Run nmap from the WebSex network toolkit. The container executes nmap directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run rustscan from the WebSex network toolkit. The container executes rustscan directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run masscan from the WebSex network toolkit. The container executes masscan directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run autorecon from the WebSex network toolkit. The container executes autorecon directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run arp scan from the WebSex network toolkit. The container executes arp-scan directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run netbios scan from the WebSex network toolkit. The container executes nbtscan directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run packet capture from the WebSex network toolkit. The container executes tcpdump directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run packet analysis from the WebSex network toolkit. The container executes tshark directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run network mapper from the WebSex network toolkit. The container executes netdiscover directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run socat from the WebSex network toolkit. The container executes socat directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run amass from the WebSex enumeration toolkit. The container executes amass directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run subfinder from the WebSex enumeration toolkit. The container executes subfinder directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run fierce from the WebSex enumeration toolkit. The container executes fierce directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run dnsenum from the WebSex enumeration toolkit. The container executes dnsenum directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run theharvester from the WebSex enumeration toolkit. The container executes theHarvester directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run enum4linux from the WebSex enumeration toolkit. The container executes enum4linux directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run enum4linux ng from the WebSex enumeration toolkit. The container executes enum4linux-ng directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run rpcclient from the WebSex enumeration toolkit. The container executes rpcclient directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run smbmap from the WebSex enumeration toolkit. The container executes smbmap directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run netexec from the WebSex enumeration toolkit. The container executes nxc directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run responder from the WebSex enumeration toolkit. The container executes responder directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run recon ng from the WebSex enumeration toolkit. The container executes recon-ng directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run spiderfoot from the WebSex enumeration toolkit. The container executes spiderfoot directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run sherlock from the WebSex enumeration toolkit. The container executes sherlock directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run shodan from the WebSex enumeration toolkit. The container executes shodan directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run censys from the WebSex enumeration toolkit. The container executes censys directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run gobuster from the WebSex web toolkit. The container executes gobuster directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run ffuf from the WebSex web toolkit. The container executes ffuf directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run feroxbuster from the WebSex web toolkit. The container executes feroxbuster directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run dirb from the WebSex web toolkit. The container executes dirb directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run dirsearch from the WebSex web toolkit. The container executes dirsearch directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run nikto from the WebSex web toolkit. The container executes nikto directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run nuclei from the WebSex web toolkit. The container executes nuclei directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run sqlmap from the WebSex web toolkit. The container executes sqlmap directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run whatweb from the WebSex web toolkit. The container executes whatweb directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run wfuzz from the WebSex web toolkit. The container executes wfuzz directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run xsser from the WebSex web toolkit. The container executes xsser directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run dotdotpwn from the WebSex web toolkit. The container executes dotdotpwn directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run katana from the WebSex web toolkit. The container executes katana directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run hakrawler from the WebSex web toolkit. The container executes hakrawler directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run gau from the WebSex web toolkit. The container executes gau directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run urlfinder from the WebSex web toolkit. The container executes urlfinder directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run arjun from the WebSex web toolkit. The container executes arjun directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run paramspider from the WebSex web toolkit. The container executes paramspider directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run x8 from the WebSex web toolkit. The container executes x8 directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run jaeles from the WebSex web toolkit. The container executes jaeles directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run dalfox from the WebSex web toolkit. The container executes dalfox directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run httpx from the WebSex web toolkit. The container executes httpx directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run anew from the WebSex web toolkit. The container executes anew directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run qsreplace from the WebSex web toolkit. The container executes qsreplace directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run uro from the WebSex web toolkit. The container executes uro directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run wafw00f from the WebSex web toolkit. The container executes wafw00f directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run zap from the WebSex web toolkit. The container executes zaproxy directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run subzy from the WebSex web toolkit. The container executes subzy directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run curl from the WebSex web toolkit. The container executes curl directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run httpie from the WebSex web toolkit. The container executes http directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run hydra from the WebSex credentials toolkit. The container executes hydra directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run medusa from the WebSex credentials toolkit. The container executes medusa directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run patator from the WebSex credentials toolkit. The container executes patator directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run john from the WebSex credentials toolkit. The container executes john directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run hashcat from the WebSex credentials toolkit. The container executes hashcat directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run hash identifier from the WebSex credentials toolkit. The container executes hash-identifier directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run ophcrack from the WebSex credentials toolkit. The container executes ophcrack directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run evil winrm from the WebSex credentials toolkit. The container executes evil-winrm directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run metasploit from the WebSex exploitation toolkit. The container executes msfconsole directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run msfvenom from the WebSex exploitation toolkit. The container executes msfvenom directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run exploit search from the WebSex exploitation toolkit. The container executes searchsploit directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run gdb from the WebSex binary toolkit. The container executes gdb directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run radare2 from the WebSex binary toolkit. The container executes radare2 directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run ghidra from the WebSex binary toolkit. The container executes ghidra directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run binwalk from the WebSex binary toolkit. The container executes binwalk directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run ropgadget from the WebSex binary toolkit. The container executes ROPgadget directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run ropper from the WebSex binary toolkit. The container executes ropper directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run checksec from the WebSex binary toolkit. The container executes checksec directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run objdump from the WebSex binary toolkit. The container executes objdump directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run strings from the WebSex binary toolkit. The container executes strings directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run xxd from the WebSex binary toolkit. The container executes xxd directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run file from the WebSex binary toolkit. The container executes file directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run one gadget from the WebSex binary toolkit. The container executes one_gadget directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run pwninit from the WebSex binary toolkit. The container executes pwninit directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run pwntools from the WebSex binary toolkit. The container executes pwn directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run volatility from the WebSex forensics toolkit. The container executes vol directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run foremost from the WebSex forensics toolkit. The container executes foremost directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run steghide from the WebSex forensics toolkit. The container executes steghide directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run exiftool from the WebSex forensics toolkit. The container executes exiftool directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run testdisk from the WebSex forensics toolkit. The container executes testdisk directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run scalpel from the WebSex forensics toolkit. The container executes scalpel directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run bulk extractor from the WebSex forensics toolkit. The container executes bulk_extractor directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run zsteg from the WebSex forensics toolkit. The container executes zsteg directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run hashpump from the WebSex forensics toolkit. The container executes hashpump directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run sleuthkit fls from the WebSex forensics toolkit. The container executes fls directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run sleuthkit icat from the WebSex forensics toolkit. The container executes icat directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run prowler from the WebSex cloud container iac toolkit. The container executes prowler directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run scout suite from the WebSex cloud container iac toolkit. The container executes scout directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run trivy from the WebSex cloud container iac toolkit. The container executes trivy directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run kube hunter from the WebSex cloud container iac toolkit. The container executes kube-hunter directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run kube bench from the WebSex cloud container iac toolkit. The container executes kube-bench directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run docker bench from the WebSex cloud container iac toolkit. The container executes docker-bench-security directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run checkov from the WebSex cloud container iac toolkit. The container executes checkov directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run terrascan from the WebSex cloud container iac toolkit. The container executes terrascan directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run aircrack from the WebSex wireless toolkit. The container executes aircrack-ng directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run airmon from the WebSex wireless toolkit. The container executes airmon-ng directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run airodump from the WebSex wireless toolkit. The container executes airodump-ng directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run aireplay from the WebSex wireless toolkit. The container executes aireplay-ng directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Run kismet from the WebSex wireless toolkit. The container executes kismet directly with the supplied argv tokens; shell parsing is never used. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Search text files inside the selected engagement with GNU grep. Prefer websex_jq for structured JSON and websex_python for custom parsing. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Parse, query, transform, and validate JSON inside the selected engagement with jq. Use this instead of brittle regular expressions for JSON and OpenAPI documents. Runs from the selected engagement namespace; use relative paths for engagement artifacts.

