Quality

Tests APIs for injection vulnerabilities including SQL, NoSQL, OS command, and LDAP injection. Ideal for automated security testing and penetration testing of API endpoints.

Format String Exploitation outlines how to confirm, leak from, and write through format string bugs in authorized assessments. It covers finding the argument offset, leaking pointers or canaries, and using %n or %hn when available.

Glibc Heap Exploitation outlines methods for exploiting ptmalloc2 bugs such as use-after-free, double-free, overflow, and off-by-one in authorized testing. It covers leaks, tcache poisoning, safe-linking, and modern mitigation-aware workflows.

GraphQL Depth Limit Attack tests GraphQL endpoints with deeply nested, aliased, and repeated queries to probe for depth and complexity limits. Use it during authorized security assessments to check for denial-of-service exposure.

GraphQL Introspection Testing extracts a GraphQL API schema and checks for exposed types, queries, mutations, subscriptions, and field-level authorization issues. Use it when testing authorized endpoints for introspection, reconstruction, or query-abuse weaknesses.

Integer Overflow Exploitation helps find and confirm wraparound, truncation, underflow, and signedness bugs in native code. It is used during authorized assessments to trace tainted integers into unsafe allocations, copies, or indices.

Exploits JWT algorithm confusion vulnerabilities where the server's token verification library accepts the token's specified algorithm, allowing attackers to forge tokens and bypass authentication. Useful for authorized security testing of JWT-based APIs.

Linux Kernel Exploitation explains how to turn Linux kernel memory-corruption bugs into stable read and write primitives for authorized research. Use it when triaging crashes, confirming reachability, or assessing privilege-escalation and sandbox-escape impact.

Mass Assignment Testing checks API endpoints for mass assignment flaws where extra client-supplied fields can change privileged object properties. Use it to verify whether create, update, and nested payloads let users set roles, status, balance, or similar fields.

OAuth 2.0 Flaw Testing checks authorization code, redirect URI, PKCE, state, and token handling for security weaknesses. Use it when assessing OAuth or OpenID Connect implementations under written authorization.

Office 365 Audit Log Analysis queries Microsoft Graph Unified Audit Logs to find mailbox forwarding, delegation changes, OAuth consent grants, and other compromise indicators. Use it during incident response or threat hunting for business email compromise.

Uses Microsoft RESTler to perform stateful REST API fuzzing by automatically generating and executing test sequences.