 data (JSON, PHP objects, URLs, Java objects) in requests/responses	Info	Tentative	`injection`

Information Disclosure

Module ID	Name	Description	Severity	Confidence	Tags
`secret-detect`	Secret Detection	Leaked secrets, API keys, and credentials via Kingfisher engine	High	Firm	`info-disclosure`
`info-disclosure-detect`	Info Disclosure Detect	Server versions, internal IPs, stack traces, debug information	Low	Firm	`info-disclosure`
`error-message-detect`	Error Message Detect	Error messages from debug pages, Apache, ASP.NET, Java, PHP, Ruby, Node.js, SQL	Info	Firm	`info-disclosure`
`sourcemap-detect`	Sourcemap Exposure	Exposed source maps, referenced from JS or CSS `sourceMappingURL` comments, `eval` strings, or a `SourceMap` / `X-SourceMap` header. `sourcemap-ingest` then fetches and parses what this finds	Low	Firm	`info-disclosure`
`sensitive-url-params`	Sensitive URL Params	Passwords, tokens, API keys passed in URL query parameters	Medium	Firm	`info-disclosure`
`content-type-mismatch`	Content Type Mismatch	Content-Type/body mismatches enabling MIME confusion attacks	Low	Firm	`info-disclosure`
`verbose-error-stacktrace`	Verbose Error Stack Trace	Detects full stack traces with file paths in HTTP responses	Medium	Firm	`info-disclosure`, `light`
`sensitive-header-leak`	Sensitive Data in Response Headers	Detects high-entropy / key-shaped values disclosed in custom response headers	Medium	Firm	`info-disclosure`, `secrets`, `headers`, `light`
`api-pagination-leak`	API Pagination Leak	Detects API pagination metadata that reveals total record counts	Info	Tentative	`api`, `info-disclosure`, `light`
`directory-listing-detect`	Directory Listing Detect	Passively detects directory listing exposure in HTTP responses	Low	Firm	`info-disclosure`, `misconfiguration`, `directory-listing`, `light`
`software-version-header`	Software Version Header	Detects HTTP headers that disclose specific software version strings	Info	Certain	`fingerprint`, `info-disclosure`, `light`
`subdomain-harvest`	Subdomain Harvest	Collects in-scope subdomains referenced in HTML/JS responses for recon	Info	Certain	`recon`, `subdomain`, `fingerprint`, `light`

Source & Supply-Chain Analysis

Module ID	Name	Description	Severity	Confidence	Tags
`js-beautify`	JavaScript Beautifier	Unminifies and unpacks bundled first-party JS into readable, module-annotated source (embedded jstangle/webcrack, no `eval`); rewrites the stored JS record so downstream analysis reads clean source	Info	Certain	`javascript`, `beautify`, `deobfuscation`, `source-analysis`
`dependency-confusion`	Dependency Confusion Candidate	Flags scoped npm package names referenced in first-party JS that are left unclaimed (404) on the public registry	Suspect	Tentative	`dependency-confusion`, `supply-chain`, `source-analysis`, `npm`

Security Headers & Configuration

Module ID	Name	Description	Severity	Confidence	Tags
`security-headers-missing`	Security Headers Missing	Missing X-Content-Type-Options, X-Frame-Options, HSTS, CSP, Permissions-Policy	Info	Certain	`header-security`
`mixed-content-detect`	Mixed Content Detect	HTTP resources loaded on HTTPS pages (src, href, action attributes)	Low	Certain	`header-security`
`clickjacking-detect`	Clickjacking (UI Redress)	Detects framable pages with sensitive/interactive content vulnerable to clickjacking	Medium	Firm	`clickjacking`, `ui-redress`, `header-security`, `misconfiguration`, `light`