Search every WebSex executable and native MCP tool by exact websex_* name, substring query, or category. An unfiltered call returns only counts; set include_all=true only when the complete catalog is genuinely required.

Dispatch one executable-backed catalog entry by its exact websex_* name returned by websex_catalog. This is primarily a compact-mode fallback; in full mode prefer the direct named tool. Use relative paths for engagement artifacts.

Run an arbitrary Bash script inside the WebSex container from the selected engagement directory. Supports pipelines and redirection; the container is the trust boundary. Execution is asynchronous and client-cancellable.

Run inline Python source or an engagement-relative Python file inside the WebSex container. Provide exactly one of source or path. Execution uses the WebSex Python environment and is asynchronous and client-cancellable.

Create a persistent engagement namespace and return its server-generated ID.

List persistent WebSex engagements available for client-side selection.

Return metadata for one server-generated WebSex engagement ID.

List files within the WebSex engagement workspace.

Read a UTF-8 text file from the WebSex engagement workspace.

Write or append a UTF-8 text file inside the WebSex engagement workspace.

Delete one file or empty directory inside the WebSex engagement workspace.

Write a structured Markdown security finding inside the engagement workspace.

Send a complete HTTP request and return the full response without truncation.

Send a GraphQL query and return the full server response.

Decode JWT header and payload fields without claiming signature verification.

Extract operations from a JSON OpenAPI document at a URL or engagement-relative path. Prefer this over grep, jq, or Python when the task is OpenAPI operation inventory.

Check a password against HIBP using its k-anonymity range API.

Return the container process table and active network connections.

Analyze a workspace binary with the angr Python library.

Retrieve a CVE record from NVD without inventing intelligence.

Calculate complete cryptographic hashes for a workspace file.

Audit an OpenAPI JSON document from a URL or engagement-relative path for operation inventory, declared authentication coverage, path-parameter consistency, sensitive fields, and transport review items. Results are evidence-backed leads and are persisted in the engagement.

Assess a GraphQL endpoint using introspection evidence and enumerate query/mutation fields. Results are persisted and do not claim vulnerabilities without response evidence.

Audit JWT structure and claims for evidence-backed review items such as alg=none, missing expiry, issuer mismatch, and audience mismatch. Signature verification is never implied.

Run a caller-bounded, single-parameter API fuzz matrix against an authorized target and preserve complete response evidence. The caller selects payloads and max_requests.

