Skip to main content
Snapsec Web Application Scanner (WAS) crawls modern single-page applications (SPAs), traditional server-rendered portals, and REST/GraphQL APIs.

​
OWASP Top 10 Coverage

  • Injection: SQL Injection (SQLi), Cross-Site Scripting (XSS), Command Injection, XPath/LDAP Injection.
  • Broken Access Control: Insecure Direct Object References (IDOR/BOLA), path traversal, horizontal privilege escalation.
  • Cryptographic Failures: Insecure cookie attributes (Missing Secure/HttpOnly/SameSite), weak password hashes.
  • Security Misconfiguration: Default credentials, debug error trace disclosures, unhandled exception leaks.
  • Server-Side Request Forgery (SSRF): Blind and full SSRF to cloud metadata endpoints (http://169.254.169.254).