CORS & Redirect

Module ID	Name	Description	Severity	Confidence	Tags
`cors-headers-detect`	CORS Headers Detect	Permissive CORS headers (wildcard origin, credentials enabled)	Low	Firm	`cors`
`openredirect-params`	Open Redirect Params	URL parameter names associated with open redirects (redirect, url, next, goto)	Info	Tentative	`cors`
`oauth-facebook-detect`	Facebook OAuth Detect	Facebook OAuth redirect parameters for OAuth flow analysis	Info	Firm	`cors`
`reverse-tabnabbing-detect`	Reverse Tabnabbing	`target=_blank` links to cross-origin URLs missing `rel=noopener`	Low	Firm	`client-side`, `tabnabbing`, `html`

Access Control

Module ID	Name	Description	Severity	Confidence	Tags
`csrf-detect`	CSRF Detection	State-changing requests (POST/PUT/DELETE/PATCH) missing anti-CSRF protections	Medium	Tentative	`auth-bypass`
`idor-params-detect`	IDOR Parameter Detection	Parameters referencing object identifiers for IDOR/BOLA triage	Info	Tentative	`auth-bypass`
`payment-integration-audit`	Payment Integration Risk Surface	Flags client-controlled amounts / trusted payment-status params on payment-gateway checkout pages (Stripe, PayPal, Braintree, Square, Adyen, Razorpay, Checkout.com)	Info	Tentative	`payment`, `business-logic`, `recon`

Cryptography

Module ID	Name	Description	Severity	Confidence	Tags
`crypto-weakness-detect`	Cryptographic Weakness	PHP magic hashes, weak MD5/SHA1, padding oracle errors, unprotected encrypted cookies	Medium	Tentative	`crypto`

Anomaly Detection

Module ID	Name	Description	Severity	Confidence	Tags
`anomaly-ranking`	Anomaly Ranking	Statistical anomaly detection across per-host response batches; updates risk_score	Suspect	Tentative	`detection`
`surface-scoring`	Attack Surface Scoring	Deterministic attack-surface score (0-100, percent of a 17-signal set present); writes `surface_score` and the host’s `technology` stack onto every record	Info	Certain	`detection`, `recon`

surface-scoring writes columns, not findings. It produces http_records.surface_score - an absolute, reproducible score you can rank a large sweep by - and flushes each host’s detected stack into http_records.technology. Contrast anomaly-ranking, whose risk_score is a rank within the batch a record was flushed alongside, so it answers “is this unusual here” rather than “is this worth attacking”. See Probe → Attack-surface scoring.

JS Framework Security (Runtime Analysis)

Module ID	Name	Description	Severity	Confidence	Tags
`js-framework-fingerprint`	JS Framework Fingerprint	Identifies Next.js, Nuxt, Angular, React, Remix, SvelteKit, Gatsby; extracts buildId	Info	Certain	`javascript`
`ssr-data-exposure`	SSR Data Exposure	Sensitive data in SSR state blobs (`__NEXT_DATA__`, `__NUXT__`, `__INITIAL_STATE__`)	Medium	Firm	`javascript`
`cache-auth-misconfiguration`	Cache-Auth Misconfiguration	Cacheable responses with user-specific data missing Vary headers	Medium	Tentative	`javascript`
`server-action-auth`	Server Action Auth Check	Next.js Server Actions with mutation operations but no authorization	Medium	Tentative	`javascript`
`nextjs-config-audit`	Next.js Config Audit	Insecure Next.js config (dangerouslyAllowSVG, wildcard image domains, prod sourcemaps)	Medium	Firm	`javascript`
`client-auth-guard`	Client Auth Guard Check	Client-only auth guards (useEffect redirects) without server-side enforcement	Info	Tentative	`javascript`
`cache-data-leak`	Cache Data Leak	`getStaticProps`/force-static with auth, `unstable_cache` without user-scoped keys	Medium	Tentative	`javascript`

JS Framework Security (Source Analysis)

