SauronSec
Confirm, not just detect.
A scanner that “finds” is easy. A scanner that proves — then discards anything that doesn’t reproduce — is what separates triaging noise from fixing flaws.
Map
Deep crawl of the surface: forms, hidden parameters, APIs, SPAs rendered in a real browser. Nothing is tested blindly without knowing it exists.
Detect
68 modules probe each entry point: parameters, headers, cookies, JSON bodies driven by the OpenAPI spec. Error, boolean, time-based, out-of-band.
Confirm
Each candidate is replayed against a baseline. Reflections, randomness and false signals are neutralised. Whatever doesn’t reproduce is dropped before the report.
Report
Evidence, severity, impact and a concrete fix. Readable HTML, PDF to hand over, JSON for your tools, SARIF for your CI.
Anti-false-positive verification
After detection, each flaw is safely and boundedly re-exploited. Two goals: drop what doesn’t reproduce, and qualify the real benefit to an attacker.
Controlled replay
The flaw is reproduced under the same conditions. A single, expected signal confirms — or refutes.
Baseline differential
The “clean” response is the reference. Whatever changes significantly is kept; statistical noise is ignored.
Explicit verdicts
Each finding carries a verdict: EXPLOITABLE, VERIFIED, TRAP or FALSE POSITIVE.
A clear line, held by design.
Re-verification is bounded and non-destructive. It reads a minimal internal proof to reach a verdict, but never stores, prints or reports the extracted data. A finding records a verdict and a benefit category — never the data itself.
What the scanner never does
- Destructive query (DROP / DELETE / UPDATE)
- Write, upload or persistence on the target
- Full data dump, JWT forging, defacement
- Credential brute-force
See the proof in numbers.
The method is good. Measured results are better.