74 passive security checks, all OWASP-aligned

Checks for sensitive content indexed by search engines via robots.txt, sitemap.xml, and meta robots directives.

WSTG-INFO-01

Identifies web server software (nginx, Apache, IIS), version numbers, and server-side technologies from headers and responses.

WSTG-INFO-02

Scans HTML comments, meta tags, and source code for developer notes, internal paths, and sensitive information.

WSTG-INFO-05

Discovers subdomains via DNS enumeration of common prefixes (api, admin, staging, dev, internal).

WSTG-INFO-03 · WSTG-INFO-04

Detects dangling DNS CNAMEs pointing to unclaimed cloud resources that could be hijacked by an attacker.

WSTG-CONF-10

Maps application entry points including forms, URL parameters, API endpoints, and file upload locations.

WSTG-INFO-06 · WSTG-INFO-07

Identifies frontend frameworks (React, Vue, Angular), backend frameworks (Rails, Django, Laravel), and CMS platforms (WordPress, Drupal).

WSTG-INFO-08

Identifies exposed API endpoints, GraphQL introspection, Swagger/OpenAPI documentation, and API versioning.

WSTG-INFO-06

Resolves CNAME records for the target domain via Google DNS-over-HTTPS, then probes each CNAME destination against 27 known unclaimed-resource fingerprints. A fingerprint match confirms an active takeover vector.

WSTG-CONF-10

Validates HTTPS enforcement, certificate validity, protocol versions, and cipher suite strength.

WSTG-CONF-09

Tests for dangerous HTTP methods (TRACE, PUT, DELETE, OPTIONS) that may be unintentionally enabled.

WSTG-CONF-06

Comprehensive check for HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.

WSTG-CONF-07

Tests how the server handles various file extensions and MIME types, looking for bypass opportunities.

WSTG-CONF-03

Probes for common backup files (.bak, .old, .sql), editor artifacts (.swp, ~), and unreferenced pages.

WSTG-CONF-04

Checks for exposed admin panels (/admin, /wp-admin, /administrator, /phpmyadmin) and management interfaces.

WSTG-CONF-05

Tests Cross-Origin Resource Sharing configuration for wildcard origins, credential leakage, and origin reflection.

WSTG-CONF-07

Audits Cache-Control, Pragma, and Vary headers to detect caching of sensitive content.

WSTG-CONF-08

Scans page source for leaked credentials: AWS keys, API tokens, database connection strings, private keys.

WSTG-CONF-04

Validates SPF, DKIM, and DMARC DNS records for email spoofing protection.

WSTG-CONF-07

Checks DNS CAA records for certificate authority restrictions and DNSSEC deployment status.

WSTG-CONF-09

Parses the Content-Security-Policy header for unsafe directives ('unsafe-inline', 'unsafe-eval', wildcard or HTTP script-src) and checks whether CSP violation reporting is configured.

WSTG-CONF-12

Fetches /robots.txt and checks Disallow entries for sensitive paths (admin, api, backup, config, etc.). Also checks for a /.well-known/security.txt vulnerability disclosure file.

WSTG-CONF-05

Checks for Cross-Origin-Embedder-Policy (COEP), Cross-Origin-Opener-Policy (COOP), and Cross-Origin-Resource-Policy (CORP) response headers.

WSTG-CONF-10

Queries the Google DNS-over-HTTPS API for a CAA (Certification Authority Authorisation) record on the target domain.

WSTG-CONF-10

Checks whether the site is served over HTTPS (a prerequisite for HTTP/2) and whether HTTP/3 is advertised via the Alt-Svc response header.

WSTG-CONF-10

Probes common GraphQL paths (/graphql, /api/graphql, /gql, /v1/graphql) for enabled introspection. A valid __schema response in production exposes the full API schema — types, mutations, and admin fields — to any unauthenticated caller.

WSTG-CONF-05

Detects exposed Ghost CMS admin panels, version disclosure, insecure API endpoints, and misconfigured member/subscription endpoints.

WSTG-CONF-05 · WSTG-INFO-08

Passively assesses whether a WordPress installation may be exposed to the "wp2shell" pre-authentication RCE chain: CVE-2026-63030 (REST API batch-route confusion, CWE-436) combined with CVE-2026-60137 (SQL injection in WP_Query author__not_in, CWE-89). Affected: 6.9.0–6.9.4, 7.0.0–7.0.1. Patched in 6.9.5 and 7.0.2.

WSTG-CONF-05

Passively assesses whether a WordPress installation may be running a vulnerable version of the WPDM – Premium Packages plugin (by Shahjada). CVE-2026-61948 is an unauthenticated SQL injection (CWE-89, CVSS 9.3 CRITICAL) affecting all versions <= 6.2.0, patched in 7.0.0. Plugin presence is inferred from asset paths in page source; version is extracted from ?ver= query params or public readme.txt only.

WSTG-INFO-05

Checks if login/registration pages leak valid usernames through error messages or response timing.

WSTG-IDNT-04

Analyses password field constraints and client-side validation to infer password policy strength.

WSTG-ATHN-07

Detects signs of weak authentication: default credentials paths, bypass parameters, debug auth modes.

WSTG-ATHN-04

Identifies Insecure Direct Object Reference patterns: sequential IDs in URLs, predictable resource paths, missing authorization checks.

WSTG-ATHZ-04

Detects role parameters, admin paths without protection, and authorization bypass patterns in URLs and forms.

