> ## Documentation Index > Fetch the complete documentation index at: https://docs.vigolium.com/llms.txt > Use this file to discover all available pages before exploring further. # Scanner Modules Reference > Reference for Vigolium's 323 scanner modules, 207 active and 116 passive, covering the OWASP Top 10 and beyond. Vigolium ships with **323 scanner modules**, 207 active and 116 passive, covering the OWASP Top 10 and beyond. Run `vigolium module ls` for the up-to-date enabled list (the registry can grow between releases without a docs refresh). Active modules send modified requests to detect vulnerabilities; passive modules analyze existing request/response pairs without generating traffic. Recent additions include the v0.3.8 batch (`ssi-injection`, `server-side-js-injection`, `smtp-header-injection`, `react-rsc-rce`, `dependent-response`, `path-relative-stylesheet`), the GraphQL security suite, the Adobe Experience Manager (AEM) family, the SaaS data-exposure family (Salesforce / ServiceNow / Power Pages), the Model Context Protocol (MCP) suite, the expanded IIS family, the `dependency-confusion` and `js-beautify` passives, and the v0.2.1 batch (out-of-band SQLi, XPath injection, unauthenticated infra-service exposure, TLS protocol/cipher audit, session fixation, and the LLM-endpoint / payment-integration / DOM-clobbering / CSS-injection / cross-origin-isolation / reverse-tabnabbing passives) — filter the list by tag with `vigolium module ls graphql`, `vigolium module ls aem`, `salesforce`, `servicenow`, `powerpages`, `mcp`, or `iis` (the positional filter matches on id, name, description, and tag; `vigolium module ls --tags` dumps every known tag). The **Module ID** column is the exact id `-m` / `--module-id` and `--module-tag` expect (`vigolium scan-url -m xss-stored,sqli-error-based`). Ids carry no `active-` / `passive-` prefix — `--module-id` requires an exact match and `-m` falls back to substring matching, so a prefixed name selects nothing. ## Severity Scale `critical` > `high` > `medium` > `low` > `suspect` > `info` ## Confidence Scale * **certain** - Definitively confirmed (payload executed, error matched) * **firm** - Likely confirmed by behavioral analysis * **tentative** - Possible but unconfirmed (heuristic-based) *** ## Active Modules (207) Active modules send modified requests to detect vulnerabilities via fuzzing, injection, and behavioral analysis. Every registered active module is listed below; `vigolium module ls --type active` prints the same set from your installed build. ### XSS | Module ID | Name | Description | Severity | Confidence | Tags | | --------------------------- | --------------------------------- | ------------------------------------------------------------------------------------- | -------- | ---------- | -------------------------------------- | | `xss-light-url-params` | XSS Light - URL Parameters | Reflected XSS in URL parameters with POST→GET conversion | High | Firm | `xss`, `injection` | | `xss-light-path` | XSS Light - Path Injection | Reflected XSS via path manipulation (recursive, cut, append) | High | Firm | `xss`, `injection` | | `xss-light-param-discovery` | XSS Light - Parameter Discovery | Reflected XSS via echo parameter discovery | High | Firm | `xss`, `injection` | | `xss-light-encoded` | XSS Light - Pre-encoded Injection | Detects XSS where the app decodes a parameter (base64 / double-URL) before reflecting | High | Firm | `injection`, `xss`, `light`, `encoded` | | `xss-dom-confirm` | XSS DOM Confirm (Browser) | Confirms reflected and DOM-based XSS by observing alert() in a real browser | High | Certain | `xss`, `dom-xss`, `browser`, `slow` | | `xss-stored` | Stored XSS (browser-confirmed) | Injects a canary, then confirms it executes on a later retrieval of the page | High | Firm | `injection`, `xss`, `stored` | ### SQL Injection | Module ID | Name | Description | Severity | Confidence | Tags | | -------------------- | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------- | ---------- | ---------------------------- | | `sqli-error-based` | SQLi Error Based | Error-based SQLi via database error messages (MySQL, PostgreSQL, MSSQL, Oracle, SQLite) | Critical | Certain | `sqli`, `injection` | | `sqli-boolean-blind` | Blind SQL Injection (Boolean-Based) | Boolean-based blind SQLi using a randomized boundary matrix with difflib-style page-similarity comparison, a multi-round/multi-factor logic battery (AND/OR oracle, alternating comparison operators, invalid-syntax probe), and WAF-adaptive payload mutation. Only reports 200-vs-200 differentials with a large body-size delta (rejects status-flip false positives) | High | Certain | `sqli`, `injection`, `heavy` | | `sqli-out-of-band` | SQL Injection (Out-of-Band) | Blind SQLi confirmed via out-of-band DBMS callbacks (`LOAD_FILE` / `xp_dirtree` / `UTL_HTTP`) to a per-payload OAST subdomain — an unforgeable hit proves execution | Critical | Certain | `sqli`, `injection`, `oast` | ### NoSQL Injection | Module ID | Name | Description | Severity | Confidence | Tags | | --------------------------- | ------------------------ | ----------------------------------------------------------------------------- | -------- | ---------- | --------------------- | | `nosqli-error-based` | NoSQLi Error Based | NoSQL injection via error messages (MongoDB, CouchDB, Cassandra) | High | Tentative | `nosqli`, `injection` | | `nosqli-operator-injection` | NoSQL Operator Injection | MongoDB operator injection (`$ne`, `$gt`, `$regex`, `$where`) for auth bypass | High | Tentative | `nosqli`, `injection` | ### Template Injection | Module ID | Name | Description | Severity | Confidence | Tags | | ---------------- | ------------------------------ | ------------------------------------------------------------ | -------- | ---------- | ------------------- | | `reflected-ssti` | Reflected SSTI | SSTI via math expression evaluation (e.g., `{{7*7}}=49`) | High | Certain | `ssti`, `injection` | | `ssti-detection` | SSTI Detection | Diff-based SSTI via Boolean Error-Based Blind technique | Info | Certain | `ssti`, `injection` | | `csti-detection` | Client-Side Template Injection | CSTI in AngularJS/Vue.js applications via literal reflection | Medium | Firm | `ssti`, `injection` | ### File Inclusion | Module ID | Name | Description | Severity | Confidence | Tags | | -------------------- | ------------------ | ----------------------------------------------------------------- | -------- | ---------- | ------------------ | | `lfi-generic` | LFI Generic | LFI via path traversal payloads; matches known OS file signatures | High | Certain | `lfi`, `injection` | | `lfi-path-traversal` | LFI Path Traversal | Advanced LFI with null bytes, double encoding, Unicode bypass | High | Firm | `lfi`, `injection` | ### Code Execution & Injection | Module ID | Name | Description | Severity | Confidence | Tags | | --------------------------- | ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ---------- | --------------------------------------------------------------- | | `code-exec` | Code Execution (RCE) | OS command injection via time-based blind (sleep/delay measurement), plus language-specific interpreter payloads across several string-breakout contexts | Critical | Certain | `rce`, `injection` | | `command-injection-echo` | OS Command Injection (Results-Based) | In-band OS command injection confirmed by reflecting a unique arithmetic marker, baseline-compared over multiple rounds to suppress false positives | Critical | Certain | `rce`, `command-injection`, `injection` | | `command-injection-oast` | OS Command Injection (Out-of-Band) | Blind OS command injection via DNS/HTTP OAST callbacks (classified distinctly from SSRF/XXE) | Critical | Certain | `rce`, `command-injection`, `oast` | | `command-injection-timing` | OS Command Injection (Time-Based) | Time-based blind OS command injection with delay-scaling confirmation across rounds | Critical | Tentative | `rce`, `command-injection`, `injection`, `heavy` | | `crlf-injection` | CRLF Injection | CRLF injection in HTTP headers via CR/LF character sequences | Medium | Firm | `injection` | | `xxe-generic` | XXE Generic | XML external entity injection in generic XML endpoints; includes blind / out-of-band detection via external- and parameter-entity DTDs referencing a unique OAST URL | Critical | Certain | `xxe`, `injection` | | `xpath-injection` | XPath Injection | XPath/XQuery injection detected via engine error signatures and a boolean oracle (e.g. `' or '1'='1`) | High | Firm | `xpath`, `injection` | | `insecure-deserialization` | Insecure Deserialization | Error-based detection for Java, PHP, Python, Ruby, and .NET deserialization | High | Firm | `injection` | | `input-behavior-probe` | Input Behavior Probe | Behavior change detection via header, path, debug param, and char probing | Info | Tentative | `injection` | | `padding-oracle` | CBC Padding Oracle | Confirms a CBC padding oracle by flipping ciphertext bytes and observing a reproducible padding-error differential | High | Firm | `cryptography`, `injection`, `heavy` | | `ldap-injection` | LDAP Injection | Detects LDAP injection via error-based and boolean-based techniques, including a negation oracle (match-all vs match-none divergence) | Medium | Firm | `injection`, `heavy` | | `log4shell-probe` | Log4Shell Probe | Detects Log4Shell (CVE-2021-44228) via JNDI payload injection with OAST callbacks | Critical | Certain | `java`, `rce`, `heavy` | | `struts-ognl-injection` | Struts OGNL Injection | Detects Apache Struts OGNL injection via Content-Type and parameter payloads | Critical | Firm | `java`, `rce`, `moderate` | | `response-header-injection` | HTTP Response Header Injection | Detects HTTP response header injection via CRLF in parameters | Medium | Certain | `crlf`, `injection`, `header`, `response-splitting`, `moderate` | | `ssi-injection` | Server-Side Includes (SSI) Injection | Injects a set/echo SSI directive whose value is emitted only when the server parses SSI, with the directive markup consumed — proving evaluation rather than reflection; also confirms `exec` out of band | High | Firm | `injection`, `ssi`, `rce`, `heavy` | | `server-side-js-injection` | Server-Side JavaScript Injection | Server-side JavaScript (Node.js) code injection through `eval` / `Function` / `vm` / `$where`, confirmed via an OAST callback or a consistent busy-wait time differential | Critical | Firm | `injection`, `ssji`, `nodejs`, `rce`, `heavy` | | `smtp-header-injection` | SMTP Header Injection | CRLF injection into a mail header via an email-bearing parameter, confirmed by grafting a `Bcc` at a unique collaborator address the mailer resolves on delivery | Medium | Firm | `injection`, `smtp`, `crlf`, `email`, `heavy` | ### SSRF & Out-of-Band (OAST) | Module ID | Name | Description | Severity | Confidence | Tags | | -------------------------- | ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ---------- | ------------------------------------------- | | `ssrf-detection` | SSRF Detection | SSRF via in-band probes (internal IPs, cloud metadata) with response differential | High | Tentative | `ssrf`, `injection` | | `oast-probe` | OAST Probe | Blind vulnerabilities (blind SSRF, blind XXE, blind RCE) via DNS/HTTP callbacks, plus "Collaborator Everywhere" OAST headers | High | Certain | `ssrf`, `injection` | | `proxy-pingback` | Proxy Pingback | Open proxy/callback endpoints via OAST URL injection | High | Certain | `ssrf`, `injection` | | `ssrf-filter-bypass` | SSRF Filter Bypass (URL Parser Confusion) | SSRF that defeats URL allow/deny filters via parser confusion (`@`, `#`, backslash, embedded credentials) | High | Firm | `ssrf`, `injection`, `heavy` | | `ssrf-protocol-smuggling` | SSRF Protocol Smuggling (CRLF in URL) | SSRF via CRLF-in-URL protocol smuggling against fetchers that don't sanitize the target URL | High | Firm | `ssrf`, `injection`, `heavy` | | `routing-ssrf` | Routing-Based SSRF (Request-Line) | Routing-based SSRF from PortSwigger's "Cracking the Lens" — absolute-URI / `@` / `///` request-line targets with OAST + internal-marker confirmation | Info | Firm | `ssrf`, `proxy`, `routing`, `oast`, `heavy` | | `upgrade-routing-ssrf` | WebSocket-Upgrade SSRF Filter Bypass | Routing SSRF that bypasses filters via a WebSocket `Upgrade`, confirmed by a with-vs-without differential | High | Tentative | `ssrf`, `proxy`, `websocket`, `heavy` | | `pdf-generation-injection` | PDF Generation Injection | Detects HTML/JS injection into server-side PDF generation endpoints for SSRF/file read | High | Firm | `ssrf`, `injection`, `moderate` | ### Misconfiguration | Module ID | Name | Description | Severity | Confidence | Tags | | ---------------------------- | ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ---------- | ------------------------------------------------------------------------------------ | | `cors-misconfiguration` | CORS Misconfiguration | Permissive CORS policies (reflected origins, null origin, wildcard+credentials), plus a single-mutation trusted-origin probe gated on a negative control so a blanket reflector isn't re-reported | Low | Firm | `misconfiguration` | | `host-header-injection` | Host Header Injection | Host header injection via value reflection (password reset/cache poisoning) | Medium | Firm | `misconfiguration` | | `web-cache-poisoning` | Web Cache Poisoning | Cache poisoning via unkeyed header injection (`X-Forwarded-Host`, `X-Forwarded-Scheme`, `X-Host`, `X-Forwarded-Server`, `X-Original-Host`, `X-Forwarded-Prefix`) | High | Tentative | `misconfiguration` | | `cache-poisoned-dos` | Cache-Poisoned Denial of Service (CPDoS) | CPDoS via header-only HMO/HHO variants that make a shared cache store and replay an origin error; safe unique-buster oracle, never affects shared keys | Medium | Firm | `cache-poisoning`, `cpdos`, `dos` | | `unauth-service-exposure` | Unauthenticated Infrastructure Service Exposure | Unauthenticated Docker / Kubernetes / datastore APIs exposed over HTTP, confirmed by a service-specific structural signature and re-verified | Critical | Certain | `exposure`, `infrastructure`, `misconfiguration` | | `tls-protocol-cipher-audit` | TLS Protocol & Cipher Audit | Grades a host's TLS by directly negotiating deprecated protocols and weak cipher suites | Low | Certain | `tls`, `crypto`, `transport`, `misconfiguration` | | `cache-deception` | Web Cache Deception | Detects web cache deception via path confusion with static file extensions and delimiter-confusion variants | Medium | Tentative | `cache-poisoning`, `auth-bypass`, `moderate` | | `oauth-misconfiguration` | OAuth/OIDC Misconfiguration | Detects common OAuth/OIDC misconfigurations including open redirect and missing state | Low | Firm | `authentication`, `session`, `moderate` | | `common-directory-listing` | Common Directory Listing | Detects directory listing exposure on common web servers (Apache, Nginx, IIS, Jetty, Python) | Low | Firm | `info-disclosure`, `misconfiguration`, `directory-listing`, `light` | | `dashboard-exposure` | Exposed Third-Party Dashboard | Probes for exposed third-party dashboards/consoles (Grafana, Airflow, GitLab, Jenkins, Ollama, ...) and unauthenticated version/config/data leaks | Medium | Firm | `dashboard`, `exposure`, `discovery`, `info-leak`, `default-login`, `light` | | `go-debug-endpoint-exposure` | Go Debug Endpoint Exposure | Detects exposed Go net/http/pprof and expvar debug endpoints | Medium | Firm | `golang`, `pprof`, `expvar`, `debug`, `info-disclosure`, `misconfiguration`, `light` | | `subdomain-takeover` | Subdomain Takeover | Detects dangling DNS records pointing to deprovisioned cloud services | High | Firm | `cloud`, `misconfiguration`, `moderate` | | `tls-cert-recon` | TLS Certificate Recon | Reads each host's live TLS certificate for recon: self-signed / private-CA certs and the subdomains and internal names in their SANs | Info | Certain | `recon`, `tls`, `certificate`, `fingerprint`, `light` | | `path-relative-stylesheet` | Path-Relative Stylesheet Import (PRSSI) | A page carrying a path-relative stylesheet that the server also serves at a path-info-confused URL without `X-Content-Type-Options: nosniff`, so attacker content can resolve as CSS | Low | Firm | `client-side`, `css-injection`, `prssi`, `moderate` | ### Access Control | Module ID | Name | Description | Severity | Confidence | Tags | | ------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | -------- | ---------- | --------------------------------------------------------------------------- | | `forbidden-bypass` | 403/401 Forbidden Bypass | Bypass via path manipulation, header injection, method tampering | Medium | Firm | `auth-bypass` | | `http-method-tampering` | HTTP Method Tampering | Unexpectedly enabled HTTP methods (PUT, DELETE, PATCH) and overrides | Info | Firm | `auth-bypass` | | `csrf-verify` | CSRF Token Verification | Verifies CSRF token enforcement by removing, emptying, or randomizing tokens | High | Firm | `auth-bypass` | | `idor-detection` | IDOR Detection | Missing authorization on object ID parameters via neighbor ID probing | High | Tentative | `auth-bypass` | | `mass-assignment` | Mass Assignment | Mass assignment via injecting privilege keys into JSON APIs | High | Firm | `auth-bypass` | | `open-redirect` | Open Redirect | Open redirect via injected external URL in Location/meta refresh, across a wide set of leading separators that catch blocklist-bypass redirect targets | Medium | Firm | `auth-bypass` | | `open-redirect-confusion` | Open Redirect via URL Parser Confusion | Open redirect reached through URL-parser-confusion payloads (`@`, backslash, embedded host) that slip past naive redirect validation | High | Firm | `open-redirect`, `ssrf`, `moderate` | | `session-fixation` | Session Fixation | Permissive session mechanism that adopts an attacker-supplied session ID across authentication | Medium | Firm | `session`, `auth`, `session-fixation` | | `authz-compare` | Cross-Session Authorization Compare | Compares responses across authenticated sessions to detect IDOR/BOLA | High | Firm | `idor`, `bola`, `auth-bypass`, `access-control`, `api-security`, `moderate` | | `bfla-detection` | BFLA Detection | Detects Broken Function-Level Authorization on privileged endpoints | High | Tentative | `auth-bypass`, `api-security`, `moderate` | | `idor-guid` | IDOR GUID Predictability | Detects predictable GUID patterns like UUIDv1 with extractable timestamps | Medium | Firm | `idor`, `auth-bypass`, `moderate` | ### Path Analysis | Module ID | Name | Description | Severity | Confidence | Tags | | ------------------------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------- | -------- | ---------- | ---------------------------------------------------------------------- | | `path-normalization` | Path Normalization | Path normalization vulnerabilities via traversal payloads against middleware/reverse proxy | High | Firm | `misconfiguration` | | `nginx-off-by-slash` | Nginx Off-by-Slash | Nginx alias traversal via missing trailing slash | High | Tentative | `misconfiguration` | | `nginx-path-escape` | Nginx Path Escape Detection | Diff-based detection for alias