Total KB References
190
Grounded Security Passages
Executable Audit Rules
105 Active
Book-Grounded Scanner Probes
Standards & CWE Catalog
101
OWASP, MITRE, NIST, ISO, RFCs
Cybersecurity Books
65
Books & Ingested PDFs
Live Scan Usage
21
Real Scans Run on This Site
Audit Target URL & Authenticated Scan Options
Knowledge Base Audit Engine • 190 References & 105 Active Book-Grounded Rules Loaded Click to view dynamic KB rules →
HIGH
sql-injection-surface
(sqli)
OWASP-A03-INJECTION
CWE-89
MEDIUM
reflected-xss-surface
(xss)
OWASP-A03-INJECTION
CWE-79
HIGH
strict-transport-security
(header_required)
OWASP-SEC-HEADERS
CWE-319
HIGH
content-security-policy
(header_required)
OWASP-SEC-HEADERS
CWE-79
LOW
x-content-type-options
(header_required)
OWASP-SEC-HEADERS
CWE-16
LOW
referrer-policy
(header_required)
OWASP-SEC-HEADERS
CWE-200
LOW
permissions-policy
(header_required)
OWASP-SEC-HEADERS
CWE-16
LOW
cross-origin-opener-policy
(header_required)
OWASP-SEC-HEADERS
CWE-693
LOW
cross-origin-embedder-policy
(header_required)
OWASP-SEC-HEADERS
CWE-693
LOW
cross-origin-resource-policy
(header_required)
OWASP-SEC-HEADERS
CWE-693
LOW
cache-control
(header_required)
OWASP-SEC-HEADERS
CWE-524
MEDIUM
content-type
(header_required)
OWASP-SEC-HEADERS
CWE-436
MEDIUM
x-frame-options
(header_required)
OWASP-CLICKJACK
CWE-1021
HIGH
Secure
(cookie_flag)
OWASP-SESSION
CWE-614
HIGH
HttpOnly
(cookie_flag)
OWASP-SESSION
CWE-1004
MEDIUM
SameSite
(cookie_flag)
OWASP-SESSION
CWE-1275
MEDIUM
CWE-601
(open_redirect)
CWE-601
CWE-601
MEDIUM
open-redirect-next-param
(code_review)
CWE-601
CWE-601
HIGH
CWE-200-SENSITIVE
(sensitive_paths)
CWE-200-SENSITIVE
CWE-200
MEDIUM
CWE-749
(http_methods)
CWE-749
CWE-749
HIGH
sql-string-concat
(code_review)
CWE-89
CWE-89
HIGH
execute-fstring-sql
(code_review)
CWE-89
CWE-89
HIGH
php-query-var-concat
(code_review)
CWE-89
CWE-89
HIGH
js-template-literal-sql
(code_review)
CWE-89
CWE-89
HIGH
java-statement-execute-concat
(code_review)
CWE-89
CWE-89
HIGH
innerHTML-assign
(code_review)
CWE-79
CWE-79
HIGH
insertadjacenthtml
(code_review)
CWE-79
CWE-79
MEDIUM
document-write
(code_review)
CWE-79
CWE-79
HIGH
react-dangerouslysetinnerhtml
(code_review)
CWE-79
CWE-79
HIGH
vue-v-html
(code_review)
CWE-79
CWE-79
MEDIUM
jinja-safe-filter
(code_review)
CWE-79
CWE-79
MEDIUM
ejs-unescaped-output
(code_review)
CWE-79
CWE-79
HIGH
disabled-ssl-verification
(code_review)
CWE-295
CWE-295
HIGH
csrf-protection-disabled
(code_review)
CWE-352
CWE-352
HIGH
jwt-alg-none
(code_review)
OWASP-API-2023-AUTH
CWE-287
LOW
insecure-authz-comment
(code_review)
OWASP-API-2023-AUTH
CWE-285
LOW
ddos-mitigation-posture
(ddos_mitigation)
ATTACK-T1498-DOS
CWE-400
HIGH
python-pickle-load
(code_review)
CWE-502-DESERIALIZATION
CWE-502
MEDIUM
yaml-unsafe-load
(code_review)
CWE-502-DESERIALIZATION
CWE-502
HIGH
php-unserialize
(code_review)
CWE-502-DESERIALIZATION
CWE-502
