loading
Loading content
loading
Vulnerability Scanning
Web app fuzzing with active DAST. Crawl each app, inject payloads into discovered inputs, report insecure behaviors, and recrawl for stored issues.
Web app fuzzing finds what a template run cannot: the inputs the app actually exposes and how it behaves when you push payloads into them. This module crawls each live application, injects payloads into the inputs it discovered, then recrawls so stored issues surface. It is active DAST, not a CVE template pack and not directory brute force.
You feed a URL list. This module crawls each live web app, injects payloads into discovered inputs, then recrawls. Crawl-then-payload DAST: not a named-stack CVE pack, not directory brute force, not a JavaScript AST pass. It switches to a headless browser when the HTML spider cannot reach the application state, and it can run across thousands of web applications in one pass.
Pipeline guidance
Web tail (does not include this node):
hosts -> probe-web -> web FP -> tech-specific
This module is adjacent. It consumes URLs, not web-technologies.
url-details and parameter
wordlists). You can consume JS-derived wordlists; this module still does
the crawl-then-payload job.findings and sitemap into
Generate Scan Report.web-technologies.
Misconfig, outdated-software, and the exposed-artifact family run on a URL
list without injecting payloads. Do not cross-wire onto the network tail
(hosts -> open-ports -> network FP -> (misconfig | weak-creds)).Nest this after you have live web URLs and want payload testing of discovered
inputs, not stack naming or path mapping. Probe produces the live URL list.
Crawling and directory brute force can seed deeper URLs.
Analyze JavaScript Code can feed
url-details for non-GET endpoints. Fingerprint feeds the tech-specific
sibling, not this module.
urls (FILE). List of URLs to scan, one per line.
header (STRING). Header(s) to include in HTTP requests.
header-file (FILE). File with header(s) to include in HTTP requests.
in-scope (FILE). URLs, paths, or regular expressions to include.
out-of-scope (FILE). URLs, paths, or regular expressions to exclude. The
rate-limit (STRING). Maximum requests per second per machine. Default:
url-details (FILE). JSONL of URL and request details, for non-GET
findings (FILE). JSONL of finding details. Published fields: finding,
sitemap (FILE). The sitemap the crawl accessed, in a format compatible
The tables this module produces. Sample rows are illustrative.
Crawl-then-payload DAST findings: injected payloads, matched behaviors, and triggering requests.
findingtext | locationurl | severitytext | matchesjson | descriptiontext | hostnametext | domain_nametext | ip_addresstext | attacktext | bodytext | methodtext | fieldtext | requesttext | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | SQL Injection (Boolean-Based) | https://app.example.com/search?q=test | high | Array[1] | Boolean-based SQL injection in q parameter. | app.example.com | example.com | 203.0.113.20 | q=test' OR '1'='1 | GET | q | GET /search?q=test%27+OR+%271%27%3D%271 HTTP/1.1 | |
| 2 | Cross-Site Scripting (Reflected) | https://app.example.com/profile?name=guest | medium | Array[1] | Reflected XSS in name parameter. | app.example.com | example.com | 203.0.113.20 | name=<script>alert(1)</script> | GET | name | GET /profile?name=%3Cscript%3Ealert(1)%3C%2Fscript%3E HTTP/1.1 | |
| 3 | File Upload Form (Informational) | https://app.example.com/upload | info | Array[1] | Unrestricted file upload form detected. | app.example.com | example.com | 203.0.113.20 | POST | file | POST /upload HTTP/1.1 |
Sitemap the crawl accessed, in a ZAP Messages-compatible format.
methodtext | urlurl | status_codeint | content_lengthint | timestampdatetime | |
|---|---|---|---|---|---|
| 1 | GET | https://app.example.com/ | 200 | 1024 | 2026-08-13T10:00:00Z |
| 2 | GET | https://app.example.com/search?q=test | 200 | 2048 | 2026-08-13T10:00:05Z |
| 3 | POST | https://app.example.com/upload | 200 | 512 | 2026-08-13T10:00:10Z |
Why this is not it
Curated checks for ten named stacks off web-technologies. No crawl. This fuzzes discovered inputs on any URL.
Why this is not it
Wordlist guessing of unlinked paths. This injects payloads into inputs the crawler found.
Why this is not it
Retrieve-and-unpack of client-side JS. It can feed url-details and wordlists here. It does not crawl or inject payloads.
Discover Paths via Crawling maps linked paths. This fuzzes the inputs on those paths. Scan for Outdated Software runs CVE/CNVD HTTP matchers with no crawl and no payload injection.
questions
template engine; not this crawl-then-payload job
plan instrument
SQL injection validation instrument
Drop this module into a Trickest workflow and connect it to your upstream and downstream nodes. The face contract above is the wiring.
Get a personalized demo
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.