Directories ¶ Show internal Expand all Path Synopsis agent agenttypes authsession extensions input llm parsing prompt recon source anomaly htmlutils audit claudecost stream authentication cftbrowser cli configcmd internal/clicommon tui core hosterrors network ratelimit services stats database dbimport dedup deparos casesense config discovery discovery/module discovery/module/builtin discovery/module/wildcard discovery/payload discovery/queue discovery/testutil discovery/tracker fingerprint html http internal/dedup jsscan jsscan/linkfinder reqcache responsechain scope spider spider/formparser storage tag waf wordlist diagnostics gitutil harvester http httpmsg input formats formats/burpraw formats/burpxml formats/curl formats/deparos formats/detect formats/har formats/nuclei formats/openapi formats/postman formats/urls source jsext api api/parse knownissuescan metrics modules active/angular_template_injection active/api_key_url_exposure active/api_rate_limit_bypass active/api_spec_ingest active/aspnet_blazor_exposure active/aspnet_health_exposure active/aspnet_identity_probe active/aspnet_misconfig active/aspnet_sensitive_files active/aspnet_service_exposure active/aspnet_viewstate_scan active/authz_compare active/backslash_transformation active/backup_file_discovery active/bfla_detection active/cache_deception active/client_prototype_pollution active/cloud_bucket_takeover active/cloud_origin_bypass active/cloud_public_read active/cloud_storage_listing active/cms_installer_exposure active/code_exec active/common_directory_listing active/cors_misconfiguration active/crlf_injection active/csrf_verify active/csti_detection active/default_credentials active/django_admin_exposure active/django_browsable_api_exposure active/django_debug_exposure active/django_debug_toolbar_exposure active/drupal_misconfig active/drupal_user_enum active/express_debug_probe active/express_directory_listing active/express_trust_proxy_misconfig active/fastapi_auth_inconsistency active/fastapi_docs_exposure active/fastify_hono_probe active/file_upload_scan active/firebase_auth_misconfig active/firebase_functions_exposure active/firebase_misconfig active/firebase_rtdb_exposure active/firebase_storage_exposure active/flask_werkzeug_debugger active/forbidden_bypass active/graphql_scan active/host_header_injection active/http_method_tampering active/http_request_smuggling active/idor_detection active/idor_guid active/iis_shortname_discovery active/input_behavior_probe active/insecure_deserialization active/java_appserver_console active/java_sensitive_files active/joomla_misconfig active/joomla_user_enum active/js_devserver_exposure active/jsonp_callback active/jwt_vulnerability active/laravel_admin_exposure active/laravel_devtool_exposure active/laravel_ignition_rce active/laravel_misconfig active/laravel_sensitive_files active/ldap_injection active/lfi_generic active/lfi_path_traversal active/log4shell_probe active/magento_misconfig active/mass_assignment active/mcp_batch_abuse active/mcp_completion_enum active/mcp_method_enum active/mcp_origin_rebinding active/mcp_prompt_fuzz active/mcp_resource_fuzz active/mcp_server_probe active/mcp_session_checks active/mcp_tool_fuzz active/metaframework_probe active/nextjs_chunk_audit active/nextjs_data_leakage active/nextjs_draft_mode_exposure active/nextjs_image_ssrf active/nextjs_middleware_bypass active/nextjs_version_audit active/nginx_off_by_slash active/nginx_path_escape active/nosqli_error_based active/nosqli_operator_injection active/oast_probe active/oauth_misconfiguration active/open_redirect active/path_normalization active/pdf_generation_injection active/php_composer_exposure active/php_debug_exposure active/php_framework_debug active/php_path_info_misconfig active/php_source_disclosure active/prototype_pollution active/proxy_header_trust active/proxy_pingback active/race_interference active/rails_action_mailbox_probe active/rails_active_storage_probe active/rails_admin_dashboard active/rails_info_exposure active/rails_sensitive_files active/reflected_ssti active/response_header_injection active/sensitive_file_discovery active/smart_behavior_detection active/spring_actuator_misconfig active/spring_boot_admin_exposure active/spring_cloud_config_exposure