Module ID	Name	Description	Severity	Confidence	Tags
`unsafe-html-sink`	Unsafe HTML Sink	Raw HTML injection sinks: `dangerouslySetInnerHTML`, `v-html`, `{@html}`, `innerHTML`	Low	Firm	`javascript`
`insecure-token-storage`	Insecure Token Storage	Auth tokens stored in `localStorage`/`sessionStorage`	Medium	Firm	`javascript`
`env-secret-exposure`	Environment Secret Exposure	Secrets in `NEXT_PUBLIC_`, `VITE_`, `REACT_APP_` public env vars; served `.env` files	Medium	Tentative	`javascript`
`build-misconfig-detect`	Build Misconfiguration	Prod sourcemaps, dev mode in production, SVG XSS risk, broad image `remotePatterns`	High	Firm	`javascript`

Framework Fingerprinting

Module ID	Name	Description	Severity	Confidence	Tags
`aspnet-fingerprint`	ASP.NET Fingerprint	Fingerprints ASP.NET version and configuration	Info	Certain	`aspnet`, `fingerprint`
`aspnet-viewstate-detect`	ASP.NET ViewState Detect	Analyzes ViewState fields for security issues	Low	Firm	`aspnet`
`django-fingerprint`	Django Fingerprint	Fingerprints Django framework indicators	Info	Certain	`django`, `python`, `fingerprint`
`express-fingerprint`	Express Fingerprint	Fingerprints Express.js indicators	Info	Certain	`express`, `fingerprint`
`fastapi-fingerprint`	FastAPI Fingerprint	Fingerprints FastAPI framework indicators	Info	Certain	`fastapi`, `python`, `fingerprint`
`firebase-fingerprint`	Firebase Fingerprint	Fingerprints Firebase SDK usage and config	Info	Certain	`firebase`, `fingerprint`
`flask-fingerprint`	Flask Fingerprint	Fingerprints Flask framework indicators	Info	Certain	`flask`, `python`, `fingerprint`
`laravel-fingerprint`	Laravel Fingerprint	Fingerprints Laravel framework indicators	Info	Certain	`laravel`, `php`, `fingerprint`
`rails-fingerprint`	Rails Fingerprint	Fingerprints Rails framework indicators	Info	Certain	`rails`, `ruby`, `fingerprint`
`spring-fingerprint`	Spring Fingerprint	Fingerprints Spring Boot indicators	Info	Certain	`spring`, `java`, `fingerprint`
`drupal-fingerprint`	Drupal Fingerprint	Fingerprints Drupal CMS indicators	Info	Certain	`drupal`, `php`, `fingerprint`
`joomla-fingerprint`	Joomla Fingerprint	Fingerprints Joomla CMS indicators	Info	Certain	`joomla`, `php`, `fingerprint`
`wp-fingerprint`	WordPress Fingerprint	Fingerprints WordPress CMS indicators	Info	Certain	`wordpress`, `php`, `fingerprint`
`aem-fingerprint`	AEM Fingerprint	Identifies Adobe Experience Manager (Sling/CRX/Granite) from headers, cookies, and body markers, and gates the `aem-*` active family	Info	Certain	`aem`, `adobe`, `cms`, `fingerprint`
`salesforce-fingerprint`	Salesforce Experience Cloud Detection	Identifies Salesforce Experience Cloud / Lightning (Aura) sites and gates the `salesforce-*` active family	Info	Certain	`salesforce`, `aura`, `lightning`, `fingerprint`
`servicenow-fingerprint`	ServiceNow Detection	Identifies ServiceNow instances (`glide_` cookies, `g_ck` / `window.NOW` markers) and gates the `servicenow-` active family	Info	Certain	`servicenow`, `fingerprint`
`powerpages-fingerprint`	Microsoft Power Pages Detection	Identifies Microsoft Power Pages / Power Apps portals (Dataverse-backed) and gates the `powerpages-*` active family	Info	Certain	`powerpages`, `dataverse`, `microsoft`, `fingerprint`
`java-server-fingerprint`	Java App-Server Fingerprint	Identifies Java app servers (Tomcat, Jetty, JBoss) from response headers and JSESSIONID cookies	Info	Certain	`java`, `fingerprint`, `light`
`metaframework-fingerprint`	Meta-Framework Fingerprint	Identifies Remix, Astro, SvelteKit, Solid, and Qwik meta-frameworks	Info	Certain	`javascript`, `fingerprint`, `light`
`php-generic-fingerprint`	PHP Generic Fingerprint	Identifies standalone PHP installations from server headers and session cookies	Info	Certain	`php`, `fingerprint`, `light`
`symfony-fingerprint`	Symfony Fingerprint	Identifies Symfony PHP framework installations from headers, cookies, and debug profiler markers	Info	Certain	`symfony`, `php`, `fingerprint`, `light`
`baas-endpoint-fingerprint`	BaaS Endpoint Fingerprint	Identifies third-party backend / identity / serverless providers referenced in responses	Info	Certain	`recon`, `baas`, `fingerprint`, `light`
`dashboard-fingerprint`	Third-Party Dashboard Detected	Recognises self-hosted dashboards, admin consoles and developer tools (Grafana, Airflow, GitLab, Jenkins, Ollama, …) in observed responses	Info	Firm	`dashboard`, `fingerprint`, `discovery`, `info`

