Home / Documentation

Command reference

SauronSec’s options, profiles and recipes. Syntax generated from --help — no invented option. For the per-vulnerability module list, see the coverage.

Basic syntax

Every command follows this template. -y confirms you are authorized to test the target (mandatory), -o names the report files.

$ python main.py -t <URL> [options] -y -o <report>

General options

Option	Role	Example
`-t, --target URL`	Single target	`-t https://target.com/`
`--targets FILE\|list`	Multiple targets (1 report/target + summary)	`--targets targets.txt`
`-p, --profile NAME`	Scan profile (see profiles)	`-p ultra`
`-m, --modules k1,k2`	Specific modules (overrides the profile)	`-m sqli,xss`
`--threads N`	Worker threads	`--threads 40`
`--rps N`	Max rate (requests/second)	`--rps 40`
`--risk 0-100`	Aggressiveness (wordlists + probes)	`--risk 100`
`--max-time MIN`	Time budget (0 = unlimited)	`--max-time 0`
`--depth quick\|normal\|deep\|max`	Crawl depth	`--depth max`
`--no-crawl`	Test only the target URL	`--no-crawl`
`--param-fuzz`	Force hidden-parameter fuzzing	`--param-fuzz`
`--waf-check`	Only detect a WAF then quit	`--waf-check`
`--resume [FILE]`	Resume a scan after interruption	`--resume scan.ckpt`
`--stealth`	Stealth mode (low rate + jitter)	`--stealth`
`--proxy URL`	Proxy (requests + browser)	`--proxy http://127.0.0.1:8080`
`--browser`	Runtime browser analysis (real DOM-XSS, SPA)	`--browser`
`-y, --yes`	Confirm authorization (mandatory)	`-y`

Profiles `-p`

A profile = a set of modules + default settings. From the stealthiest to the most aggressive.

Profile	Use
`passive`	Stealthiest: recon + headers, no aggressive injection.
`default`	Balanced (standard detection).
`deep`	Thorough: deep crawl + parameter fuzzing.
`recon`	Reconnaissance/mapping (subdomains, DNS, ports, WAF, tech…).
`deface`	Defacement-focused (WebDAV, upload, exposed files, webshell…).
`api`	API-oriented (specs, GraphQL, JSON, endpoints).
`max`	Almost everything, 150-page crawl.
`ultra`	Everything, full power: risk 100, max rate, all probes.

Authentication (logged-in scan)

Essential for the private area (IDOR, access control). Easiest: paste a “Copy as cURL” of a logged-in request from your DevTools. The session is monitored and reconnected automatically.

$ python main.py -t https://target.com/ -p ultra \
    --auth-curl "curl 'https://target.com/app' -H 'Cookie: sid=ABC'" -y -o report

To confirm cross-account IDOR, provide a second account via --idor-cookie / --idor-bearer.

Verification & exploitation

Anti-false-positive verification is on by default: every flaw is safely and boundedly replayed. --sqlmap confirms a SQLi with an independent tool (no extraction). --exploit extracts bounded, masked proof — written authorization required.

--verify--no-verify--sqlmap--nuclei--exploit

Reports & output

Available formats: HTML (readable), PDF (to hand over), JSON (tools/diff), SARIF (CI, GitHub, DefectDojo).

$ python main.py -t https://target.com/ -p ultra --format all -y -o client_report

Ready-to-use recipes

Check for a WAF first (without scanning)

$ python main.py -t https://target.com/ --waf-check -y

Quick scan (surface only)

$ python main.py -t https://target.com/ --depth quick -y -o report

Balanced standard scan

$ python main.py -t https://target.com/ -p default -y -o report

Authenticated scan by cookie

$ python main.py -t https://target.com/ -p ultra --cookie "sid=ABC; csrf=XYZ" -y -o report

The most powerful (authorized target)

$ python main.py -t https://target.com/ -p ultra --browser --param-fuzz --max-time 0 --verify --nuclei --format all -y -o report

Stealth mode (low-and-slow)

$ python main.py -t https://target.com/ --stealth -y -o report

Through a proxy (Burp)

$ python main.py -t https://target.com/ -p deep --proxy http://127.0.0.1:8080 -y -o report

Legal reminders

-y declares you are authorized to test the target. Only scan what you are allowed to test. --exploit = real exploitation → written authorization required. The scanner is detection-only by default: it proves the flaw without extracting anything.