ASFB v0.1

No matching modules.

Pipeline order & coverage

Reuse archive crawl seeds and observed response metadata in later stages.

Guided mode only reorders enabled tools. Manual mode preserves every position. Hostnames found by Amass remain inventory and are not automatically added to scan scope.

Limits apply per scan job, not globally across all browser sessions.

Non-sensitive settings are saved in cookies for this browser. Each target's stages keep their selected order. Up to three jobs can run in the Space; endpoints on the same hostname remain sequential. ZAP and shared advisory databases each use an exclusive slot. Parallel execution overlaps existing bounded scanner processes on HF.

Protocol endpoints

GraphQL and raw WebSocket checks use matching same-origin URLs already found by discovery, or the paths below. Blank inputs skip tools with no applicable endpoint. Paths apply to the selected asset and are not saved in cookies.

GraphQL checks metadata and query-only native signatures; no application mutations, subscriptions, cyclic fragments or schema reconstruction. WebSocket checks validate opening handshakes without sending frames; Socket.IO negotiation and authenticated hijack testing are outside this profile. Native Corsy checks HTTP CORS; wildcard access or anonymous acceptance is not itself a credential leak.

VCS metadata review needs a directory URL ending in / and never fetches repository objects or history. S3 review applies only to bucket-root URLs such as https://bucket.s3.amazonaws.com/ or https://s3.amazonaws.com/bucket/. It requests no object contents or writes. Takeover review needs provider/DNS corroboration and never registers or claims services. Unresolved hostnames can run DNS review when Takeover is enabled; HTTP tools skip until public DNS resolves.

IDOR-Forge · limited GET profile

Use explicit reference IDs you are authorized to test. This keyless, anonymous profile sends at most four GET requests to one path and never follows redirects. Configure one selected asset at a time. Without these inputs the module skips.

Similarity is a review signal. This profile cannot prove object ownership or missing authorization; verify candidates using two authorized test accounts. Credentials, mutations, broad payload fuzzing and the upstream GUI are outside this profile. Reference values and response bodies are omitted from results and logs.

Optional module inputs

Optional inputs stay in this job's memory. Source/SBOM content is not included in saved results. Attach artifacts to one selected asset at a time. Full pipeline skips tools whose inputs are absent.

Semgrep reviews one supplied source file using ten bundled rules. Source is never executed or uploaded to a rule service. This profile does not infer source code from a website URL. Language preference is saved; pasted source stays unsaved. WAFW00F runs before payload scanners in Guided mode and records vendor context; a WAF fingerprint is not a vulnerability.

Verify found credentials I own or am authorized to test

Optional: runs TruffleHog’s built-in verification for all detector types against the original supplied source. Native detectors use the credential and its source context to check the relevant service, which can include a database or another host. No five-provider restriction or 10-candidate cap. One worker, with a 120-second overall process limit on HF. Some detectors may be unable to verify, skip verification or encounter network errors; an unverified result never proves a secret is invalid. Values, account details and provider errors are redacted. Full pipeline does not enable this option.

These tools inspect supplied package metadata. OSV sends package names/versions to its public advisory service. Trivy and dep-scan fetch public databases on their first applicable run; database availability is shown in logs. dep-scan uses a smaller application-only database covering 2024 onward.

This asset is an API target; allow Kiterunner's eight-route GET sample.

Amass uses standalone 4.2.0 passive discovery. Returned hostnames are inventory only and are not added to scan scope. Nettacker runs one HTTP-status check.

garak runs two benign antivirus-signature output-filter checks. Use this only for an LLM expected to filter those signatures. No local model, API key, browser or GPU is required.

Race-condition replay

Enable Race replay in the module library and configure one asset. The profile can repeat POST operations: use disposable test fixtures and identities. It sends two sequential requests to a control fixture, then two overlapping requests to a distinct fresh fixture. Only one two-request burst is allowed; HF timing is best effort.

Use a JSON success predicate. An optional GET verifier must report a non-negative integer counter starting at zero for each fixture. Exactly one sequential effect must be established before the parallel test. Without state verification, duplicate success responses are informational, since idempotent acknowledgements can look like a race.

NoSQL HTTP operator review

Enable NoSQL HTTP review and configure a known-working baseline request and success predicate. Six paced requests compare the baseline, a negative scalar, an inert object, equality controls and a not-equal operator. This checks Mongo-style HTTP parsing, not direct MongoDB/CouchDB/Redis ports. Operator support may be intentional; findings require review of the API contract.

For GET, the selected query field is replaced with bracket-form operator parameters; for POST, the selected top-level JSON string field is replaced with typed objects. Only equality/not-equal operators are generated. No scripts, sleeps, data enumeration or credential extraction.

Private, single-job inputs

Request paths, headers, bodies, fixture values and predicates stay unsaved and clear after queuing. Optional test-account Cookie/Authorization headers apply only to the selected origin; environment credentials and account profiles are not imported. These fields are never saved in cookies or job options. Other settings and module choices keep their saved preferences.

One asset per replay job, one shared replay slot on HF, verified TLS, no redirects, no retries, 64 KiB response cap. Normal pacing applies between requests/phases; only the explicit two-request race burst overlaps. Profiles skip when absent, even in Full pipeline.

Nuclei · Template selection

Combine any bundled profiles, compatible community templates, and custom YAML. This selection applies to new scans only. Community and custom templates must pass the server's GET/HEAD-only validation; dynamic DSL, POST requests, remote interactions, and unsafe paths are blocked.

Custom YAML templates

Paste up to 3 supported templates, separating them with a line containing only three dashes. Each must be under 20 KB, with at most 2 GET/HEAD checks and scoped paths. Uploaded files remain in this browser tab until queued.

Account profiles (session only)

Do not use other users' credentials. Cookies stay in backend process memory, not disk.