OWASP Website Security Checks
Automated security auditing against the OWASP Top 10. Audit insecure cookies (missing Secure, HttpOnly, SameSite), server information disclosure, unsafe CORS policies, open directory listings, publicly accessible .git and backup files, dangerous HTTP methods, and vulnerable client-side JavaScript libraries.
Failed to perform OWASP security scan
Please check target domain format and try again.
Audit against the OWASP Top 10
Enter a URL above to check cookies, exposed files, CORS policy, headers and client-side libraries.
Auditing OWASP Top 10 vulnerabilities... · Scanned in 0ms · Just now
Sensitive Files, Git Repositories & Backups
Probes for exposed version control (.git), secrets (.env), database dumps (.sql), and archive backups (.zip, .tar.gz).
Cross-Origin Resource Sharing (CORS) Configuration
Evaluates origin whitelisting, arbitrary reflection, and credential leakage risks.
Dangerous HTTP Methods & Cross-Site Tracing (XST)
Checks for enabled HTTP TRACE, TRACK, PUT, and DELETE methods.
Server Information & Fingerprint Disclosure
Exposed web server and runtime version headers (OWASP A05).
Client-Side JavaScript Libraries & CVEs
Identifies outdated components (jQuery < 3.5.0 XSS, AngularJS 1.x EOL, Bootstrap < 4.3.1 XSS, Lodash, Moment.js).
Directory Listing / Autoindex Status
Probes common upload and asset folders for open directory browsing.
Suspicious & Open Redirect Testing
Tests for unvalidated parameter reflection on redirect parameters (?next=, ?url=, ?redirect=).
Slack Bot
Microsoft Teams
Discord Bot