API & Protocol Analysis

Module ID	Name	Description	Severity	Confidence	Tags
`api-version-detect`	API Version Detection	Detects API versioning patterns in URLs and headers	Info	Certain	`api`
`graphql-introspection-detect`	GraphQL Introspection Detect	Detects enabled GraphQL introspection	Info	Firm	`api`, `graphql`
`grpc-web-detect`	gRPC-Web Detect	Detects gRPC-Web traffic patterns	Info	Firm	`api`
`endpoint-classifier`	Endpoint Classifier	Classifies endpoint types (API, auth, admin, static)	Info	Certain	`api`
`mcp-endpoint-detect`	MCP Endpoint Detect	Detects Model Context Protocol (MCP) server endpoints from HTTP responses (gates the `mcp-*` active family)	Medium	Firm	`mcp`, `api-security`
`mcp-description-injection`	MCP Tool/Prompt Description Injection	Prompt-injection imperatives, bidi/zero-width unicode, and base64 payloads inside MCP tool/prompt descriptions	High	Firm	`mcp`, `prompt-injection`, `supply-chain`
`mcp-dangerous-tool-exposure`	MCP Dangerous Tool Exposure	Inventories MCP tools whose names expose high-impact capabilities (code exec, file write/delete, outbound fetch, raw SQL, secret access)	Low	Firm	`mcp`, `excessive-permissions`, `api-security`
`llm-endpoint-fingerprint`	LLM Endpoint Fingerprint	Identifies application-level LLM chat/completion API endpoints (backed by the `infra/llmsig` signature catalog)	Info	Firm	`llm`, `ai`, `fingerprint`
`api-spec-detect`	API Spec Detect	Detects API spec responses and ingests endpoints for scanning	Info	Firm	`api`, `discovery`, `spec-detect`, `light`
`graphql-fingerprint`	GraphQL Endpoint Fingerprint	Identifies GraphQL endpoints from request paths and response body markers	Info	Certain	`graphql`, `api`, `fingerprint`, `light`
`graphql-error-leak`	GraphQL Error Leak	Detects verbose GraphQL errors exposing schema and resolver details	Medium	Firm	`graphql`, `info-disclosure`, `light`

Security Headers & Policy

Module ID	Name	Description	Severity	Confidence	Tags
`csp-weakness-audit`	CSP Weakness Audit	Content-Security-Policy weaknesses and bypasses	Low	Firm	`header-security`
`permissions-policy-detect`	Permissions-Policy Detect	Missing or weak Permissions-Policy/Feature-Policy	Info	Certain	`header-security`
`hsts-preload-audit`	HSTS Preload Audit	HSTS header configuration and preload readiness	Low	Certain	`header-security`
`subresource-integrity-detect`	Subresource Integrity Detect	Scripts/styles loaded without SRI attributes	Info	Certain	`header-security`
`cors-vary-origin-missing`	CORS Vary: Origin Missing	CORS responses without Vary: Origin header	Low	Firm	`cors`, `header-security`
`cross-origin-isolation-audit`	Cross-Origin Isolation Headers Missing	Authenticated responses missing COOP / COEP / CORP cross-origin isolation headers (XS-Leaks exposure)	Info	Firm	`client-side`, `xs-leaks`, `headers`

