WebSec Auditor - 360° Security Inspector

Real-time 360° security auditor for HTTP headers, TLS, DNS, cookies, SRI scripts, file leaks, GraphQL, and subdomain takeovers.

WebSec Auditor is a professional 360° mobile cybersecurity auditing suite designed for developers, DevOps engineers, and security researchers to assess the security posture of public websites and API endpoints. WebSec Auditor executes 8 specialized scanning engines concurrently to evaluate web infrastructure resilience, TLS/SSL configurations, DNS email security records, and accidental credential leaks. 8 SPECIALIZED SECURITY SCANNING ENGINES 1. HTTP SECURITY HEADERS AUDIT - HSTS (Strict-Transport-Security): max-age, includeSubDomains, preload rules. - Content Security Policy (CSP): Evaluates weak directives ('unsafe-inline', 'unsafe-eval', wildcards). - Clickjacking Defense: X-Frame-Options (DENY/SAMEORIGIN) & CSP frame-ancestors. - MIME Sniffing Protection: X-Content-Type-Options (nosniff). - Referrer & Permissions Policies: Privacy and hardware feature restriction rules. - Technology Banner Leakage: Server, X-Powered-By, and X-AspNet-Version disclosures. 2. TLS / SSL CERTIFICATE INSPECTOR - Protocol Version Matrix: Tests support for TLS 1.3, TLS 1.2, and flags deprecated TLS 1.0, TLS 1.1, SSLv3. - Certificate Lifecycle: Expiration countdown, validity period, issuing CA, key length & algorithm (RSA 2048+, ECDSA). - Chain Integrity: Validates Leaf -> Intermediate -> Root CA chain and flags self-signed certs. - Cipher Suite Security: Detects weak/broken ciphers (RC4, 3DES, non-Perfect Forward Secrecy). 3. DNS & EMAIL PROTECTION RECORDS - CAA (Certificate Authority Authorization): Verifies CAA records restricting unauthorized CA issuance. - DMARC Policy (_dmarc): Evaluates policy enforcement (p=reject, quarantine, or weak p=none). - SPF Policy (v=spf1): Inspects TXT records and flags dangerous +all or ?all rules. - DNSSEC Status: Validates cryptographically signed DNS records (AD flag). - Dual-Stack IPv4 / IPv6 Check: Resolves A and AAAA records. 4. API & COOKIE SECURITY AUDITOR - Set-Cookie Security Flags: Validates Secure, HttpOnly, and SameSite (Strict/Lax/None) flags. - CORS Misconfiguration: Flags wildcard origins (*) combined with Allow-Credentials. - Insecure HTTP Verbs: Probes TRACE and OPTIONS methods (XST protection). - Rate Limiting Headers: Checks X-RateLimit-* and Retry-After headers. 5. RECON & EXPOSURE INSPECTOR - security.txt Compliance (RFC 9116): Probes /.well-known/security.txt for vulnerability contact policy. - robots.txt Route Leakage: Identifies sensitive disallowed paths (/admin, /api/v1/internal, /backup). - Web Port Probe: Probes common web/API service ports (80, 443, 8080, 8443, 3000, 8000). 6. SECRET & SENSITIVE FILE LEAKS - Probes for publicly accessible /.env files, /.git/config source code repositories, database dumps (/backup.sql), and unauthenticated Swagger UI / OpenAPI docs. 7. GRAPHQL & API SECURITY - Probes /graphql endpoints for enabled Schema Introspection and checks 404/500 error routes for verbose framework stack trace leaks. 8. SUBDOMAIN & CLOUD TAKEOVER DETECTOR - Analyzes CNAME DoH records to detect dangling CNAME aliases pointing to unclaimed cloud services (GitHub Pages, AWS S3, Heroku, Azure, Vercel). ETHICAL USE & DISCLAIMER WebSec Auditor is strictly intended for ethical security auditing, research, and evaluating systems you own or have explicit authorization to test.