3,748 tools found
Assess OAuth and OIDC boundaries from redirects to token exchange with owned accounts, verified navigation, and bounded impact evidence.
Interpret NTLM challenge metadata with bounded capture, offline decoding, and evidence separating protocol fields from unproven impact.
Assess NoSQL query boundaries using context-specific inputs, synthetic records, and evidence of actual authentication or data access.
Assess Node.js merge, template, proxy, and command boundaries with isolated markers and evidence of the actual security effect.
Assess role, invitation, token, and configuration boundaries with controlled accounts and evidence of the exact unauthorized access demonstrated.
Validate prompt-injection and retrieval risks with synthetic canaries, controlled sessions, and proof of the downstream boundary crossed.
Validate file inclusion and traversal with synthetic canaries, context-specific checks, and evidence separating file reads from execution.
Assess LDAP and XPath injection with context-specific parsing, controlled evidence, and clear boundaries between Active Directory and generic LDAP.
Review Laravel debug, dashboard, key, signed-URL, and mass-assignment risks with evidence tied to actual configuration and controlled accounts.
Assess Kubernetes and Docker exposure with exact permission checks, controlled canaries, and evidence bounded to the access demonstrated.
Assess JWT signature verification and key trust using controlled identities, scoped checks, and redacted evidence of authorization boundaries.
Assess Host-derived reset links, cache entries, upstream routing, path overrides, and OAuth URLs using owned accounts and isolated canaries.