Create a persistent engagement-scoped HTTP workbench session with declared target scope, default headers, cookies, TLS, and redirect behavior.

List persistent HTTP workbench sessions in one engagement.

Inspect one engagement-scoped HTTP workbench session and its history count.

Update an HTTP workbench session's scope, headers, cookies, match/replace rules, TLS verification, or redirect behavior.

Replay one crafted HTTP request through an engagement workbench session, enforcing scope and applying persisted headers, cookies, and match/replace rules. Complete evidence is retained.

Run caller-bounded sniper-style payload iteration through an HTTP workbench session against one query, header, body, or path location.

Read the complete persisted request/response history for one engagement HTTP workbench session.

Launch an isolated headless Chromium context inside the WebSex container and return a server-generated browser session ID bound to the engagement.

List live browser sessions owned by this MCP process for one engagement.

Inspect one live WebSex browser session, including URL, title, network event count, and interception rules.

Close a live browser context and release its Chromium resources. Unlike engagement close, this has real process lifecycle semantics.

Navigate a live WebSex browser session to a URL and return the resulting status, headers, URL, and title.

Return the current page text and accessibility-oriented ARIA snapshot, with optional complete HTML.

Perform a selector-based browser action: click, fill, type, clear, press, check, uncheck, select, or hover.

Capture a browser screenshot into the selected engagement and return its relative artifact path.

Evaluate JavaScript in the active page and return its serializable result.

Read cookies, localStorage, and sessionStorage from a live browser session.

Set cookies, localStorage, and sessionStorage in a live browser session.

Configure browser request interception with blocked URL patterns, URL replacements, and extra request headers.

Return complete request/response metadata captured by a live browser session, optionally clearing the in-memory log afterward.

Encode text as base64, base64url, hex, URL, or form data.

Extract URLs, IPv4 addresses, CVEs, and common hashes from supplied text.

Detect deterministic technology hints in supplied HTTP headers and body text.

Create a deterministic WebSex engagement plan using catalog tool names.

Recommend WebSex tools using deterministic objective matching.

Order caller-supplied findings into a reviewable severity-based attack chain.

Summarize complete WebSex tool results without discarding their output.

Inject unique canaries into parameters and classify reflection context (HTML/attribute/JS/URL/comment) with encoding state, plus CSP and cookie posture. Evidence-first: returns exact snippets, not payload guesses.

Boolean differential SQLi oracle on one parameter with true/false/control payload triplets — fires only when true matches baseline, false diverges, and control behaves like false.

Time-based SQLi oracle: N baseline vs N sleep-payload samples, median ratio comparison across dialects (MySQL/MSSQL/Postgres/Oracle).

Server-side template injection via inert math canaries ({{7*74311}} family) with engine identification from error fingerprints. High-confidence only on evaluated literals.

Command injection with echo canaries per separator variant; time-based sleep fallback with sampled medians. Confirmed only by canary output or reproducible delay.

Path traversal / LFI against a target system file with depth-varied and encoded traversal prefixes; confirmed by target-file content absent from baseline.

401/403/405 bypass matrix: method sweep, forwarding/origin headers, X-Original-URL rewrite, path-shape mutations, case/encoding tricks, host confusion. Confirmed by status flip away from the block page.

SSRF probe with optional oob_canary_host (webhook.site) for content-read proof, metadata markers, internal-vs-dead-host differential, and blind timing fallback.

Open redirect via scheme/host confusion matrix (@-authority, backslash, encoded slashes, allowlist suffix tricks); confirmed by Location/refresh pointing at the canary host. Also flags javascript:/data: Location values.

Object-level authorization: replay one object URL as owner, other low-privilege user, and anonymous; fires on identical cross-identity success or inverted authz.

Sweep object ids through a {id} template under one identity to build a status/shape oracle, then replay hits with websex_idor_probe.

Function-level authorization: privileged verbs (POST/PUT/PATCH/DELETE) replayed as low-privilege identity vs privileged identity; fires when low-priv reaches the same success.

Over-posting: inject sensitive fields (role/admin/balance/flags) into create/update and verify persistence by re-reading the object. High-confidence on persisted sentinels.

CORS origin ladder: evil/null/suffix/prefix origins on actual + preflight requests; classification depends on ACAO reflection WITH credentials.

CSRF posture: token anatomy of the form page, SameSite cookie posture, and foreign-Origin replay of the state-changing request against a live session (caller supplies session_headers).

CRLF / response splitting via encoded CR/LF variants; confirmed when injected headers or Set-Cookie appear that the baseline did not have.

Host / X-Forwarded-Host trust: whether absolute URLs (and optionally password-reset responses) rebuild from an attacker host.

Live-oracle JWT audit: alg=none acceptance, RS256->HS256 confusion via JWKS, weak HS256 secret cracking against a bundled + payload-derived wordlist, claim tampering, kid leads. Calibrates with a valid token control request first.

Race condition: N simultaneous requests per round against a single-use flow; fires when more than one request succeeds where the flow allows 1. Caller supplies the exact legitimate request.

Business logic values: negative/zero/overflow/discount/status-forced patches against fields present in the base body; fires when illegal values are accepted and reflected.