Total KB References
193
Grounded Security Passages
Executable Audit Rules
105 Active
Book-Grounded Scanner Probes
Standards & CWE Catalog
104
OWASP, MITRE, NIST, ISO, RFCs
Cybersecurity Books
65
Ingested Reference Literature
Live Scan Usage
35
Real Scans Executed Live
Audit Target URL & Authenticated Scan Options
100% Non-Destructive Zero Logs Stored 193 Grounded References OWASP Top 10 & ASVS
Knowledge Base Audit Engine • 193 References & 105 Active Book-Grounded Rules Loaded Click to view dynamic KB rules →
HIGH sql-injection-surface (sqli)
OWASP-A03-INJECTION CWE-89
MEDIUM reflected-xss-surface (xss)
OWASP-A03-INJECTION CWE-79
HIGH strict-transport-security (header_required)
OWASP-SEC-HEADERS CWE-319
HIGH content-security-policy (header_required)
OWASP-SEC-HEADERS CWE-79
LOW x-content-type-options (header_required)
OWASP-SEC-HEADERS CWE-16
LOW referrer-policy (header_required)
OWASP-SEC-HEADERS CWE-200
LOW permissions-policy (header_required)
OWASP-SEC-HEADERS CWE-16
LOW cross-origin-opener-policy (header_required)
OWASP-SEC-HEADERS CWE-693
LOW cross-origin-embedder-policy (header_required)
OWASP-SEC-HEADERS CWE-693
LOW cross-origin-resource-policy (header_required)
OWASP-SEC-HEADERS CWE-693
LOW cache-control (header_required)
OWASP-SEC-HEADERS CWE-524
MEDIUM content-type (header_required)
OWASP-SEC-HEADERS CWE-436
MEDIUM x-frame-options (header_required)
OWASP-CLICKJACK CWE-1021
HIGH Secure (cookie_flag)
OWASP-SESSION CWE-614
HIGH HttpOnly (cookie_flag)
OWASP-SESSION CWE-1004
MEDIUM SameSite (cookie_flag)
OWASP-SESSION CWE-1275
MEDIUM CWE-601 (open_redirect)
CWE-601 CWE-601
MEDIUM open-redirect-next-param (code_review)
CWE-601 CWE-601
HIGH CWE-200-SENSITIVE (sensitive_paths)
CWE-200-SENSITIVE CWE-200
MEDIUM CWE-749 (http_methods)
CWE-749 CWE-749
HIGH sql-string-concat (code_review)
CWE-89 CWE-89
HIGH execute-fstring-sql (code_review)
CWE-89 CWE-89
HIGH php-query-var-concat (code_review)
CWE-89 CWE-89
HIGH js-template-literal-sql (code_review)
CWE-89 CWE-89
HIGH java-statement-execute-concat (code_review)
CWE-89 CWE-89
HIGH innerHTML-assign (code_review)
CWE-79 CWE-79
HIGH insertadjacenthtml (code_review)
CWE-79 CWE-79
MEDIUM document-write (code_review)
CWE-79 CWE-79
HIGH react-dangerouslysetinnerhtml (code_review)
CWE-79 CWE-79
HIGH vue-v-html (code_review)
CWE-79 CWE-79
MEDIUM jinja-safe-filter (code_review)
CWE-79 CWE-79
MEDIUM ejs-unescaped-output (code_review)
CWE-79 CWE-79
HIGH disabled-ssl-verification (code_review)
CWE-295 CWE-295
HIGH csrf-protection-disabled (code_review)
CWE-352 CWE-352
HIGH jwt-alg-none (code_review)
OWASP-API-2023-AUTH CWE-287
LOW insecure-authz-comment (code_review)
OWASP-API-2023-AUTH CWE-285
LOW ddos-mitigation-posture (ddos_mitigation)
ATTACK-T1498-DOS CWE-400
HIGH python-pickle-load (code_review)
CWE-502-DESERIALIZATION CWE-502
MEDIUM yaml-unsafe-load (code_review)
CWE-502-DESERIALIZATION CWE-502
HIGH php-unserialize (code_review)
CWE-502-DESERIALIZATION CWE-502
HIGH java-objectinputstream (code_review)
CWE-502-DESERIALIZATION CWE-502
HIGH node-serialize (code_review)
CWE-502-DESERIALIZATION CWE-502
HIGH known-vulnerable-dependency (dependency_scan)
OWASP-SCVS-SUPPLYCHAIN CWE-1104
HIGH python-command-shell (code_review)
CWE-78 CWE-78
HIGH php-command-exec (code_review)
CWE-78 CWE-78
HIGH node-child-process-exec (code_review)
CWE-78 CWE-78
HIGH java-runtime-exec (code_review)
CWE-78 CWE-78
HIGH python-eval-exec (code_review)
CWE-94 CWE-94
HIGH js-eval (code_review)
CWE-94 CWE-94
HIGH urlopen-user-input (code_review)
CWE-918 CWE-918
HIGH requests-user-supplied-url (code_review)
CWE-918 CWE-918
HIGH js-fetch-user-url (code_review)
CWE-918 CWE-918
HIGH php-file-get-contents-var (code_review)
CWE-918 CWE-918
MEDIUM java-openconnection-var (code_review)
CWE-918 CWE-918
MEDIUM php-upload-unvalidated (code_review)
CWE-434 CWE-434