Cloud & Firebase

Module ID	Name	Description	Severity	Confidence	Tags
`cloud-storage-fingerprint`	Cloud Storage Fingerprint	Identifies cloud storage provider from URLs/headers	Info	Certain	`cloud`, `fingerprint`
`cloud-storage-error-info`	Cloud Storage Error Info	Cloud storage error messages revealing bucket names	Info	Certain	`cloud`, `info-disclosure`
`cloud-signed-url-leak`	Cloud Signed URL Leak	Cloud signed URLs with excessive permissions or long expiry	Medium	Firm	`cloud`, `info-disclosure`
`cloud-storage-url-harvest`	Cloud Storage URL Harvester	Harvests object-storage/CDN object URLs from page bodies and queues them for traversal probing	Info	Certain	`cloud`, `cloud-storage`, `discovery`, `passive`, `light`

CMS Detection

Module ID	Name	Description	Severity	Confidence	Tags
`drupal-api-detect`	Drupal API Detect	Detects Drupal JSON:API and REST endpoints	Low	Certain	`drupal`, `api`
`joomla-api-detect`	Joomla API Detect	Detects Joomla API endpoints and versions	Low	Certain	`joomla`, `api`
`wp-rest-api-detect`	WordPress REST API Detect	Detects WordPress REST API endpoints	Low	Certain	`wordpress`, `api`

Advanced JS Framework Analysis

Module ID	Name	Description	Severity	Confidence	Tags
`nextjs-dynamic-param-audit`	Next.js Dynamic Param Audit	Audits Next.js dynamic route parameters for injection	Medium	Tentative	`nextjs`, `javascript`
`nextauth-config-audit`	NextAuth.js Config Audit	Audits NextAuth.js configuration for security issues	Medium	Firm	`nextjs`, `javascript`
`nuxt-config-audit`	Nuxt Config Audit	Audits Nuxt.js configuration for security issues	Medium	Firm	`nuxt`, `javascript`
`remix-loader-exposure`	Remix Loader Exposure	Detects exposed Remix loader data	Medium	Firm	`remix`, `javascript`
`ssr-hydration-xss`	SSR Hydration XSS	Detects XSS via SSR hydration mismatches	High	Tentative	`javascript`, `xss`
`server-action-bind-audit`	Server Action Bind Audit	Audits Next.js Server Action .bind() usage for security	Medium	Tentative	`nextjs`, `javascript`
`server-action-input-audit`	Server Action Input Audit	Audits Next.js Server Action input validation	Medium	Tentative	`nextjs`, `javascript`
`server-only-boundary-audit`	Server-Only Boundary Audit	Audits server-only module boundary enforcement	Medium	Tentative	`nextjs`, `javascript`
`javascript-uri-sink`	JavaScript URI Sink	Detects javascript: URI usage in links and event handlers	Medium	Tentative	`javascript`, `xss`
`wasm-module-detect`	WebAssembly Module Detect	Detects WebAssembly module loading	Info	Certain	`javascript`
`postmessage-handler-detect`	JavaScript postMessage Handler Detected	Detects window postMessage handlers and wildcard-origin sends in JS	Info	Firm	`postmessage`, `dom`, `javascript`, `light`

Session & Authentication (Passive)