HIGH
java-objectinputstream
(code_review)
CWE-502-DESERIALIZATION
CWE-502
HIGH
node-serialize
(code_review)
CWE-502-DESERIALIZATION
CWE-502
HIGH
known-vulnerable-dependency
(dependency_scan)
OWASP-SCVS-SUPPLYCHAIN
CWE-1104
HIGH
python-command-shell
(code_review)
CWE-78
CWE-78
HIGH
php-command-exec
(code_review)
CWE-78
CWE-78
HIGH
node-child-process-exec
(code_review)
CWE-78
CWE-78
HIGH
java-runtime-exec
(code_review)
CWE-78
CWE-78
HIGH
python-eval-exec
(code_review)
CWE-94
CWE-94
HIGH
js-eval
(code_review)
CWE-94
CWE-94
HIGH
urlopen-user-input
(code_review)
CWE-918
CWE-918
HIGH
requests-user-supplied-url
(code_review)
CWE-918
CWE-918
HIGH
js-fetch-user-url
(code_review)
CWE-918
CWE-918
HIGH
php-file-get-contents-var
(code_review)
CWE-918
CWE-918
MEDIUM
java-openconnection-var
(code_review)
CWE-918
CWE-918
MEDIUM
php-upload-unvalidated
(code_review)
CWE-434
CWE-434
HIGH
hardcoded-password
(code_review)
CWE-798
CWE-798
HIGH
hardcoded-api-key
(code_review)
CWE-798
CWE-798
MEDIUM
default-credentials
(code_review)
CWE-798
CWE-798
HIGH
sql-injection
(sqli)
WSTG-INPV-05-SQLI
CWE-89
HIGH
blind-sqli-surface
(blind_sqli)
WSTG-INPV-05-SQLI
CWE-89
MEDIUM
reflected-xss-surface
(xss)
WSTG-INPV-01-XSS
CWE-79
LOW
ddos-mitigation-posture
(ddos_mitigation)
OWASP-DOS-CHEATSHEET
CWE-400
HIGH
Secure
(cookie_flag)
WSTG-SESS-04-FIXATION
CWE-384
HIGH
HttpOnly
(cookie_flag)
WSTG-SESS-04-FIXATION
CWE-384
LOW
brute-force-rate-limit-posture
(ddos_mitigation)
OWASP-RATELIMIT-BRUTEFORCE
CWE-307
MEDIUM
rate-limit-backoff-posture
(rate_limiting)
OWASP-RATELIMIT-BRUTEFORCE
CWE-307
HIGH
path-traversal-lfi-surface
(path_traversal)
WSTG-INPV-07-PATHTRAV
CWE-22
MEDIUM
file-open-tainted-path
(code_review)
WSTG-INPV-07-PATHTRAV
CWE-22
HIGH
php-include-tainted
(code_review)
WSTG-INPV-07-PATHTRAV
CWE-98
HIGH
state-changing-form-csrf-token
(csrf_token)
WSTG-SESS-05-CSRF
CWE-352
MEDIUM
rate-limit-backoff-posture
(rate_limiting)
OWASP-RATELIMIT-DEEP
CWE-307
MEDIUM
weak-hash-credential
(code_review)
CWE-327
CWE-327
HIGH
weak-cipher
(code_review)
CWE-327
CWE-327
MEDIUM
random-secret-source
(code_review)
CWE-327
CWE-330
MEDIUM
log-sensitized-secret
(code_review)
CWE-532
CWE-532
MEDIUM
GraphQL Schema Introspection & Surface
(sensitive_paths)
OWASP-API-2023-GRAPHQL
CWE-200
INFO
Security.txt Vulnerability Disclosure Policy
(sensitive_paths)
RFC-9116-SECURITY-TXT
CWE-200
INFO
Webserver Metafiles & Sitemap Surface
(sensitive_paths)
WSTG-INFO-03-ROBOTS
CWE-200
HIGH
xxe-xml-parse
(code_review)
CWE-611-XXE
CWE-611
HIGH
prototype-pollution-pattern
(code_review)
CWE-1321-PROTOTYPE-POLLUTION
CWE-1321
HIGH
ssti-template-string
(code_review)
CWE-1336-SSTI
CWE-1336
MEDIUM
verbose-debug-exposure
(code_review)
CWE-209-ERROR-LEAK
CWE-209
MEDIUM
Authentication Rate Limiting (NIST SP 800-63B)
(rate_limiting)
NIST-SP-800-63B-AUTH
CWE-307
HIGH
Strict Transport Security Enforced (NIST SC-8)
