3,748 tools found
Review gRPC method authorization, proxy metadata trust, service reflection, and browser-facing translators with controlled identities and bounded proof.
Assess GraphQL authorization, tenant isolation, REST state consistency, and operation budgets with controlled accounts and concrete response evidence.
Review upload validation, content processing, rendered files, and archive extraction using disposable accounts and owner-controlled canaries.
Assess unexpected-input error paths for exposed stack traces, query details, server paths, and framework information within a scoped test.
Trace browser-controlled input through DOM clobbering, postMessage, service workers, CSS, and framework sinks with bounded validation.
Plan scoped red-team or web assessment context, route platform skills, and record baselines, authentication limits, and deferred work.
Assess insecure deserialization across Java, PHP, Python, .NET, Ruby, and Node with scoped testing and evidence-based impact validation.
Review CSRF defenses, browser credential delivery, token binding, and account-linking flows with harmless, reversible test actions.
Assess CORS trust rules, credentialed browser reads, preflight behavior, and related origin checks within an authorized test scope.
Review cloud storage, exposed services, metadata access, and CloudWatch RUM permissions with scoped validation and controlled evidence.
Review CI/CD trust boundaries across workflows, runners, OIDC, artifacts, Jenkins, state files, and images using scoped evidence and isolated labs.
Assess whether CAPTCHA controls protect real application actions by comparing token handling, replay, session binding, and endpoint coverage.