HIGH hardcoded-password (code_review)
CWE-798 CWE-798
HIGH hardcoded-api-key (code_review)
CWE-798 CWE-798
MEDIUM default-credentials (code_review)
CWE-798 CWE-798
HIGH sql-injection (sqli)
WSTG-INPV-05-SQLI CWE-89
HIGH blind-sqli-surface (blind_sqli)
WSTG-INPV-05-SQLI CWE-89
MEDIUM reflected-xss-surface (xss)
WSTG-INPV-01-XSS CWE-79
LOW ddos-mitigation-posture (ddos_mitigation)
OWASP-DOS-CHEATSHEET CWE-400
HIGH Secure (cookie_flag)
WSTG-SESS-04-FIXATION CWE-384
HIGH HttpOnly (cookie_flag)
WSTG-SESS-04-FIXATION CWE-384
LOW brute-force-rate-limit-posture (ddos_mitigation)
OWASP-RATELIMIT-BRUTEFORCE CWE-307
MEDIUM rate-limit-backoff-posture (rate_limiting)
OWASP-RATELIMIT-BRUTEFORCE CWE-307
HIGH path-traversal-lfi-surface (path_traversal)
WSTG-INPV-07-PATHTRAV CWE-22
MEDIUM file-open-tainted-path (code_review)
WSTG-INPV-07-PATHTRAV CWE-22
HIGH php-include-tainted (code_review)
WSTG-INPV-07-PATHTRAV CWE-98
HIGH state-changing-form-csrf-token (csrf_token)
WSTG-SESS-05-CSRF CWE-352
MEDIUM rate-limit-backoff-posture (rate_limiting)
OWASP-RATELIMIT-DEEP CWE-307
MEDIUM weak-hash-credential (code_review)
CWE-327 CWE-327
HIGH weak-cipher (code_review)
CWE-327 CWE-327
MEDIUM random-secret-source (code_review)
CWE-327 CWE-330
MEDIUM log-sensitized-secret (code_review)
CWE-532 CWE-532
MEDIUM GraphQL Schema Introspection & Surface (sensitive_paths)
OWASP-API-2023-GRAPHQL CWE-200
INFO Security.txt Vulnerability Disclosure Policy (sensitive_paths)
RFC-9116-SECURITY-TXT CWE-200
INFO Webserver Metafiles & Sitemap Surface (sensitive_paths)
WSTG-INFO-03-ROBOTS CWE-200
HIGH xxe-xml-parse (code_review)
CWE-611-XXE CWE-611
HIGH prototype-pollution-pattern (code_review)
CWE-1321-PROTOTYPE-POLLUTION CWE-1321
HIGH ssti-template-string (code_review)
CWE-1336-SSTI CWE-1336
MEDIUM verbose-debug-exposure (code_review)
CWE-209-ERROR-LEAK CWE-209
MEDIUM Authentication Rate Limiting (NIST SP 800-63B) (rate_limiting)
NIST-SP-800-63B-AUTH CWE-307
HIGH Strict Transport Security Enforced (NIST SC-8) (missing_header)
NIST-SP-800-53-SC-8 CWE-319
MEDIUM Input Validation & Output Encoding (NIST SI-10) (xss)
NIST-SP-800-53-SI-10 CWE-20
MEDIUM MIME-Type Sniffing Protection (ISO 27001) (missing_header)
ISO-27001-A-8-28 CWE-693
MEDIUM Secure Cryptographic Algorithm (ISO 27001) (code_review)
ISO-27001-A-8-26 CWE-327
MEDIUM Exception Sanitization (ISO 27001) (code_review)
ISO-27001-A-8-12 CWE-209
LOW Permissions-Policy Hardware Restriction (missing_header)
W3C-PERMISSIONS-POLICY CWE-693
LOW missing-permissions-policy (missing_header)
W3C-PERMISSIONS-POLICY CWE-693
LOW Referrer-Policy URL Privacy (missing_header)
W3C-REFERRER-POLICY CWE-116
LOW missing-referrer-policy (missing_header)
W3C-REFERRER-POLICY CWE-116
LOW Cross-Origin-Opener-Policy Isolation (missing_header)
W3C-COOP-COEP CWE-346
LOW missing-coop-header (missing_header)
W3C-COOP-COEP CWE-346
MEDIUM Directory Indexing / Browsing Exposure (dirlisting)
CWE-548-DIR-INDEXING CWE-548
HIGH Cross-Domain Policy Wildcard Exposure (crossdomain_policy)
CWE-942-CROSSDOMAIN CWE-942
MEDIUM Open URL Redirection Surface (open_redirect)
CWE-601-OPEN-REDIRECT CWE-601
HIGH Hardcoded Secrets & API Keys (code_review)
CWE-798-HARDCODED-CREDENTIALS CWE-798
HIGH Dynamic Code Evaluation Surface (code_review)
CWE-94-CODE-INJECTION CWE-94
MEDIUM API Object Property Exposure (stateful_api)
OWASP-API3-2023-BOPLA CWE-213
MEDIUM API Resource Consumption Throttling (rate_limiting)
OWASP-API4-2023-UNRESTRICTED CWE-770
HIGH API SSRF Surface (open_redirect)
OWASP-API7-2023-SSRF CWE-918
HIGH OS Command Execution Surface (code_review)
CWE-77-COMMAND-INJECTION CWE-77
HIGH command-injection-shell (code_review)
CWE-77-COMMAND-INJECTION CWE-77
MEDIUM Cryptographic Algorithm Robustness (code_review)
CWE-327-BROKEN-CRYPTO CWE-327
Code Review, Dependency Scan & Security Test Generation
KB-GROUNDED