traversal, URL encoding bypass, semicolon injection | Info | Tentative | `misconfiguration` | | `reverse-proxy-path-confusion` | Reverse Proxy Path Confusion | Reaches access-controlled backend paths the reverse proxy and origin normalize differently (encoded slashes, dot-segments, semicolons) | High | Firm | `proxy`, `access-control`, `heavy` | | `client-path-traversal-confirm` | Client-Side Path Traversal Confirm | Browser-confirms a URL-controlled value escaping a client-side request path prefix | Medium | Firm | `cspt`, `dom`, `browser`, `heavy` | | `cdn-object-traversal-listing` | CDN Object-Storage Traversal Listing | Detects bucket object enumeration via ..; path traversal on CDN-fronted object storage | High | Firm | `cloud`, `cloud-storage`, `path-traversal`, `info-disclosure`, `light` | ### Differential & Behavior Detection | Module ID | Name | Description | Severity | Confidence | Tags | | -------------------------- | --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ---------- | ---------------------------------------------- | | `smart-behavior-detection` | Smart Behavior Detection | Diff-based injection detection via true/false behavioral payload pairs | Info | Tentative | `detection` | | `suspect-transform` | Suspect Transform Detection | Expression evaluation, quote consumption, and unicode normalizations | Suspect | Firm | `detection` | | `backslash-transformation` | Backslash Transformation | Escape sequence interpretation, backslash consumption, character handling | Suspect | Firm | `detection` | | `internal-header-probe` | Internal Header Probe | Fuzzes custom/internal request headers advertised via Access-Control-Allow-Headers and reports value-dependent response changes | Suspect | Tentative | `cors`, `header`, `recon`, `ssrf`, `intrusive` | | `dependent-response` | Referer / User-Agent Dependent Response | Response content that varies on a spoofable `Referer` or `User-Agent` — ineffective gating, cloaking, or weak access control — with each variant re-sampled to rule out dynamic-content noise | Info | Firm | `recon`, `behavior`, `cloaking`, `moderate` | ### Prototype Pollution | Module ID | Name | Description | Severity | Confidence | Tags | | ---------------------------- | ------------------------------- | ------------------------------------------------------------------------------------------ | -------- | ---------- | ------------------------- | | `prototype-pollution` | Prototype Pollution | Server-side prototype pollution via `__proto__` and `constructor.prototype` JSON injection | High | Firm | `javascript`, `injection` | | `client-prototype-pollution` | Client-Side Prototype Pollution | Client-side prototype pollution via JavaScript static analysis (source + gadget patterns) | Medium | Tentative | `javascript`, `injection` | ### Race Conditions | Module ID | Name | Description | Severity | Confidence | Tags | | ------------------- | --------------------------- | ------------------------------------------------------------------------------------------ | -------- | ---------- | ----------- | | `race-interference` | Race Interference Detection | Race conditions via parallel request analysis (input storage, cross-contamination, TOCTOU) | Medium | Firm | `injection` | ### XML, JWT & HTTP Protocol | Module ID | Name | Description | Severity | Confidence | Tags | | ------------------------ | ---------------------- | --------------------------------------------------------------------------- | -------- | ---------- | ----------- | | `xml-saml-security` | XML SAML Security | XXE and DTD injection in SAML XML processing | High | Firm | `injection` | | `jwt-vulnerability` | JWT Vulnerability | JWT algorithm confusion (`none` algorithm, empty signature, RS256→HS256) | Critical | Certain | `injection` | | `http-request-smuggling` | HTTP Request Smuggling | CL.TE and TE.CL desync via conflicting Content-Length and Transfer-Encoding | Suspect | Tentative | `injection` | ### API & Endpoint Security | Module ID | Name | Description | Severity | Confidence | Tags | | -------------------------- | ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ---------- | --------------------------------------------------------------------------- | | `graphql-scan` | GraphQL Security Scanner | Runs only against a confirmed GraphQL endpoint: introspection & schema exercise, exposed IDE/console (GraphiQL/Playground/Altair), error- and boolean-based SQLi, field-level authorization (IDOR/BOLA), reflected XSS in errors, uncapped query batching, and DoS via deeply-nested/aliased/circular queries. Endpoint discovery walks endpoint names over parent-path prefixes and nested `api`/version permutations | Medium | Certain | `graphql`, `injection`, `idor`, `bola`, `xss`, `dos`, `batching`, `console` | | `file-upload-scan` | File Upload Scanner | File upload bypass (extension, null byte, magic bytes, SVG XXE, HTML XSS); a PHP web shell is confirmed by an arithmetic execution marker that proves evaluation, not mere storage | High | Certain | `injection` | | `default-credentials` | Default Credentials | Login endpoints tested with common credential pairs; CAPTCHA/lockout aware | High | Certain | `auth-bypass` | | `sensitive-file-discovery` | Sensitive File Discovery | \~25 marker-based sensitive files and \~1,350 generic paths (.env, .git, logs) | Medium | Tentative | `info-disclosure` | | `jsonp-callback` | JSONP Callback Injection | JSONP endpoints via callback injection enabling cross-origin data theft | Medium | Firm | `injection` | | `grpc-surface-audit` | gRPC-Web Surface Audit | gRPC-Web (HTTP/1.1) endpoints with missing authorization and exposed reflection/health services | High | Firm | `grpc`, `api`, `authorization`, `heavy` | | `llm-boundary-probe` | LLM Boundary Probe | Probes LLM endpoints for system-prompt / secret disclosure and tool abuse | High | Firm | `llm`, `ai`, `prompt-injection`, `heavy` | | `api-key-url-exposure` | API Key in URL | Detects API keys that work when moved from headers to URL parameters | Medium | Firm | `info-disclosure`, `api-security`, `light` | | `api-spec-ingest` | API Spec Ingest | Discovers API specs (OpenAPI/Swagger/Postman) and ingests endpoints for scanning | Info | Firm | `api`, `discovery`, `spec-ingest`, `light` | | `swagger-exposure` | Exposed API Documentation | Detects publicly exposed Swagger/OpenAPI/Redoc documentation routes | Low | Firm | `api`, `discovery`, `swagger`, `openapi`, `exposure`, `info-leak`, `light` | | `ws-cswsh` | WebSocket CSWSH | Tests for Cross-Site WebSocket Hijacking via insufficient origin validation | Medium | Firm | `csrf`, `session`, `moderate` | | `ws-injection` | WebSocket Injection | Tests for injection vulnerabilities in parameters forwarded to WebSocket message processing | Medium | Firm | `injection`, `xss`, `moderate` | ### Proxy & Utility | Module ID | Name | Description | Severity | Confidence | Tags | | ---------------------------- | -------------------------- | ------------------------------------------------------------------------- | -------- | ---------- | ------------------------------ | | `proxy-header-trust` | Proxy Header Trust | Cross-framework proxy header trust issues via X-Forwarded-\* manipulation | High | Firm | `misconfiguration`, `moderate` | | `api-rate-limit-bypass` | API Rate Limit Bypass | Rate limiting bypass via IP spoofing headers | Medium | Firm | `auth-bypass`, `moderate` | | `backup-file-discovery` | Backup File Discovery | Exposed backup archives derived from hostname and year variants | Medium | Tentative | `sensitive-file`, `moderate` | | `angular-template-injection` | Angular Template Injection | Angular template injection via expression evaluation | High | Firm | `angular`, `injection`, `ssti` | ### SQL Injection (Time-Based) | Module ID | Name | Description | Severity | Confidence | Tags | | ----------------- | -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ---------- | ---------------------------- | | `sqli-time-blind` | Blind SQL Injection (Time-Based) | Time-based blind SQLi with a per-target statistical delay threshold and multi-round confirmation that the delay scales with the injected sleep value (rejects fixed/jitter delays); prioritizes payloads by any DBMS identified for the host | Suspect | Tentative | `injection`, `sqli`, `heavy` | ### SSRF & SSTI (Blind) | Module ID | Name | Description | Severity | Confidence | Tags | | ------------ | -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ---------- | ---------------------------- | | `ssrf-blind` | Blind SSRF Detection | Blind SSRF via OAST callbacks | High | Firm | `ssrf`, `injection`, `heavy` | | `ssti-blind` | Blind SSTI | Blind SSTI via OAST callbacks and time-delay payloads; JVM template stacks are confirmed with a pure-JVM DNS/URL callback that needs no shell on the target | Critical | Firm | `injection`, `ssti`, `heavy` | ### Framework Security #### Next.js | Module ID | Name | Description | Severity | Confidence | Tags | | ---------------------------- | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------- | ---------- | --------------------------------------------------------------------- | | `nextjs-data-leakage` | Next.js Data Route Leakage | Unauthorized access to `/_next/data//.json` | High | Firm | `nextjs`, `javascript` | | `nextjs-middleware-bypass` | Next.js Middleware Bypass | CVE-2025-29927 and path normalization bypasses | Critical | Firm | `nextjs`, `javascript` | | `nextjs-image-ssrf` | Next.js Image Optimizer SSRF | SSRF via `/_next/image` with OAST and in-band probes | High | Firm | `nextjs`, `javascript` | | `nextjs-draft-mode-exposure` | Next.js Draft Mode Exposure | Insecure or unprotected Draft/Preview Mode endpoints | High | Firm | `nextjs`, `javascript` | | `nextjs-version-audit` | Next.js Version Audit | Fingerprints Next.js version and maps to known CVE advisories | High | Firm | `nextjs`, `javascript`, `fingerprint` | | `js-devserver-exposure` | JS Dev Server Exposure | Exposed webpack HMR, Vite, Nuxt, Remix dev server endpoints | Medium | Firm | `javascript` | | `fastify-hono-probe` | Fastify/Hono Probe | Detects exposed Fastify and Hono framework endpoints | Medium | Firm | `nodejs`, `misconfiguration`, `light` | | `metaframework-probe` | Metaframework Probe | Detects exposed Remix, Astro, and SvelteKit internal files and endpoints | Low | Firm | `javascript`, `misconfiguration`, `light` | | `nextjs-chunk-audit` | Next.js Static Chunk Audit | Fetches Next.js static JS chunks and extracts routes, domains, and embedded secrets | Info | Certain | `nextjs`, `javascript`, `intel`, `info-disclosure`, `medium`, `light` | | `react-rsc-rce` | React Server Components RCE | The React Flight server-action decoder RCE (CVE-2025-55182 / CVE-2025-66478) — a crafted colon-delimited object reference makes the decoder dereference a missing property, surfacing as a Next.js error digest while a well-formed control request does not | Critical | Firm | `nextjs`, `react`, `rce`, `deserialization`, `heavy` | #### Spring / Java | Module ID | Name | Description | Severity | Confidence | Tags | | ------------------------------ | -------------------------------- | ----------------------------------------------------------------------- | -------- | ---------- | ---------------------------------------------------------------- | | `spring-actuator-misconfig` | Spring Actuator Misconfiguration | Exposed Spring Boot actuator endpoints leaking env vars, health, config | High | Firm | `spring`, `java`, `misconfiguration`, `info-disclosure`, `light` | | `spring-boot-admin-exposure` | Spring Boot Admin Exposure | Exposed Spring Boot Admin dashboards | High | Firm | `spring`, `java` | | `spring-cloud-config-exposure` | Spring Cloud Config Exposure | Exposed Config Server endpoints leaking secrets | Critical | Firm | `spring`, `java` | | `spring-data-rest-exposure` | Spring Data REST Exposure | Auto-exposed repository endpoints with HAL/HATEOAS | Medium | Firm | `spring`, `java` | | `spring-debug-exposure` | Spring Debug Exposure | Debug endpoints, Whitelabel errors, stack traces | Medium | Firm | `spring`, `java` | | `spring-gateway-exposure` | Spring Gateway Exposure | Exposed Cloud Gateway actuator revealing routes | High | Firm | `spring`, `java` | | `spring-h2-console-exposure` | Spring H2 Console Exposure | Exposed H2 database web consoles | Medium | Firm | `spring`, `java`, `rce` | | `spring-jolokia-exposure` | Spring Jolokia Exposure | Exposed Jolokia JMX endpoints | High | Firm | `spring`, `java` | | `java-appserver-console` | Java App Server Console | Exposed admin consoles (WildFly, WebLogic, GlassFish) | High | Firm | `java`, `tomcat` | | `java-sensitive-files` | Java Sensitive Files | Java config files, WEB-INF, META-INF, build artifacts | Medium | Tentative | `java`, `sensitive-file` | | `tomcat-manager-exposure` | Tomcat Manager Exposure | Exposed Tomcat Manager and Host Manager interfaces | High | Firm | `tomcat`, `java` | #### Django / Flask / FastAPI (Python) | Module ID | Name | Description | Severity | Confidence | Tags | | ------------------------------- | ----------------------------- | ----------------------------------------------- | -------- | ---------- | ------------------------ | | `django-admin-exposure` | Django Admin Exposure | Exposed Django admin panel and login page | Low | Firm | `django`, `python` | | `django-browsable-api-exposure` | Django Browsable API Exposure | DRF browsable API detected via Accept header | Info | Firm | `django`, `python` | | `django-debug-exposure` | Django Debug Exposure | Django DEBUG=True information disclosure | High | Firm | `django`, `python` | | `django-debug-toolbar-exposure` | Django Debug Toolbar Exposure | Exposed django-debug-toolbar panels | High | Firm | `django`, `python` | | `flask-werkzeug-debugger` | Flask Werkzeug Debugger | Exposed Werkzeug interactive debugger (RCE) | Critical | Certain | `flask`, `python`, `rce` | | `fastapi-docs-exposure` | FastAPI Docs Exposure | Exposed FastAPI interactive API documentation | Info | Firm | `fastapi`, `python` | | `fastapi-auth-inconsistency` | FastAPI Auth Inconsistency | Unprotected operations found via OpenAPI schema | Medium | Firm | `fastapi`, `python` | #### Laravel / Symfony / PHP | Module ID | Name | Description | Severity | Confidence | Tags | | -------------------------- | ------------------------------- | ----------------------------------------------------- | -------- | ---------- | ----------------------- | | `laravel-admin-exposure` | Laravel Admin Exposure | Exposed admin panels, API docs, GraphQL endpoints | High | Tentative | `laravel`, `php` | | `laravel-devtool-exposure` | Laravel Developer Tool Exposure | Exposed Web Tinker, Clockwork, Pulse, Log Viewer | High | Firm | `laravel`, `php` | | `laravel-ignition-rce` | Laravel Ignition RCE | CVE-2021-3129 RCE via exposed Ignition endpoints | Critical | Firm | `laravel`, `php`, `rce` | | `laravel-misconfig` | Laravel Misconfiguration | Debug mode, exposed debugbar, application logs | High | Firm | `laravel`, `php` | | `laravel-sensitive-files` | Laravel Sensitive Files | PHPUnit config, SQLite DB, storage internals | Medium | Tentative | `laravel`, `php` | | `symfony-misconfig` | Symfony Misconfiguration | Exposed profiler, debug toolbar, dev front controller | High | Firm | `symfony`, `php` | | `php-composer-exposure` | PHP Composer Exposure | Exposed Composer manifests, vendor directory | High | Firm | `php` | | `php-debug-exposure` | PHP Debug Exposure | Exposed phpinfo, PHP-FPM status, phpMyAdmin | Medium | Firm | `php` | | `php-framework-debug` | PHP Framework Debug Exposure | Debug endpoints for Yii, CodeIgniter, CakePHP | Medium | Firm | `php` | | `php-path-info-misconfig` | PHP PATH\_INFO Misconfiguration | cgi.fix\_pathinfo routing ambiguity | Medium | Firm | `php` | | `php-source-disclosure` | PHP Source Disclosure | PHP source code via .phps handlers | High | Firm | `php` | #### Rails (Ruby) | Module ID | Name | Description | Severity | Confidence | Tags | | ---------------------------- | -------------------------- | ----------------------------------------------- | -------- | ---------- | --------------- | | `rails-info-exposure` | Rails Info Exposure | Exposed Rails dev/debug endpoints in production | High | Firm | `rails`, `ruby` | | `rails-admin-dashboard` | Rails Admin Dashboard | Exposed Rails ecosystem admin panels | High | Firm | `rails`, `ruby` | | `rails-sensitive-files` | Rails Sensitive Files | Exposed Rails config, credentials, artifacts | Medium | Tentative | `rails`, `ruby` | | `rails-action-mailbox-probe` | Rails Action Mailbox Probe | Exposed Action Mailbox ingress endpoints | Medium | Firm | `rails`, `ruby` | | `rails-active-storage-probe` | Rails Active Storage Probe | Exposed Active Storage direct upload endpoints | Medium | Tentative | `rails`, `ruby` | #### Express (Node.js) | Module ID | Name | Description | Severity | Confidence | Tags | | ------------------------------- | ------------------------------------ | ----------------------------------------------- | -------- | ---------- | ----------------------- | | `express-debug-probe` | Express Debug Probe | Stack trace and debug info leakage | Low | Firm | `express`, `javascript` | | `express-directory-listing` | Express Directory Listing | Directory listing via serve-index middleware | Low | Firm | `express`, `javascript` | | `express-trust-proxy-misconfig` | Express Trust Proxy Misconfiguration | Trust proxy misconfiguration via X-Forwarded-\* | Medium | Firm | `express`, `javascript` | #### ASP.NET / IIS | Module ID | Name | Description | Severity | Confidence | Tags | | ---------------------------------- | --------------------------------------- | ------------------------------------------------------------------------------------------------------ | -------- | ---------- | ------------------------------------------------------------- | | `aspnet-blazor-exposure` | ASP.NET Blazor Exposure | Exposed Blazor WebAssembly assemblies and Server endpoints | Medium | Firm | `aspnet` | | `aspnet-health-exposure` | ASP.NET Health Endpoint Exposure | Exposed health checks, monitoring dashboards, metrics | Medium | Firm | `aspnet` | | `aspnet-identity-probe` | ASP.NET Identity Probe | Exposed Identity endpoints and IdentityServer | Medium | Firm | `aspnet` | | `aspnet-misconfig` | ASP.NET Misconfiguration | Exposed diagnostics, debug endpoints, verbose errors | High | Firm | `aspnet` | | `aspnet-sensitive-files` | ASP.NET Sensitive Files | Exposed config files, backups, sensitive directories | Medium | Tentative | `aspnet` | | `aspnet-service-exposure` | ASP.NET Service Exposure | Exposed ASMX, WCF, OData, legacy service paths | Medium | Firm | `aspnet` | | `aspnet-viewstate-scan` | ASP.NET ViewState Scan | ViewState MAC disabled, event validation bypass | High | Firm | `aspnet` | | `iis-shortname-discovery` | IIS Short Filename Discovery | IIS 8.3 short-filename enumeration via a tilde-based oracle, resolving names to feed content discovery | Medium | Certain | `iis`, `aspnet`, `info-disclosure`, `heavy` | | `iis-cookieless-source-disclosure` | IIS Cookieless Source/Config Disclosure | Downloads protected