loading
Loading content
loading
Vulnerability Scanning
Scan URLs for web misconfigurations: exposed APIs, debug surfaces, default-state takeover. Response-validated. Not CVE matching, not config files.
Web misconfiguration scanning asks whether an instance is still in a default or unsafe setup state: an API left public, a debug surface left on, an uninitialized app a visitor can finish installing and take over. This module probes a URL list for those setup issues and validates responses to cut false positives. It is not CVE matching and not leftover config file hunting.
You feed a URL list. This module probes live URLs for web misconfigurations: setup disclosure, exposed APIs, debug surfaces, and default-state takeover such as an uninitialized GitLab or a public Swagger API. It validates responses to cut false positives. The question is whether setup is still default, not whether a CVE matcher fired.
Pipeline guidance
findings into Generate Scan Report.urls face. Same contract, different artifact class, unswappable H1s.This family sits on the web tail after probe (hosts -> probe-web -> this family). It does not sit on hosts -> open-ports -> network FP -> (misconfig | weak-creds). Do not cross-wire to Scan Network Services for Misconfigurations; that takes port-details, not a URL list.
Nest this after you have live web URLs and you want to know whether setup is still default: is the API public, is debug left on, can a visitor finish setup and take the box. A root-only URL list misses nested misconfigs; seed deeper paths from crawling or directory brute force when you care about paths under /app.
urls (FILE): live web server URLs, one per line. Example: https://foo.example.com, https://bar.example.com/app.
header (STRING): header(s) to include in HTTP requests.
header-file (FILE): file of header(s) to include.
rate-limit (STRING): max requests per second per machine. Default 300.
findings: JSONLines rows. Published fields: finding, location, severity, hostname, domain_name, ip_address, method, description, and the triggering request. Example rows: Uninitialized GitLab instances (high), Public Swagger API (info). v1.0.1 added Basic Auth at info.
The tables this module produces. Sample rows are illustrative.
Web misconfiguration findings: exposed APIs, debug surfaces, and default-state takeover.
findingtext | locationurl | severitytext | matchestext | descriptiontext | hostnametext | domain_nametext | ip_addresstext | methodtext | fieldtext | |
|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Uninitialized GitLab Instance | https://git.example.com/ | high | default-state | GitLab instance is uninitialized and can be taken over by completing setup. | git.example.com | example.com | 203.0.113.30 | GET | |
| 2 | Public Swagger API | https://api.example.com/swagger.json | info | swagger-ui | Swagger API documentation is publicly accessible. | api.example.com | example.com | 198.51.100.40 | GET | |
| 3 | Debug Surface Exposed | https://app.example.com/debug | high | debug-endpoint | Debug endpoint is reachable without authentication. | app.example.com | example.com | 203.0.113.20 | GET |
Scan for Misconfigured Software
Artifact class it owns
Insecure setup: APIs, debug, default-state takeover
Upstream it needs
live urls
Artifact class it owns
Login UI, then default creds on a subset
Upstream it needs
live urls
Artifact class it owns
Token patterns in the live HTTP response
Upstream it needs
live urls
Do not 301 any of these six onto each other. Do not collapse this page into the network-services misconfig module (different tail, different input).
questions
network twin; `port-details`, not this job
fixed checklist; distinction, not the engine this module wraps
Drop this module into a Trickest workflow and connect it to your upstream and downstream nodes. The face contract above is the wiring.
Get a personalized demo
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.