What problem does it solve?
It helps you identify high-impact API security misconfigurations that enable account takeover, unauthorized data access, or privilege escalation through broken auth flows and insecure endpoint behavior.
Core Features & Use Cases
- JWT attacks: Tests for alg confusion, none-alg issues, weak secrets, missing claim validation, JWK/JWK URL abuse, and kid-based weaknesses that can turn valid tokens into admin or cross-user tokens.
- GraphQL misconfiguration: Checks whether introspection and batching reveal or enable dangerous mutations, plus attempts to trigger authorization gaps and resource/recursion issues.
- CORS and rate-limit bypass testing: Detects dangerous cross-origin credential leakage and attempts common throttling bypass patterns to uncover endpoints that should be protected but aren’t.
- Mass assignment, versioning flaws, and prototype pollution: Attempts to over-post extra fields, finds weaker legacy/undocumented API versions, and probes client-side prototype pollution behaviors.
Quick Start
Ask an AI to hunt your target’s API for JWT validation weaknesses, GraphQL introspection/auth bypass, dangerous CORS settings, rate-limit bypasses, mass-assignment, versioning issues, and prototype pollution using only safe detection steps and evidence you provide.