ASP.NET config/source via cookieless (`S(X)`) path-confusion | High | Firm | `iis`, `aspnet`, `info-disclosure`, `heavy` | | `iis-extension-confusion-bypass` | IIS Extension Confusion Bypass | NTFS `::$DATA` source disclosure and trailing-dot / `::$INDEX_ALLOCATION` access-control bypass | High | Firm | `iis`, `aspnet`, `access-control`, `info-disclosure`, `heavy` | #### Firebase | Module ID | Name | Description | Severity | Confidence | Tags | | ----------------------------- | ------------------------------ | ---------------------------------------------------- | -------- | ---------- | ------------------- | | `firebase-auth-misconfig` | Firebase Auth Misconfiguration | Firebase Authentication misconfigurations | Medium | Firm | `firebase` | | `firebase-functions-exposure` | Firebase Functions Exposure | Unauthenticated Cloud Functions | Medium | Firm | `firebase` | | `firebase-misconfig` | Firebase Misconfiguration | Exposed Firebase config, security rules, credentials | High | Firm | `firebase` | | `firebase-rtdb-exposure` | Firebase RTDB Exposure | Publicly readable Realtime Database | Medium | Certain | `firebase` | | `firebase-storage-exposure` | Firebase Storage Exposure | Publicly accessible Cloud Storage buckets | High | Certain | `firebase`, `cloud` | #### Cloud Infrastructure | Module ID | Name | Description | Severity | Confidence | Tags | | ----------------------- | --------------------- | ----------------------------------------------------- | -------- | ---------- | ------- | | `cloud-bucket-takeover` | Cloud Bucket Takeover | Dangling cloud storage buckets vulnerable to takeover | High | Firm | `cloud` | | `cloud-origin-bypass` | Cloud Origin Bypass | Direct access to origins bypassing CDN security | Medium | Firm | `cloud` | | `cloud-public-read` | Cloud Public Read | Publicly readable sensitive paths on cloud storage | High | Firm | `cloud` | | `cloud-storage-listing` | Cloud Storage Listing | Publicly listable S3 buckets and Azure containers | High | Certain | `cloud` | #### CMS (WordPress, Drupal, Joomla, Magento) | Module ID | Name | Description | Severity | Confidence | Tags | | ------------------------ | ------------------------------ | ----------------------------------------------------- | -------- | ---------- | ------------------------------- | | `wp-misconfig` | WordPress Misconfiguration | Exposed config files, debug logs, dangerous endpoints | High | Firm | `wordpress`, `php` | | `wp-user-enum` | WordPress User Enumeration | User enumeration via author archives and REST API | Info | Certain | `wordpress`, `php` | | `wp-xmlrpc` | WordPress XML-RPC Abuse | XML-RPC multicall brute-force and pingback abuse | Medium | Firm | `wordpress`, `php` | | `wp-ajax-exposure` | WordPress AJAX Action Exposure | Publicly accessible AJAX actions from plugins | High | Firm | `wordpress`, `php` | | `drupal-misconfig` | Drupal Misconfiguration | Exposed config files, update scripts, installer | High | Firm | `drupal`, `php` | | `drupal-user-enum` | Drupal User Enumeration | User enumeration via user profiles and JSON:API | Info | Certain | `drupal`, `php` | | `joomla-misconfig` | Joomla Misconfiguration | Exposed config backups, log/temp dirs, debug settings | High | Firm | `joomla`, `php` | | `joomla-user-enum` | Joomla User Enumeration | User enumeration via registration, API, admin login | Info | Firm | `joomla`, `php` | | `magento-misconfig` | Magento Misconfiguration | Exposed setup wizard, downloader, version files | High | Firm | `magento`, `php` | | `cms-installer-exposure` | CMS Installer Exposure | Exposed WordPress, Drupal, and Joomla install wizards | Critical | Firm | `wordpress`, `drupal`, `joomla` | #### Adobe Experience Manager (AEM) Every module gates on a confirmed AEM instance (`passive-aem-fingerprint`), is detection-only, and confirms across multiple rounds. | Module ID | Name | Description | Severity | Confidence | Tags | | ----------------------------- | -------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ---------- | ----------------------------------------------- | | `aem-dispatcher-bypass` | AEM Dispatcher ACL Bypass | Differential confirmation: a protected servlet blocked on the direct path but reachable through a path-normalization trick | High | Certain | `aem`, `adobe`, `dispatcher`, `cms` | | `aem-sensitive-servlet` | AEM Sensitive Servlet Disclosure | Info disclosure via AEM servlets (QueryBuilder password-hash leak, GQL/DefaultGetServlet dumps, userinfo, loginstatus, truststore), incl. dispatcher-bypass reachability | High | Firm | `aem`, `adobe`, `info-disclosure`, `cms` | | `aem-console-exposure` | AEM Console & Admin Panel Exposure | Internet-reachable AEM developer/admin consoles (CRXDE Lite, CRX Package Manager, CRX Explorer, admin dashboards) and ACL bypasses to them | High | Firm | `aem`, `adobe`, `misconfiguration`, `cms` | | `aem-content-discovery` | AEM Repository Content Discovery | Routing-aware JCR enumeration via Sling selectors (`.1.json`) and QueryBuilder predicates, harvesting config secrets, user accounts, and writable nodes (`rep:password` → Critical) | High | Firm | `aem`, `adobe`, `info-disclosure`, `jcr`, `cms` | | `aem-default-credentials` | AEM Default Credentials | AEM default and demo-account credentials on the Granite login and Felix Web Console | High | Certain | `aem`, `adobe`, `default-credentials`, `cms` | | `aem-cloudsettings-injection` | AEM Cloud Settings Node Write / EL Injection | BulkImportConfigServlet pre-auth node write (CVE-2025-54246) and the EL injection it enables (CVE-2025-54247/54248), proven with a benign marker / `7*7` read-back | Critical | Firm | `aem`, `adobe`, `el-injection`, `rce`, `cms` | | `aem-xss` | AEM Reflected XSS | Reflected XSS in AEM-specific sinks (childlist selector, CRXDE setPreferences, DAM merge-metadata, WCM contentfinder) with headless popup confirmation | High | Firm | `aem`, `adobe`, `xss`, `cms` | | `aem-ssrf` | AEM SSRF-Capable Proxy Servlet Exposure | Reachable AEM proxy/fetch servlets known for SSRF (ContentInsight proxy, opensocial/shindig, SalesforceSecretServlet, accesstoken/verify) — surface detection, no OAST fired | Medium | Tentative | `aem`, `adobe`, `ssrf`, `cms` | | `aem-oob-injection` | AEM Blind SSRF / XXE (Out-of-Band) | Out-of-band probes for the AccessTokenServlet full-read SSRF (CVE-2025-54249) and CRX Package Manager blind XXE (CVE-2025-54251), confirmed