Upgrade Subscription
Data
Data Types
Modules

Web Scraper

Token cost: 1

This tool will download the HTML contents of the website and search for vulnerable keywords in the source code such as error strings, private secrets and known vulnerable keywords.

Minimal Risk Web Scraper

Progress

Web Spider

Token cost: 5

Enter a URL to crawl the website and extract its URLs. This tool can be used to discover hidden pages, directories, and files.


Whitelist www. Subdomain - Choose to allow scanning of the www. subdomain.
Low Risk Web Spider

Progress

HTML Entities

Token cost: 4

Enter a URL to extract resources from HTML entities including meta data, code comments and javascript files.


Image Metadata - Choose to analyse all image metadata or skip analysis.
Subscription Required Srcport Shield Verified
Minimal Risk HTML Entities

Progress

Host Discovery

Token cost: 20

Enter a domain name or IP address to discover actively listening ports and services.


Scan Type - Select the type of scan to perform.
Low Risk Host Discovery

Progress

ICMP

ICMP Host Discovery is a technique that uses ICMP (Internet Control Message Protocol) packets, such as ICMP Echo Request (ping), to determine the availability of hosts.

SYN

TCP SYN Host Discovery is technique that sends TCP SYN packets to specific ports to determine if the hosts are listening or closed.

ACK

TCP ACK Host Discovery is a technique that sends TCP ACK packets to specific ports to determine if the hosts are filtered or unfiltered.

UDP

UDP Host Discovery is a technique that sends UDP packets to specific ports to determine if the hosts are listening or closed.

IP

IP Host Discovery is technique that involves scanning IP addresses within a network range to identify active hosts.

WebTech Detector

Token cost: 5

Enter a URL to find out what a website is built with including its web technology stack, web server, and web framework.

Minimal Risk WebTech Detector

Progress

Cyber Squatting

Token cost: 10

Enter a domain name to find out if it has been impersonated or squatted.

Low Risk Cyber Squatting

Progress

Cookie Security

Token cost: 1

Enter a URL to find and analyze cookies on a website to check for security vulnerabilities.


Browser Headers - Choose to set additional headers (User Agent, Accept, Encoding, Cache Control, Sec-*...) when making requests that mimic a browser.

Request Type - By default we just make a basic request to the URL. You can choose to resolve requests, wait for the page to load and then extract the cookies. This is much slower and not recommended for crawling.
Subscription Required Srcport Shield Verified
Minimal Risk Cookie Security

Progress

HTTP Headers

Token cost: 4

Enter a URL to analyze a website's HTTP headers to check for security vulnerabilities.

Minimal Risk HTTP Headers

Progress

Request

A HTTP request header is sent by a client to a server and includes fields like User-Agent, Host, and Accept, which might be of use in cybersecurity to detect malicious requests, fraud, or unauthorized access.

Response

A HTTP response header is sent by the server to the client and includes fields such as Set-Cookie, Content-Security-Policy, and X-Frame-Options, which can help in implementing security measures like authentication, data integrity checks, and prevention against cross-site scripting or clickjacking attacks.

Server Field

The Server field in an HTTP response header provides information about the software used by the origin server, including the name and version of the server software. In the context of cybersecurity, this information might be used by attackers to identify potential vulnerabilities specific to the server software version, so it's often recommended to minimize or obfuscate this information to reduce the potential attack surface.

HTTP Methods

Token cost: 3

Enter a URL to check which HTTP methods are enabled on a website and if they are secure.


Port - Choose to scan either the HTTP or HTTPS version of the site.

Security Checks - Choose to perform security checks on the HTTP methods.
Subscription Required Srcport Shield Verified
Low Risk HTTP Methods

Progress

HTTP Method

An HTTP method is a verb used in the HTTP protocol to indicate the desired action to be performed on a specified resource. Common HTTP methods include GET (retrieve data), POST (submit data), PUT (update data), DELETE (remove data), and several others. HTTP methods are crucial to cybersecurity because they define the types of actions that can be taken on web resources. If not properly managed or restricted, malicious actors can exploit these methods to retrieve, modify, or delete data without authorization, leading to data breaches, data loss, or other cyber threats.

Safe

Common HTTP Headers such as: GET, HEAD, OPTIONS, TRACE

Unsafe

Common HTTP headers that can change data on the server such as: PUT, DELETE, CONNECT, POST, PATCH

Non-Standard

Application-specific headers that can perform a variety of tasks including: PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK, NOTIFY, SUBSCRIBE, UNSUBSCRIBE, PATCH, SEARCH, CONNECT

Local Storage

Token cost: 1

Enter a URL to retrieve its local storage key-value pairs and test for security vulnerabilities.

Minimal Risk Local Storage

Progress

Local Storage

Local storage is a web browser feature that allows websites to store data persistently on a user's device. Local storage can be exploited by cyber attackers through techniques like cross-site scripting (XSS) to steal or manipulate stored data, which might contain sensitive information such as user preferences, authentication tokens, or personal details, thereby posing a significant cybersecurity risk.

JavaScript

Local storage is often set by JavaScript, specifically Ajax requests that run after the page body has fully loaded. The Idle option allows you to wait a specified period of time for the network to go quiet before checking for local storage key-value pairs.

JavaScript CVE Scanner

Token cost: 15

Enter a URL to scan a website for known JavaScript vulnerabilities.

Low Risk JavaScript CVE Scanner

Progress

Open Redirect Scanner

Token cost: 50

Enter a URL to scan a website for open redirect vulnerabilities.


Max Parameters Per Request - Set the maximum number of URL parameters to scan per HTTP request.

Test Directories - By default we only test GET parameters. You can choose to test directories as well.

Skip JavaScript - Choose to skip testing JavaScript files which are unlikely to be vulnerable.

Skip CSS - Choose to skip testing CSS files which are unlikely to be vulnerable.
Subscription Required Srcport Shield Verified
Low Risk Open Redirect Scanner

Progress

Google Dorking

Token cost: 40

Provide hostname and we'll check if there is any sensitive information related on Google.


Search Type - Choose the type of search to perform.

Search Scope - Choose to target a specific site or the entire internet.

Search Depth - Choose how many pages to search through.
Subscription Required Srcport Shield Verified
Minimal Risk Google Dorking

Progress