WSTG-ATHZ-02 · WSTG-ATHZ-03

Analyses OAuth implementations for deprecated flows (implicit), open redirect in redirect_uri, state parameter usage, and token exposure.

WSTG-ATHZ-05

Passive inspection of OAuth/OIDC initiation links: wildcard redirect_uri, missing state parameter, deprecated implicit flow, broad scopes, and OIDC issuer mismatch via /.well-known/openid-configuration.

WSTG-ATHZ-05

Checks for rate limiting headers (X-RateLimit-*), retry-after responses, and CAPTCHA implementations on sensitive endpoints.

WSTG-BUSV-05

Comprehensive cookie audit: HttpOnly, Secure, SameSite, __Host-/__Secure- prefixes, and entropy analysis.

WSTG-SESS-02

Detects if session tokens are regenerated after authentication by analysing Set-Cookie patterns.

WSTG-SESS-03

Checks forms for CSRF tokens, SameSite cookie attributes, and custom header requirements.

WSTG-SESS-05

Detects JWT tokens, analyses algorithm (none/HS256/RS256), checks for exposed secrets, and validates claims.

WSTG-SESS-01

Parses all <form> elements and checks for GET-method forms, password inputs without autocomplete="off", and the absence of CSRF token patterns (_token, csrf, _wpnonce, authenticity_token).

WSTG-SESS-05 · WSTG-INPV-01

Passive detection of XSS sinks: innerHTML, document.write, eval, reflected parameters in responses.

WSTG-INPV-01 · WSTG-INPV-02

Detects SQL error messages, query patterns in URLs, and database-specific fingerprints in responses.

WSTG-INPV-05

Checks for file path parameters, local file inclusion patterns, and directory listing exposure.

WSTG-INPV-13

Tests URL redirect parameters for open redirect vulnerabilities that enable phishing attacks.

WSTG-INPV-04

Detects OS error messages, shell patterns, and input fields that may pass data to system commands.

WSTG-INPV-12

Detects patterns that may enable business logic abuse: price manipulation fields, quantity limits, workflow bypass paths.

WSTG-BUSV-01 · WSTG-BUSV-04 · WSTG-BUSV-09

Scans for outdated libraries (jQuery, Angular, Lodash), dangerous patterns (eval), and exposed source maps.

WSTG-CLNT-01

Identifies DOM XSS sources (location, document.URL) and sinks (innerHTML, eval) in JavaScript code.

WSTG-CLNT-01

Verifies X-Frame-Options and CSP frame-ancestors protection against UI redressing attacks.

WSTG-CLNT-09

Detects WebSocket connections, checks for wss:// enforcement, and analyses handshake security.

WSTG-CLNT-10

Analyses window.postMessage usage for missing origin validation and sensitive data exposure.

WSTG-CLNT-11

Checks localStorage and sessionStorage for sensitive data (tokens, PII, credentials).

WSTG-CLNT-12

Maps all external script origins, identifies tracking/analytics scripts, and checks for SRI hashes.

WSTG-CLNT-01

Identifies embedded chatbots (Intercom, Drift, custom LLM) and assesses prompt injection risk.

WSTG-CLNT-01

Counts external scripts and stylesheets lacking integrity= attributes. Without SRI hashes, a compromised CDN can silently serve malicious code to all users.

WSTG-CLNT-13

Inspects HTML meta tags for a UTF-8 charset declaration (prevents charset-sniffing XSS), a viewport tag, and unexpected noindex directives on public pages.

WSTG-CLNT-01

Inspects page HTML for excessive inline scripts, mixed content (HTTP resources on HTTPS pages), and other content-level security weaknesses.

WSTG-CLNT-01 · WSTG-CLNT-10

Probes publicly accessible .map files for each detected JavaScript bundle. Source maps allow reconstruction of original, unminified source code.

WSTG-CLNT-01

Analyses encryption indicators in cookies, tokens, and API responses for weak or deprecated algorithms.

WSTG-CRYP-04

Detects verbose error messages that disclose stack traces, database queries, or internal paths.

WSTG-ERRH-01 · WSTG-ERRH-02

Enriches findings with NVD CVSS scores, FIRST EPSS exploit probability, and CISA KEV status.

Cross-references detected libraries against OSV.dev for known vulnerabilities in dependencies.

WSTG-CLNT-01

Maps findings to SOC 2 TSC, ISO 27001:2022, GDPR articles, PCI DSS, and OWASP Top 10 2021.

Generates infrastructure-aware fix instructions tailored to your detected technology stack.

Generates typosquat variants, checks certificate transparency for lookalike domains, and monitors brand abuse.

Checks domain against URLhaus, PhishTank, and other malware/phishing blocklists.

Compares against historical baseline to detect security posture degradation.

Checks your IP and domain against 20+ authoritative DNS blocklists including Spamhaus ZEN, Barracuda, SpamCop, SURBL, and DroneBL.

Reserved for social engineering surface analysis. Typosquat variant generation has been consolidated into the Brand Impersonation module.

Queries the URLhaus abuse.ch database to determine whether the target domain is listed as actively distributing malware or hosting phishing content.

Generates domain permutations (deletion, transposition, keyboard-adjacency, homoglyph, insertion) and resolves each via Google DNS-over-HTTPS. Registered and resolving variants are classified by WHOIS age.

Generates Unicode confusable variants (Cyrillic, Greek, accented) of the domain and encodes them as Punycode ACE labels. Each is checked via Google DNS-over-HTTPS and crt.sh for active TLS certificates not issued to the real domain.