Vulnerability Scanner
Check authorized web targets for common vulnerability and exposure patterns.
The Vulnerability Scanner tests a list of in-scope URLs for common web security issues and groups the findings for review. It helps prioritize manual verification; it does not replace a tester's judgment or prove impact by itself.
What It Does
- Checks for SQL injection indicators.
- Looks for cross-site scripting (XSS) and local or remote file inclusion patterns.
- Detects exposed environment or configuration files and can highlight selected environment keys.
- Finds exposed administration interfaces such as Adminer.
- Supports country filtering and proxy rotation where available.
Automated findings can include false positives and false negatives. Confirm each result manually and safely before reporting it.
What You Can Use It For
- Triage during an authorized penetration test or bug bounty program.
- Checking a known application inventory for recurring exposure patterns.
- Prioritizing URLs for deeper manual review.
- Re-testing approved targets after a remediation change.
Typical Input and Output
Input: an explicitly authorized URL list, selected vulnerability types, and optional targeting settings.
Output: categorized findings that identify the affected URL and suspected issue type.
When to Choose It
Use the Scanner after you have confirmed ownership or written permission and narrowed the input to the approved scope. Use the Crawler first when you still need to map an application. SQL injection findings can be passed to the Dumper only when your authorization explicitly permits data-access validation.
See Task Settings for module options.