> ## Documentation Index
> Fetch the complete documentation index at: https://docs.snapsec.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Web Vulnerability Scanning (WAS)

> In-depth DAST and API security scanning covering OWASP Top 10 and business logic flaws.

Snapsec Web Application Scanner (WAS) crawls modern single-page applications (SPAs), traditional server-rendered portals, and REST/GraphQL APIs.

***

## OWASP Top 10 Coverage

* **Injection**: SQL Injection (SQLi), Cross-Site Scripting (XSS), Command Injection, XPath/LDAP Injection.
* **Broken Access Control**: Insecure Direct Object References (IDOR/BOLA), path traversal, horizontal privilege escalation.
* **Cryptographic Failures**: Insecure cookie attributes (`Missing Secure/HttpOnly/SameSite`), weak password hashes.
* **Security Misconfiguration**: Default credentials, debug error trace disclosures, unhandled exception leaks.
* **Server-Side Request Forgery (SSRF)**: Blind and full SSRF to cloud metadata endpoints (`http://169.254.169.254`).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.