Static code review (SQLi, XSS, SSRF, insecure auth, deserialization, weak crypto...), dependency/advisory scanning (Log4Shell, prototype pollution, and other known CVEs), and generation of Burp Intruder / fuzzer / curl regression tests - all driven by the same knowledge-base rules.

Static Code Review
Dependency & Advisory Scan
Enterprise & DevOps Integrations (CI/CD Pipeline Generator, Webhooks & Scan Diff) Click to view automation templates →
GitHub Actions CI/CD Pipeline (Automated Audits)

Copy to .github/workflows/security-audit.yml to run on every commit or PR.

Slack / Discord Security Alert Webhook Payload

JSON alert template for Security Operations (SecOps) channels.

Security Audit Progress & Grounding Engine

Ready to audit. Enter a target URL above and click Run Security Audit.
0%
1 TLS & Domain Check
2 Security Probes
3 Crawl & Entry Points
4 193 References Grounding
5 Remediation Bundle
100% Safe & Authorized Audit Guarantee • Powered by 193 Security References

Guaranteed 100% safe, non-destructive, read-only probes with zero data modification or harmful payloads. Every security check, explanation, and remediation bundle is strictly grounded in 193 authoritative security standards & curated cybersecurity books (OWASP Top 10s, MITRE CWE Catalog, ASVS v4.0.3, NIST SP 800-53/160, ISO 27001:2022, PCI DSS v4.0, CIS Benchmarks, IETF RFCs).

Free Web Security Audit & Grounded Vulnerability Assessment

websec-auditor is a free, book-grounded web application security scanner and penetration testing tool engineered for developers, security engineers, and DevSecOps teams. Unlike superficial online scanners, every security finding, vulnerability explanation, and remediation patch is strictly grounded in over 193+ peer-reviewed cybersecurity books and international security standards (OWASP Top 10:2021, ASVS v4.0.3, MITRE CWE Catalog, NIST SP 800-53, ISO/IEC 27001:2022, and IETF RFCs).

🎯 DAST & Dynamic Web Probes

Detects SQL Injection (SQLi), Cross-Site Scripting (XSS), SSRF, Open Redirection, Host Header Poisoning, Path Traversal, and Cache Poisoning with non-destructive verification payloads.

📧 Email & Domain Defense

Automated DNS-over-HTTPS (DoH) evaluation of DMARC (RFC 7489) and SPF (RFC 7208) records to protect your brand from email spoofing, CEO fraud, and phishing campaigns.

💻 Client-Side DOM & SPA JS Engine

Deep static inspection of modern Single-Page Applications (React, Vue, Angular) for dangerous DOM sinks (eval, innerHTML), postMessage origin flaws, and exposed API keys.

⚡ CI/CD & SARIF Integration

Automate audits on every git push or Pull Request via GitHub Actions. Export standard OASIS SARIF reports directly into GitHub Code Scanning Alerts.

Frequently Asked Questions (FAQ)

Is this web security audit 100% free?

Yes. websec-auditor is an open-source security tool provided free of charge to empower developers and organizations worldwide to secure their web assets against cyber threats.

How does websec-auditor compare to commercial vulnerability scanners?

Unlike black-box commercial tools that produce opaque scores, websec-auditor grounds every finding in 193+ specific book passages and standards (OWASP, NIST, ISO 27001) with ready-to-use copyable remediation code, zero vendor lock-in, and full privacy (zero logs stored).

Is the scan safe to run on live production websites?

Yes. All probes are non-destructive and read-only. The engine employs DNS pinning and strict anti-SSRF protections, ensuring zero service disruption or data corruption.

Can I audit protected pages behind a login session?

Yes. Enter your session cookie (e.g. session=abc123xyz) or authorization header (e.g. Authorization: Bearer <token>) in the Authenticated Scan Options above to audit authenticated routes.