(missing_header)
NIST-SP-800-53-SC-8
CWE-319
MEDIUM
Input Validation & Output Encoding (NIST SI-10)
(xss)
NIST-SP-800-53-SI-10
CWE-20
MEDIUM
MIME-Type Sniffing Protection (ISO 27001)
(missing_header)
ISO-27001-A-8-28
CWE-693
MEDIUM
Secure Cryptographic Algorithm (ISO 27001)
(code_review)
ISO-27001-A-8-26
CWE-327
MEDIUM
Exception Sanitization (ISO 27001)
(code_review)
ISO-27001-A-8-12
CWE-209
LOW
Permissions-Policy Hardware Restriction
(missing_header)
W3C-PERMISSIONS-POLICY
CWE-693
LOW
missing-permissions-policy
(missing_header)
W3C-PERMISSIONS-POLICY
CWE-693
LOW
Referrer-Policy URL Privacy
(missing_header)
W3C-REFERRER-POLICY
CWE-116
LOW
missing-referrer-policy
(missing_header)
W3C-REFERRER-POLICY
CWE-116
LOW
Cross-Origin-Opener-Policy Isolation
(missing_header)
W3C-COOP-COEP
CWE-346
LOW
missing-coop-header
(missing_header)
W3C-COOP-COEP
CWE-346
MEDIUM
Directory Indexing / Browsing Exposure
(dirlisting)
CWE-548-DIR-INDEXING
CWE-548
HIGH
Cross-Domain Policy Wildcard Exposure
(crossdomain_policy)
CWE-942-CROSSDOMAIN
CWE-942
MEDIUM
Open URL Redirection Surface
(open_redirect)
CWE-601-OPEN-REDIRECT
CWE-601
HIGH
Hardcoded Secrets & API Keys
(code_review)
CWE-798-HARDCODED-CREDENTIALS
CWE-798
HIGH
Dynamic Code Evaluation Surface
(code_review)
CWE-94-CODE-INJECTION
CWE-94
MEDIUM
API Object Property Exposure
(stateful_api)
OWASP-API3-2023-BOPLA
CWE-213
MEDIUM
API Resource Consumption Throttling
(rate_limiting)
OWASP-API4-2023-UNRESTRICTED
CWE-770
HIGH
API SSRF Surface
(open_redirect)
OWASP-API7-2023-SSRF
CWE-918
HIGH
OS Command Execution Surface
(code_review)
CWE-77-COMMAND-INJECTION
CWE-77
HIGH
command-injection-shell
(code_review)
CWE-77-COMMAND-INJECTION
CWE-77
MEDIUM
Cryptographic Algorithm Robustness
(code_review)
CWE-327-BROKEN-CRYPTO
CWE-327
Code Review, Dependency Scan & Security Test Generation
KB-GROUNDED
Static code review (SQLi, XSS, SSRF, insecure auth, deserialization, weak crypto...), dependency/advisory scanning (Log4Shell, prototype pollution, and other known CVEs), and generation of Burp Intruder / fuzzer / curl regression tests - all driven by the same knowledge-base rules.
Static Code Review
Dependency & Advisory Scan
Security Audit Progress & Grounding Engine
Ready to audit. Enter a target URL above and click Run Security Audit.
0%
1 TLS & Domain Check
2 Security Probes
3 Crawl & Entry Points
4 190 References Grounding
5 Remediation Bundle
100% Safe & Authorized Audit Guarantee • Powered by 190 Security References
Guaranteed 100% safe, non-destructive, read-only probes with zero data modification or harmful payloads. Every security check, explanation, and remediation bundle is strictly grounded in 190 authoritative security standards & curated cybersecurity books (OWASP Top 10s, MITRE CWE Catalog, ASVS v4.0.3, NIST SP 800-53/160, ISO 27001:2022, PCI DSS v4.0, CIS Benchmarks, IETF RFCs).