Module ID	Name	Description	Severity	Confidence	Tags
`express-session-audit`	Express Session Audit	Audits Express session cookie configuration	Low	Firm	`express`, `session`
`jwt-claims-detect`	JWT Claims Detect	Analyzes JWT payload claims for security issues	Medium	Firm	`auth`, `session`
`jackson-deserialize-detect`	Jackson Deserialization Detect	Detects Jackson default typing indicators	Low	Tentative	`java`, `injection`
`python-debug-detect`	Python Debug Detect	Detects Python debug/traceback indicators	High	Firm	`python`
`rails-debug-detect`	Rails Debug Detect	Detects Rails debug page indicators	High	Firm	`rails`, `ruby`
`rails-action-cable-detect`	Rails Action Cable Detect	Detects Rails Action Cable WebSocket endpoints	Info	Firm	`rails`, `ruby`
`rails-active-storage-detect`	Rails Active Storage Detect	Detects Active Storage blob URLs and signed tokens	Info	Certain	`rails`, `ruby`
`sensitive-api-fields-detect`	Sensitive API Fields Detect	Detects sensitive field names in API responses	Medium	Tentative	`api`, `info-disclosure`

​Severity Scale

​Confidence Scale

​Hardening advisories (hygiene)

​Active Modules (208)

​XSS

​SQL Injection

​NoSQL Injection

​Template Injection

​File Inclusion

​Code Execution & Injection

​SSRF & Out-of-Band (OAST)

​Misconfiguration

​Access Control

​Path Analysis

​Differential & Behavior Detection

​Prototype Pollution

​Race Conditions

​XML, JWT & HTTP Protocol

​API & Endpoint Security

​Proxy & Utility

​SQL Injection (Time-Based)

​SSRF & SSTI (Blind)

​Framework Security

​Next.js

​Spring / Java

​Django / Flask / FastAPI (Python)

​Laravel / Symfony / PHP

​Rails (Ruby)

​Express (Node.js)

​ASP.NET / IIS

​Firebase

​Cloud Infrastructure

​CMS (WordPress, Drupal, Joomla, Magento)

​Adobe Experience Manager (AEM)

​SaaS Platforms (Salesforce / ServiceNow / Power Pages)

​Model Context Protocol (MCP)

​Passive Modules (117)

​XSS

​Authentication & Session

​Injection Signals

​Information Disclosure

​Source & Supply-Chain Analysis

​Security Headers & Configuration

​CORS & Redirect

​Access Control

​Cryptography

​Anomaly Detection

​JS Framework Security (Runtime Analysis)

​JS Framework Security (Source Analysis)

​Framework Fingerprinting

​API & Protocol Analysis

​Security Headers & Policy

​Cloud & Firebase

​CMS Detection

​Advanced JS Framework Analysis

​Session & Authentication (Passive)

Severity Scale

Confidence Scale

Hardening advisories (`hygiene`)

Active Modules (208)

XSS

SQL Injection

NoSQL Injection

Template Injection

File Inclusion

Code Execution & Injection

SSRF & Out-of-Band (OAST)

Misconfiguration

Access Control

Path Analysis

Differential & Behavior Detection

Prototype Pollution

Race Conditions

XML, JWT & HTTP Protocol

API & Endpoint Security

Proxy & Utility

SQL Injection (Time-Based)

SSRF & SSTI (Blind)

Framework Security

Next.js

Spring / Java

Django / Flask / FastAPI (Python)

Laravel / Symfony / PHP

Rails (Ruby)

Express (Node.js)

ASP.NET / IIS

Firebase

Cloud Infrastructure

CMS (WordPress, Drupal, Joomla, Magento)

Adobe Experience Manager (AEM)

SaaS Platforms (Salesforce / ServiceNow / Power Pages)

Model Context Protocol (MCP)

Passive Modules (117)

XSS

Authentication & Session

Injection Signals

Information Disclosure

Source & Supply-Chain Analysis

Security Headers & Configuration

CORS & Redirect

Access Control

Cryptography

Anomaly Detection

JS Framework Security (Runtime Analysis)

JS Framework Security (Source Analysis)

Framework Fingerprinting

API & Protocol Analysis

Security Headers & Policy

Cloud & Firebase

CMS Detection

Advanced JS Framework Analysis

Session & Authentication (Passive)