Is this a template catalog against live URLs?

No. That job lives on [nuclei](/tools/nuclei) and on the outdated-software and technology-specific modules. This page is crawl, fuzz, recrawl, report.

Can it run behind login?

Only with a live header (Cookie or Bearer) that stays valid for the run. There is no login-sequence recorder. SSO, MFA, OAuth, and CSRF-gated login are out of band. [Get Cookies via Puppeteer Recording](/library/modules/get-cookies-via-puppeteer-recording) can emit a Cookie header for targets you already recorded.

Is it safe on production?

Not by default. It submits forms and recrawls, so it can write records and trigger stored behavior. Run against staging, or with tight `in-scope`, a low `rate-limit`, and write endpoints excluded.

Do JavaScript wordlists replace this module?

No. Analyze JavaScript code produces candidate endpoints and parameter wordlists. Feed `url-details` and those wordlists here. The crawl-then-payload pass is still this module.

Is this passive or safe scanning?

No. This is active DAST. It submits forms, writes records, and recrawls, so a run can trigger stored behavior on production. Run against staging, or pin `in-scope`, lower `rate-limit`, and exclude write endpoints.

How many apps can it scan in one pass?

Thousands. The module runs across a URL list at fleet scale, with per-machine rate limiting and scope controls. Scale is real, but the crawl-then-payload method is the same whether you feed ten URLs or ten thousand.

2026-08-13

Vulnerability Scanning

Fuzz Web Applications for Vulnerabilities

Web app fuzzing with active DAST. Crawl each app, inject payloads into discovered inputs, report insecure behaviors, and recrawl for stored issues.

What Fuzz Web Applications for Vulnerabilities does

Web app fuzzing finds what a template run cannot: the inputs the app actually exposes and how it behaves when you push payloads into them. This module crawls each live application, injects payloads into the inputs it discovered, then recrawls so stored issues surface. It is active DAST, not a CVE template pack and not directory brute force.

You feed a URL list. This module crawls each live web app, injects payloads into discovered inputs, then recrawls. Crawl-then-payload DAST: not a named-stack CVE pack, not directory brute force, not a JavaScript AST pass. It switches to a headless browser when the HTML spider cannot reach the application state, and it can run across thousands of web applications in one pass.

Where it fits in the pipeline

Illustrative excerpt. Each node is a Trickest module.

Pipeline guidance

Web tail (does not include this node): hosts -> probe-web -> web FP -> tech-specific

This module is adjacent. It consumes URLs, not web-technologies.

Upstream. Probe for Web Servers (live URLs). Discover Paths via Crawling and Discover Paths via Directory Brute Force (path seeds). Analyze JavaScript code (url-details and parameter wordlists). You can consume JS-derived wordlists; this module still does the crawl-then-payload job.
Downstream. findings and sitemap into Generate Scan Report.
Parallel. Scan for Technology-Specific Vulnerabilities runs tailored checks for ten named stacks off web-technologies. Misconfig, outdated-software, and the exposed-artifact family run on a URL list without injecting payloads. Do not cross-wire onto the network tail (hosts -> open-ports -> network FP -> (misconfig | weak-creds)).

When to use this

Nest this after you have live web URLs and want payload testing of discovered inputs, not stack naming or path mapping. Probe produces the live URL list. Crawling and directory brute force can seed deeper URLs. Analyze JavaScript Code can feed url-details for non-GET endpoints. Fingerprint feeds the tech-specific sibling, not this module.

Inputs and outputs

Required: urls (FILE). List of URLs to scan, one per line.
Optional: header (STRING). Header(s) to include in HTTP requests.
header-file (FILE). File with header(s) to include in HTTP requests.
in-scope (FILE). URLs, paths, or regular expressions to include.
out-of-scope (FILE). URLs, paths, or regular expressions to exclude. The
rate-limit (STRING). Maximum requests per second per machine. Default:
url-details (FILE). JSONL of URL and request details, for non-GET
Outputs: findings (FILE). JSONL of finding details. Published fields: finding,
sitemap (FILE). The sitemap the crawl accessed, in a format compatible

Data

The tables this module produces. Sample rows are illustrative.

findings13 columns · 3 sample rows

Crawl-then-payload DAST findings: injected payloads, matched behaviors, and triggering requests.

	findingtext	locationurl	severitytext	matchesjson	descriptiontext	hostnametext	domain_nametext	ip_addresstext	attacktext	methodtext	fieldtext	requesttext
1	SQL Injection (Boolean-Based)	https://app.example.com/search?q=test	high	Array[1]	Boolean-based SQL injection in q parameter.	app.example.com	example.com	203.0.113.20	q=test' OR '1'='1	GET	q	GET /search?q=test%27+OR+%271%27%3D%271 HTTP/1.1
2	Cross-Site Scripting (Reflected)	https://app.example.com/profile?name=guest	medium	Array[1]	Reflected XSS in name parameter.	app.example.com	example.com	203.0.113.20	name=<script>alert(1)</script>	GET	name	GET /profile?name=%3Cscript%3Ealert(1)%3C%2Fscript%3E HTTP/1.1
3	File Upload Form (Informational)	https://app.example.com/upload	info	Array[1]	Unrestricted file upload form detected.	app.example.com	example.com	203.0.113.20		POST	file	POST /upload HTTP/1.1

sitemap5 columns · 3 sample rows

Sitemap the crawl accessed, in a ZAP Messages-compatible format.

	methodtext	urlurl	status_codeint	content_lengthint	timestampdatetime
1	GET	https://app.example.com/	200	1024	2026-08-13T10:00:00Z
2	GET	https://app.example.com/search?q=test	200	2048	2026-08-13T10:00:05Z
3	POST	https://app.example.com/upload	200	512	2026-08-13T10:00:10Z

How it differs from similar modules

Scan for Technology-Specific Vulnerabilities

Why this is not it

Curated checks for ten named stacks off web-technologies. No crawl. This fuzzes discovered inputs on any URL.

Discover Paths via Directory Brute Force

Why this is not it

Wordlist guessing of unlinked paths. This injects payloads into inputs the crawler found.

Analyze JavaScript Code

Why this is not it

Retrieve-and-unpack of client-side JS. It can feed url-details and wordlists here. It does not crawl or inject payloads.

Discover Paths via Crawling maps linked paths. This fuzzes the inputs on those paths. Scan for Outdated Software runs CVE/CNVD HTTP matchers with no crawl and no payload injection.

questions