The five suites

Sensitive paths

After the crawl, the worker requests a short wordlist the interface may never have linked.

1. 01

   Stay on the verified host

   Every probe is a GET on the host you proved. The same read-only rules apply. Paths that look like logout, delete, or checkout are not part of this list.

2. 02

   Request the forgotten paths

   The list includes admin and debug routes, environment files, actuator endpoints, git metadata, OpenAPI documents, and a few health and metrics paths.

3. 03

   Treat a content response as a hit

   A hit is a path that answered with content even though the interface never linked it. The route shows up under Routes with the wordlist as its source, and a leaky body can also raise a secret finding.

GET /debug
Identity   Anonymous probe
Status     200
Evidence   { "db": "postgres://internal:[REDACTED]@10.0.0.5:5432/shop", "jwt": "[REDACTED_JWT]" }

See the redacted example