[ 03 / 05 ]
Five suites run on every scan. They start from the calls the running interface already made, then check access, identity, sensitive data, and forgotten paths.
01
Record every XHR and fetch the running UI makes: method, query, request body, status, and response.
Static assets are dropped. Each remaining call keeps its method, path, query keys, and the shape of the JSON body so later suites replay the real request.
GraphQL calls keep the operation name in the fingerprint so two operations on one path stay distinct.
API catalog example02
Replay each captured call with no session and flag data that still comes back.
The anonymous replay uses the captured URL and body with no session cookies and no bearer token. A 200 that still returns user data is the finding.
Handlers that only exist behind a button are still in scope, because the crawl saw the browser call them.
Unguarded route example03
Replay User A's captured call as a peer account, keeping the original URL and body.
User A’s captured call is sent again as User B. When the status matches and the body is effectively the same, the route is treating identity as optional.
Object ids seen in captured URLs and JSON are available for IDOR substitution on parameterized paths.
Cross-user replay example04
Classify responses for tokens, cards, password hashes, emails, and stack traces.
Responses are classified for tokens, cloud keys, private keys, payment cards, national IDs, password hashes, emails, phone numbers, internal addresses, and stack traces.
The copy stored with the finding is redacted. The classifier runs on the response before that redaction is persisted.
Secret and PII example05
Probe forgotten paths such as /debug, /.env, /actuator, and /.git.
After capture, Routelint requests a short wordlist: admin and debug consoles, environment files, actuator endpoints, git metadata, and common API docs.
These probes are GET requests inside the verified host and the target’s scope rules.
Sensitive path exampleThe overview counts open findings by suite. A target page lists each one with severity, route, and the redacted response that triggered it.
