WEBSITE SECURITY TESTING
Discover the surface. Keep the evidence.
Crawl an authorized public website, inventory forms and API routes, and assess exposed controls. Add identity-based authorization scenarios and external scanner findings to the same remediation ledger.
THE LIVE EXPERIENCE
A report that explains what was tested.
Rule results, discovered surfaces and methodology gaps are reported separately. A catalog entry is never proof that a test ran. Errors and unverified baselines remain inconclusive.
Assess a public website
Lead/operator authorization and a workspace interlock are required.
https://shop.example.testAssess websiteWSTGWSTGWSTGAn authorized starting URL
Ownership is asserted before the first request, and the target is re-resolved immediately before connecting.
- DNS answers are pinnedEach resolved address is validated, then pinned into the socket lookup callback — so a second answer cannot move the connection somewhere else after the check passed.
- Every redirect is re-authorisedA public hostname that redirects to a private address is an SSRF path, not a website target, so the guard runs again on each hop rather than once at the start.
A bounded website crawl
- Run time ceiling
- 45 min
- Page ceiling
- 5,000
- HTTP request ceiling
- 12,000
The first reached limit stops discovery. The workspace request rate may reduce coverage further; incomplete work remains visible in the report.
9 observations
transport.httpsheader.hstsWSTG-CONF-07header.cspWSTG-CONF-12header.framingWSTG-CONF-14header.nosniffheader.referrerheader.permissionsheader.disclosureWSTG-INFO-08cookie.flagsWSTG-SESS-02
What it never does
- Crawl beyond the one authorised URL
- Authenticate, or submit any form
- Inject, fuzz or mutate a parameter
- Scan a port or probe the network
- Execute JavaScript from the page
Everything on this list is an intrusive technique. They stay disabled until isolated-runner controls exist — not because they are hard, but because a platform that quietly escalates from passive to active is one that gets its customer sued.
SAFETY ARCHITECTURE
Every redirect earns authorization again.
A public hostname that turns into a private address is an SSRF path, not a website target. The target guard is applied before the first request and before every redirect.
Lead/operator authorization, workspace exclusions and the kill switch are checked throughout native assessments.
Credentials, query strings, alternate ports and private, local or reserved DNS answers are rejected.
Resolved public addresses are pinned to the request socket and every redirect is revalidated.
Shared queue reservations, rate limits, cancellation and a 45-minute time ceiling. Incomplete work remains visible.
WHAT IT OBSERVES
Browser-facing controls with useful remediation.
HTTPS use, redirect outcome and bounded TLS connection details.
CSP, framing, content-type, referrer and permissions policies.
Secure, HttpOnly and SameSite attributes on returned cookies.
Links, forms, bounded same-origin scripts and API definitions, plus mixed content and password-form transport.
Plan the coverage your application needs
- Native crawling does not execute JavaScript or submit forms.
- Private JSON fixtures and two test identities enable scoped authorization checks.
- ZAP active and browser plans require an installed, isolated external runner.
- SARIF import accepts code-analysis results; it does not execute a SAST engine.
Business logic, uploads, races and exploit chains need dedicated scenarios and review. No scan guarantees that every vulnerability has been found.
EXTERNAL ENGINE INTEGRATION
Connect specialist scanners to remediation.
Prepare a scoped ZAP automation plan with optional form login, browser crawling, OpenAPI import and selected active rules. Execute it in an operator-managed testing environment and import its results. ZAP and SARIF imports retain provenance and never automatically close existing findings.