by collaborator callback | High | Firm | `aem`, `adobe`, `ssrf`, `xxe`, `oob`, `cms` | | `aem-xxe` | AEM Adaptive Forms XXE | XML external-entity processing in Adaptive Forms `guideContainer` internalsubmit (CVE-2019-8086) via an exploit-free internal-entity expansion proof | High | Firm | `aem`, `adobe`, `xxe`, `cms` | | `aem-rce-surface` | AEM RCE-Capable Surface Exposure | Exposed AEM code-execution surfaces (Groovy Console, ACS Fiddle, Forms GetDocumentServlet, WebDAV PUT) — detection only, no exec/write payload sent | Critical | Firm | `aem`, `adobe`, `rce`, `cms` | #### SaaS Platforms (Salesforce / ServiceNow / Power Pages) Each family gates on a live per-vendor fingerprint, pairs a catch-all negative control with the positive, and confirms across multiple rounds. | Module ID | Name | Description | Severity | Confidence | Tags | | --------------------------------- | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ---------- | ------------------------------------------------------------- | | `salesforce-aura-object-exposure` | Salesforce Aura Guest Object Enumeration | An Experience Cloud Guest user can invoke the Aura `getConfigData` action and enumerate accessible SObjects (incl. custom `__c`) — an over-permissive Guest profile | Medium | Firm | `salesforce`, `aura`, `lightning`, `info-disclosure` | | `salesforce-aura-record-exposure` | Salesforce Aura Guest Record Exposure | Unauthenticated read of SObject records (User, Contact, Case, Lead, custom `__c`) through the Aura `getItems` action | High | Certain | `salesforce`, `aura`, `lightning`, `idor`, `info-disclosure` | | `salesforce-aura-apex-execution` | Salesforce Aura Guest Apex Execution | An unauthenticated Guest user can invoke `@AuraEnabled` Apex via `ApexActionController.execute` — the pivot for guest-driven SSRF, DML, and exfiltration | High | Firm | `salesforce`, `aura`, `lightning`, `apex`, `ssrf` | | `salesforce-lightning-debug-mode` | Salesforce Lightning Debug Mode Enabled | A Lightning/Experience Cloud site served in an Aura debug mode (`PRODDEBUG`/`DEV`/`JSTESTDEBUG`) leaking un-minified code and backend stacktraces | Medium | Firm | `salesforce`, `aura`, `lightning`, `debug`, `info-disclosure` | | `servicenow-widget-data-exposure` | ServiceNow Public Widget Data Exposure | Unauthenticated read of arbitrary ServiceNow tables (`sys_user`, `incident`, `cmdb_ci`, attachments, OAuth) via the public Simple/Unordered List widgets | High | Certain | `servicenow`, `idor`, `info-disclosure`, `api` | | `servicenow-kb-widget-exposure` | ServiceNow Knowledge Base Widget Exposure | Unauthenticated read of KB article contents via the public KB Article Page widget (not covered by the 2023 ACL hardening — KB access is gated by User Criteria, not ACLs) | High | Certain | `servicenow`, `idor`, `info-disclosure`, `api` | | `powerpages-dataverse-exposure` | Power Pages Dataverse Web API Data Exposure | Unauthenticated read of Microsoft Dataverse tables (contacts, accounts, leads, cases, custom) via a Power Pages portal's `/_api/` Web API | High | Certain | `powerpages`, `dataverse`, `idor`, `info-disclosure`, `api` | #### Model Context Protocol (MCP) Audited against OWASP; every active probe gates on a reachable MCP endpoint (`passive-mcp-endpoint-detect`). | Module ID | Name | Description | Severity | Confidence | Tags | | --------------------------- | -------------------------------- | ------------------------------------------------------------------------------------------------------------- | -------- | ---------- | ----------------------------------------- | | `mcp-server-probe` | MCP Server Probe | Probes for exposed MCP servers, enumerates tools, and attempts unauthenticated invocation | High | Firm | `mcp`, `api-security`, `misconfiguration` | | `mcp-tool-fuzz` | MCP Tool Argument Fuzzer | Fuzzes every enumerable MCP tool's arguments for OS command injection, LFI, SSRF (OAST), and prompt injection | High | Firm | `mcp`, `rce`, `lfi`, `ssrf`, `injection` | | `mcp-resource-fuzz` | MCP Resource URI Fuzzer | Probes `resources/read` with `file://`, cloud-metadata, path-traversal, and OAST SSRF payloads | High | Firm | `mcp`, `lfi`, `ssrf`, `path-traversal` | | `mcp-prompt-fuzz` | MCP Prompt Argument Fuzzer | Fuzzes `prompts/get` arguments for SSTI, command injection, and reflective prompt injection | High | Firm | `mcp`, `ssti`, `rce`, `prompt-injection` | | `mcp-completion-enum` | MCP Completion Enumeration | Uses `completion/complete` to leak valid resource URIs and prompt argument values | Medium | Firm | `mcp`, `info-disclosure`, `enumeration` | | `mcp-method-enum` | MCP JSON-RPC Method Enumeration | Wordlist enumeration of undocumented JSON-RPC methods on MCP servers | Medium | Firm | `mcp`, `enumeration`, `info-disclosure` | | `mcp-session-checks` | MCP Session Hardening Checks | Tests `Mcp-Session-Id` entropy, attacker-supplied SID acceptance (fixation), and post-handshake reuse | Medium | Firm | `mcp`, `session`, `auth-bypass` | | `mcp-batch-abuse` | MCP JSON-RPC Batch Abuse | Tests JSON-RPC batch handling: a smuggled `tools/call` inside an `initialize` batch | High | Firm | `mcp`, `auth-bypass` | | `mcp-origin-rebinding` | MCP Origin / DNS-Rebinding Check | Verifies an MCP server enforces Origin validation on streamable HTTP transports | High | Firm | `mcp`, `dns-rebinding`, `origin` | | `mcp-tool-definition-drift` | MCP Tool Definition Drift | Detects MCP servers serving mutating, non-deterministic tool definitions (rug-pull risk) | Medium | Tentative | `mcp`, `rug-pull`, `integrity` | | `mcp-dos-amplification` | MCP DoS Amplification | An unbounded oversized `ping` batch processed with no size or rate limit | Medium | Firm | `mcp`, `dos`, `rate-limit` | *** ## Passive Modules (116) Passive modules analyze existing request/response pairs without sending new traffic. ### XSS | Module ID | Name | Description | Severity | Confidence | Tags | | ---------------------- | -------------------------------------------- | --------------------------------------------------------------------------------------------------------- | -------- | ---------- | --------------------------------------------- | | `dom-xss-detect` | DOM XSS Detect | DOM XSS source-to-sink data flows (location.hash, innerHTML, eval, document.write) | Low | Firm | `xss` | | `css-injection-detect` | CSS Injection | Request values reflected into a `