BoundedScan includes bounded checks for reflected HTML injection, observable CSRF controls and direct object references. These checks run only after scope validation and preserve the campaign request budget, rate limit, cancellation and exact-origin restrictions. They are enabled by web_deep_non_destructive and pentest_lab_aggressive; the lightweight web_baseline profile intentionally skips them.
They produce evidence for review rather than claiming universal exploitability. Modern applications can implement protections that are not visible to a black-box scanner, and authorization findings always require human confirmation.
The crawler preserves query strings from same-origin links. For up to 12 discovered parameters per campaign, the worker replaces one value at a time with a deterministic custom HTML element:
<boundedscan-xss-canary data-boundedscan="random-marker">random-marker</boundedscan-xss-canary>The element contains no script, event handler or external resource. A finding is created only when the exact raw element is returned in an HTML response. Encoded or text-only reflection does not match.
Rule: web.xss.reflected_html_canary
Limitations:
- only parameters discovered in same-origin URLs are tested;
- DOM-only and stored XSS are not covered;
- routes and forms that exist only after client-side JavaScript rendering may not be discovered;
- reflection is strong injection evidence but browser exploitability still requires manual review;
- no JavaScript is executed.
The worker retrieves crawled HTML pages with GET, parses forms and looks for state-changing methods without a recognizable anti-CSRF field. Common names containing csrf, xsrf, authenticity, requestverificationtoken or nonce are recognized.
Rule: web.csrf.missing_form_token
Confidence is higher when the response creates a cookie or the campaign uses an authenticated credential. The finding remains heuristic because an application may enforce a custom header, Fetch Metadata or another server-side control invisible in the HTML.
The scanner never submits the form and never sends POST, PUT, PATCH or DELETE.
The crawler identifies numeric or UUID-like references in API-style paths and common object query parameters.
Without comparison credentials, the platform creates only a low-confidence review signal:
web.idor.object_reference_candidate
With two distinct credential profiles restricted to the same host, the worker requests the exact same discovered URL once per identity. It does not increment, replace or enumerate object identifiers. If both identities receive the same non-empty representation, it creates:
web.idor.cross_identity_same_object
Evidence stores response status, size and a truncated SHA-256 digest, not the response body. Identical content can still be legitimate for shared or public resources, so manual ownership validation remains mandatory.
Create two credential profiles for test identities with different ownership and the same exact allowed_host. In Pentest controlado, select one under Credencial principal opcional and the other under Segunda identidad para IDOR.
API campaigns accept:
{
"credential_profile_id": "PRIMARY_PROFILE_UUID",
"comparison_credential_profile_id": "COMPARISON_PROFILE_UUID"
}The API rejects a comparison without a primary profile, identical profile IDs, missing profiles or profiles assigned to different hosts.
- Use only systems covered by an approved scope and explicit authorization.
- Use dedicated test accounts containing no production-sensitive data.
- Prefer staging or an isolated laboratory.
- Keep request budgets and rate limits conservative.
- Treat low-confidence findings as review queues, not confirmed vulnerabilities.
- Reproduce and confirm findings manually before remediation or disclosure.