SauronSec
Home / Coverage
68 modules. 20+ classes. One standard.
From server-side injections to infrastructure reconnaissance: every surface is tested — then confirmed. Expand a family to see each module and its scan key.
Server-side injections
The most critical classes: attacker input reaches the engine (database, shell, template, XML parser).
14 modules
-m sqli
SQL injection
DB error, blind boolean, time-based, UNION — params, headers, cookies, JSON.
-m nosqli
NoSQL injection
MongoDB/CouchDB: error signatures + $ne/$eq differential.
-m cmdi
Command injection
Shell injection via benign canary echo + time delay.
-m ssti
SSTI (template)
Template injection via arithmetic evaluation probes.
-m lfi
LFI / path traversal
Local file inclusion (system-file signatures, php://filter).
-m xxe
XXE
Internal XML entities + EXTERNAL entity resolution (SYSTEM/XInclude).
-m ldap_inject
LDAP injection
LDAP directory error signatures.
-m xpath_inject
XPath injection
XPath/XML error signatures.
-m ssi_inject
SSI
Server-Side Includes (set/echo, unique marker).
-m crlf
CRLF / HTTP header
HTTP header injection via CRLF.
-m header_inject
Header injection
XSS/SQLi via reflected User-Agent, Referer, X-Forwarded-*.
-m json_inject
JSON injection (API)
Valid JSON body rebuilt from the OpenAPI spec, every field tested.
-m html_inject
HTML injection
Unencoded reflection of HTML markup.
-m proto_pollut
Prototype pollution
Server-side prototype pollution (benign marker).
Cross-Site Scripting
Script execution in the victim’s browser — reflected, stored, DOM, confirmed in a real browser.
4 modules
-m xss
Reflected XSS
Unencoded reflection in an executable HTML/JS context.
-m stored_xss
Stored XSS
Inert marker written then found executable on a clean request.
-m dom_xss
DOM-XSS (static)
Source→sink flow in first-party JS (hash→innerHTML/eval…).
-m browser_runtime
DOM-XSS runtime
Confirmation in a real browser (--browser option).
SSRF, redirects & blind flaws
The server acts on an attacker-controlled URL, or the flaw has no visible signal (out-of-band detection).
3 modules
-m ssrf
SSRF
Server-side fetch of an attacker-supplied URL.
-m open_redirect
Open Redirect
Controlled redirect to an external host.
-m oob
Blind flaws (OOB)
Callbacks to a local HTTP/DNS collaborator (--oob option).
Access control / IDOR
OWASP #1: reaching what you shouldn’t. Confirmed by cross-checking two real sessions.
2 modules
-m idor
IDOR
Cross-account access (2 sessions), unauth object reads, ID enumeration.
-m access_control
Broken Access Control
Forced browsing + vertical escalation, reproduced, read-only.
Authentication / session / tokens
Misplaced trust in a token, a cookie or an OAuth flow.
4 modules
-m jwt
JWT weaknesses
Weak algos, unsafe claims, offline-crackable HMAC secret, jku/x5u/jwk.
-m oauth
OAuth redirect_uri
Loosely validated redirect_uri (code/token theft).
-m csrf
CSRF
State-changing forms without an anti-CSRF token.
-m cookie_security
Insecure cookies
Cookies missing Secure / HttpOnly / SameSite.
Information / secrets / source disclosure
What the site leaks unknowingly: source, secrets, backups, verbose errors.
8 modules
-m exposed_files
Exposed sensitive files
.git, .env, backups…
-m source_disclosure
Disclosed source/backups
Sources, backups, archives, config + directory listing.
-m secrets_scan
Secrets in pages
Keys, tokens, private IPs, internal hosts, hardcoded passwords.
-m js_analysis
JS endpoints/secrets
Endpoints + secrets exposed in JavaScript.
-m source_maps
Exposed source maps
*.js.map files.
-m webpack
Webpack reconstruction
Enumerates chunks, rebuilds sources, hunts secrets/endpoints.
-m error_disclosure
Verbose errors
Framework errors, stack traces, path leaks.
-m exposed_services
Exposed admin/APIs
Actuator, Elasticsearch, Docker, K8s, phpMyAdmin, Adminer, .git/config…
Configuration / headers / cache
The misconfigurations that open the door: CORS, CSP, headers, cache poisoning.
11 modules
-m security_headers
Missing security headers
Absent headers + insecure cookie attributes.
-m cors
Overly permissive CORS
Origin reflection, null, prefix/suffix/regex bypasses, wildcard+credentials.
-m clickjacking
Clickjacking
Missing anti-framing protection (XFO + CSP frame-ancestors).
-m csp
Weak CSP
Permissive Content-Security-Policy directives.
-m http_methods
Dangerous HTTP methods
TRACE/XST and advertised dangerous methods.
-m mixed_content
Mixed content
HTTP resources loaded on an HTTPS page.
-m host_header
Host header injection
Reflection of a controlled Host header.
-m cache_poisoning
Cache poisoning
Unkeyed header (X-Forwarded-Host…) reflected and cached.
-m cache_deception
Cache deception
Dynamic pages made cacheable via a static suffix.
-m tabnabbing
Tabnabbing
target="_blank" links without rel="noopener".
-m sri
Missing SRI
Third-party scripts/styles without an integrity attribute.
Defacement / upload / RCE
The paths to code execution or content takeover.
4 modules
-m defacement
Write access
WebDAV/PUT allowing defacement (read-only methods).
-m upload
Upload endpoints
Locates the upload surface (no upload performed).
-m webshell
Present web shells
Web shells already present (known signatures).
-m deserialization
Unsafe deserialization
Client-exposed serialized object (Java/PHP) → RCE via gadget.
Crypto / transport / email
Transport encryption and anti-spoofing for your domain.
2 modules
-m tls
TLS / certificate
Supported TLS versions + certificate validity.
-m dns_security
DNS/email security
SPF, DMARC, DKIM, CAA (anti-spoofing + certificate issuance control).
Reconnaissance / surface / infrastructure
Full mapping of the attack surface, before detection even begins.
13 modules
-m subdomains
Subdomains
Maps reachable subdomains.
-m takeover
Subdomain takeover
Dangling CNAME to an unclaimed third-party service.
-m s3
Cloud buckets
Listable S3 / GCS / Azure Blob / DO Spaces.
-m dir_discovery
Directory discovery
Existing common paths (404 filtering).
-m api_discovery
API discovery
Swagger/OpenAPI/WSDL/GraphQL.
-m graphql
GraphQL
Introspection enabled + schema leakage.
-m websocket
WebSocket / CSWSH
WS endpoints + cross-origin hijacking + unencrypted ws:// transport.
-m axfr
DNS zone transfer
Name servers allowing full AXFR.
-m port_scan
Port scan
TCP-connect scan of common ports.
-m waf
WAF / CDN
Identifies the frontal WAF/CDN (Cloudflare, Akamai, Imperva, AWS…).
-m tech
Stack + vulnerable libs
Stack + JS libraries with known CVEs (Retire.js-style).
-m server_cve
Server CVEs
Server software version → known CVEs.
-m cms
CMS + exposed admin
Identifies the CMS + exposed admin panels.
Each module runs standalone (-m <key>) or through a full profile. See the documentation.
Coverage that doesn’t lie.
Every detected flaw is proven before it lands in your report.