Test JWT for manipulation vulnerabilities (alg:none, RS256→HS256, kid injection).

Runs deterministic checks against a JWT-protected endpoint:

1. alg:none — strip signature, set alg to "none"

2. RS256→HS256 — sign with public key as HMAC secret

3. kid injection — path traversal in kid header

4. Weak secret brute-force (opt-in, slow)

Test OAuth redirect_uri for open redirect and CSRF vulnerabilities.

Tests multiple redirect_uri bypass techniques:

• Path traversal

• Subdomain wildcard

• @ sign in URL

• JavaScript/data URIs

• Missing state parameter check

Scan for CORS misconfigurations.

Tests with various Origin headers to detect reflected origins, null origin acceptance, and wildcard with credentials.

Scan for verbose error page disclosure.

Triggers errors with bad input and checks for stack traces, debug info, and internal path disclosure.

Send an HTTP request and log it for later querying.

Replay a previously logged request with optional modifications.

Search past HTTP requests by full-text query.

Searches across URL, request body, and response body.

List recent logged HTTP requests.

Get details of a single logged HTTP request.

Fuzz a logged HTTP request by swapping ID parameters.

Loads the request from memory, identifies ID-like parameters (numeric IDs, UUIDs) in the URL and body, generates or uses provided candidate IDs, sends mutated requests, and diffs responses to detect access control bypass (IDOR/BOLA).

Fuzz a URL directly for IDOR/BOLA without needing a logged request.

Identifies ID parameters in the URL and body, mutates them, and compares responses to detect access control issues.

Test the same resource with different auth contexts (role-based BOLA).

Sends the same request with each auth context and compares responses to detect cross-role access control bypass. This is the vertical BOLA / privilege-escalation test: can a lower- privilege user access a higher-privilege resource?

Scan for common misconfigurations.

Checks for exposed .git directories, .env files, API keys in responses, debug endpoints, swagger docs, and other sensitive paths.

Scan a URL using projectdiscovery/nuclei with automatic-scan.

Wraps nuclei -u -as -json and parses output into findings. Requires nuclei installed and in PATH.

Scan for open redirect vulnerabilities.

Injects redirect payloads into URL parameters and checks if the server redirects to an external domain.

Test for race conditions by sending concurrent requests.

Sends N concurrent requests to the same URL and compares responses for differential behavior (different status codes, response lengths, or success/failure) — a strong indicator of TOCTOU race conditions.

List all domains with reconFTW output data on disk.

Returns domain names that have a Recon// directory under the reconFTW output root.

Get subdomains discovered for a target domain.

Get live web URLs (HTTP endpoints) for a target domain.

Get extracted endpoints/URLs for a domain, with optional filtering.

Get discovered query parameters for a target domain.

Get IP addresses associated with a target domain.

Get a summary of all recon data available for a domain.

Run a reconFTW scan against a domain.

Subprocess-wraps reconftw.sh (the same tool recon_bridge reads output from) — does not reimplement any recon logic. Writes to reconFTW's own Recon// layout, so recon_bridge's tools can query the results immediately after this completes.

Scan a filesystem path for leaked secrets.

Uses gitleaks (default) or trufflehog to scan a directory or file for hardcoded secrets, API keys, tokens, and credentials.

Scan a git repository for leaked secrets in commit history.

Uses trufflehog to scan git history for credentials, API keys, and other secrets.

Scan for missing or misconfigured security headers.

Checks for CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, COOP, CORP, COEP, and other security headers.

Probe a request's query/body parameters for SQL injection.

Tries a small, high-signal payload set: error-based (single quote/paren breakouts, checked against real DB error signatures — flags "confirmed" only on an unambiguous match) and boolean-based blind (TRUE/FALSE condition pair, flags "likely" on a significant response diff — needs human review, a diff alone doesn't prove SQLi).

Scan a URL for SSRF via out-of-band interaction (interactsh).

Injects unique OOB domains into request parameters. If the target server fetches our domain, SSRF is confirmed with near- zero false positives. Uses the interactsh protocol for OOB detection with RSA-2048 + AES-CFB encryption.

Scan a URL for Server-Side Template Injection (SSTI).

Injects math-evaluation probes ({{77}}, ${77}, etc.) into request parameters and checks if the result (49) appears in the response. Also detects known template engine error signatures.

Check a subdomain for takeover opportunities.

Checks for dangling CNAME records pointing to unclaimed external services (S3, GitHub Pages, Heroku, etc.).

Check multiple subdomains for takeover opportunities.

List findings with optional filters.

Get a single finding by ID.

Update a finding's status.

Get a per-target summary of all findings.

Returns counts by status, vuln_class, and confidence.

Manually save a finding for triage.

Probe a request's query/body parameters for reflected XSS.

Injects a unique marker wrapped in an HTML-breaking payload per parameter and statically analyzes the response: verbatim unescaped reflection is "confirmed", reflected-but-transformed is "likely" (needs human/browser verification), properly encoded or not-reflected-at-all produces no finding at all.