Point it at a URL — or paste a raw HTTP request — and get a severity-graded report of misconfigurations and vulnerabilities in one pass.
The Vulnerability Scanner is the flagship of the suite: a Burp-style passive analyzer fused with an opt-in active probe engine. Give it a single target and it performs dozens of checks across TLS, DNS, HTTP headers, cookies, CORS, content and parameters, then ranks every finding Critical → High → Medium → Low → Info so you know what to look at first.
It runs in two modes. Simple URL takes a normal address (custom ports like example.com:2525 included) and scans it. Raw HTTP request lets you paste a full request copied from Burp or DevTools — cookies, auth tokens and body included — so the scanner can replay it as your authenticated session and hunt for access-control and injection bugs that only appear behind login.
Active probes send benign canaries (harmless marker strings) rather than destructive payloads, and are strictly opt-in behind an authorization checkbox. Only run them against targets you own or are explicitly authorized to test.
They are sent only to the target host, never to any third-party lookup service, and are redacted from the saved report and your scan history.
Each finding maps to a calibrated Critical/High/Medium/Low/Info level based on real exploitability and impact — not vendor severity labels.