active/spring_data_rest_exposure active/spring_debug_exposure active/spring_gateway_exposure active/spring_h2_console_exposure active/spring_jolokia_exposure active/sqli_boolean_blind active/sqli_error_based active/sqli_time_blind active/ssrf_blind active/ssrf_detection active/ssti_blind active/ssti_detection active/struts_ognl_injection active/subdomain_takeover active/suspect_transform active/swagger_exposure active/symfony_misconfig active/tomcat_manager_exposure active/web_cache_poisoning active/websocket_security active/wp_ajax_exposure active/wp_misconfig active/wp_user_enum active/wp_xmlrpc active/ws_cswsh active/ws_injection active/xml_saml_security active/xss_dom_confirm active/xss_light_scanner active/xxe_generic infra infra/mcp modkit modkit/specutil modtest passive/anomaly_ranking passive/api_pagination_leak passive/api_spec_detect passive/api_version_detect passive/aspnet_fingerprint passive/aspnet_viewstate_detect passive/auth_headers_detect passive/base64_data_detect passive/build_misconfig_detect passive/cache_auth_misconfiguration passive/cache_data_leak passive/cacheable_https_detect passive/client_auth_guard passive/cloud_signed_url_leak passive/cloud_storage_error_info passive/cloud_storage_fingerprint passive/content_type_mismatch passive/cookie_security_detect passive/cors_headers_detect passive/cors_vary_origin_missing passive/crypto_weakness_detect passive/csp_weakness_audit passive/csrf_detect passive/directory_listing_detect passive/django_fingerprint passive/dom_xss_detect passive/drupal_api_detect passive/drupal_fingerprint passive/endpoint_classifier passive/env_secret_exposure passive/error_message_detect passive/express_fingerprint passive/express_session_audit passive/fastapi_fingerprint passive/firebase_fingerprint passive/flask_fingerprint passive/graphql_error_leak passive/graphql_fingerprint passive/graphql_introspection_detect passive/grpc_web_detect passive/hsts_preload_audit passive/idor_params_detect passive/info_disclosure_detect passive/input_reflection_detect passive/insecure_token_storage passive/jackson_deserialize_detect passive/java_server_fingerprint passive/javascript_uri_sink passive/joomla_api_detect passive/joomla_fingerprint passive/js_framework_fingerprint passive/jwt_claims_detect passive/jwt_weak_secret passive/laravel_fingerprint passive/mcp_description_injection passive/mcp_endpoint_detect passive/metaframework_fingerprint passive/mixed_content_detect passive/nextauth_config_audit passive/nextjs_config_audit passive/nextjs_dynamic_param_audit passive/nuxt_config_audit passive/oauth_facebook_detect passive/openredirect_params passive/password_autocomplete_detect passive/permissions_policy_detect passive/php_generic_fingerprint passive/python_debug_detect passive/rails_action_cable_detect passive/rails_active_storage_detect passive/rails_debug_detect passive/rails_fingerprint passive/referrer_policy_detect passive/remix_loader_exposure passive/secret_detect passive/security_headers_missing passive/sensitive_api_fields_detect passive/sensitive_header_leak passive/sensitive_url_params passive/serialized_object_detect passive/server_action_auth passive/server_action_bind_audit passive/server_action_input_audit passive/server_only_boundary_audit passive/software_version_header passive/sourcemap_detect passive/spring_fingerprint passive/sql_syntax_detect passive/ssr_data_exposure passive/ssr_hydration_xss passive/subresource_integrity_detect passive/symfony_fingerprint passive/unsafe_html_sink passive/verbose_error_stacktrace passive/wasm_module_detect passive/wp_fingerprint passive/wp_rest_api_detect shared/authzutil shared/diffscan shared/jsframework mutation notify discord telegram webhook oast olium auth autopilot engine provider skill stream tool toollog tui vigtool output piolium picost pistream procutil queue replay jar server spitolas internal/action internal/auth internal/browser internal/condition internal/config internal/crawler internal/form internal/fragment internal/logger internal/mab internal/metrics internal/network internal/state internal/testutil storage terminal toolexec kingfisher types severity stringslice utils work yamlext Click to show internal directories. Click to hide internal directories.