Finds the flaw. Then breaks in to prove it.
Scan
waiting for a repositoryTypeScript · illustrative replay
Argus
The code scanner of the future.
It reads your whole codebase, finds what an attacker could reach, and runs the attack in a sandbox before it tells you.
The whole reachable codebase gets read, not a sample of it.
Exact pattern checks run first, at no cost. Then one agent reads the code file by file and records every finding with a quote from the file. A second, smaller pass looks for what it missed. A file that looks safe on its own is held, not cleared, until the files that call it have been read: routes/address.ts is harmless until server.ts shows how it is mounted.
filesqueued
routes/login.ts
routes/search.ts
lib/insecurity.ts
routes/basket.ts
routes/address.ts
routes/payment.ts
server.ts
Seven of them, up close.
routes/login.tslines 30–38
module.exports = function login () {
return (req, res, next) => {
verifyPreLoginChallenges(req)
models.sequelize.query(
`SELECT * FROM Users WHERE email = '${req.body.email || ''}'
AND password = '${security.hash(req.body.password || '')}'
AND deletedAt IS NULL`,
{ model: UserModel, plain: true }
)
The email and password from the form become part of this query, unchanged.
Detectors
exact patterns, no model
waiting
Discovery
the agent reads and quotes
waiting
Recheck
a second, smaller pass
waiting
found so far
Nothing yet. Reading.
Files and line numbers from OWASP Juice Shop, an intentionally vulnerable application. The scan shown is an illustrative replay.
A weakness matters by how close it sits to the outside.
Every file is placed by how many steps separate it from something an outsider can touch. The same flaw three steps from the login form and in a script nothing calls are different risks. The map is how the report tells them apart.
a way inthe weak spotthe route an outsider can walkThree steps from the login form to a query built from its text.
Nothing reaches the report until its quote is found in the file.
Every finding names a line. Grounding opens the file and checks the quote is there. A finding that contradicts itself, sits only in a comment, or falls outside the scope is set aside, and the reason stays on the record.
#01critical
Login form text goes straight into a database query
routes/login.ts:34
#02critical
The session signing key is committed in the source
lib/insecurity.ts:5
#03high
Search text is pasted into a query unescaped
routes/search.ts:23
#04critical
Anyone can delete any saved address by id
routes/address.ts:24
#05high
Any saved card can be read by id
routes/payment.ts:38
#06high
One user can open another user's basket
routes/basket.ts:12
#07medium
Redirects to any address containing an allowed one
routes/redirect.ts:11
#08high
One user can export another user's data
routes/dataExport.ts:19
#09high
Passwords are hashed with MD5
lib/insecurity.ts:31
#10medium
The admin section is reachable from the public app
server.ts:412
#11medium
Order receipts are written to a public folder
routes/order.ts:88
#12high
Reviews can be edited by anyone who knows the id
routes/reviews.ts:17
#13medium
Coupon codes are decodable with a fixed key
lib/coupon.ts:9
#14low
The error page echoes the requested path
lib/errorHandler.ts:6
#15high
Feedback can be posted as any user
routes/feedback.ts:22
#16low
Full stack traces are returned to the browser
server.ts:640
#17medium
Upload route accepts a session token in the URL
routes/fileUpload.ts:40
#18medium
The CAPTCHA answer is checked in the browser
routes/captcha.ts:14
Every file accounted for. Reviewed, skipped, or unknown.
A register you can act on, a named reason for every file that was skipped, and each finding placed against the standards your auditors ask about. A category nobody examined is marked unknown, never clean.
your registerillustrative
criticalhighmediumlow
Login form text goes straight into a database queryroutes/login.ts:34
The session signing key is committed in the sourcelib/insecurity.ts:5
Anyone can delete any saved address by idroutes/address.ts:24
Search text is pasted into a query unescapedroutes/search.ts:23
Any saved card can be read by idroutes/payment.ts:38
One user can export another user's dataroutes/dataExport.ts:19
Passwords are hashed with MD5lib/insecurity.ts:31
Each finding quotes the exact lines, then says how to fix them.
what was reviewedillustrative
generated files in frontend/distskipped
vendored librariesskipped
binary assetskipped
Every skipped file is named, with the reason. A file nobody read never reads as clean.
against the standardsOWASP Top 10
A01Broken access controlreviewed · findings
A02Cryptographic failuresreviewed · findings
A03Injectionreviewed · findings
A04Insecure designreviewed · none found
A05Security misconfigurationreviewed · findings
A06Vulnerable componentsnot examined · unknown
A07Identification failuresreviewed · findings
A category nobody examined is marked unknown. It is never shown as green.