TOOL_PTK_ACTIVE_DEFAULT on ZAP

access_token/id_token in URL

Mon, 01 Jan 0001 00:00:00 +0000

Detects access tokens, JWTs, and API keys present in URLs or query strings observed in traffic.

Generated by OWASP PTK DAST Module

Admin/management path observed

Mon, 01 Jan 0001 00:00:00 +0000

Flags high-value endpoint patterns observed in traffic (admin panels, debug endpoints, consoles, and backup/config file paths).

Generated by OWASP PTK DAST Module

Android assetlinks.json observed

Mon, 01 Jan 0001 00:00:00 +0000

Flags security-relevant well-known resources and metadata files when they appear in observed traffic.

Generated by OWASP PTK DAST Module

AngularJS expression injection - expression 1.0.1 to 1.1.5

Mon, 01 Jan 0001 00:00:00 +0000

Detects AngularJS client-side template and expression injection by sending version-gated AngularJS sandbox-escape probes to query and form parameters, then requiring browser-executed proof from the PTK browser-nav harness.

Generated by OWASP PTK DAST Module

AngularJS expression injection - expression 1.2.0 to 1.2.18

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

AngularJS expression injection - expression 1.2.19 to 1.2.23

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

AngularJS expression injection - expression 1.2.24 to 1.2.26

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

AngularJS expression injection - expression 1.2.27 to 1.3.20

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

AngularJS expression injection - expression 1.2.6 to 1.2.18

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

AngularJS expression injection - expression 1.4.0 to 1.4.5

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

AngularJS expression injection - expression 1.4.2 to 1.5.8

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

AngularJS expression injection - expression 1.6 and later

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

AngularJS expression injection - single-quote expression 1.2.19 to 1.2.23

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

AngularJS expression injection - template marker expression 1.4.0 to 1.4.9

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

AngularJS template injection - alternate delimiters 1.6 and later

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

AngularJS template injection - HTML entity alternate delimiters 1.4.0 to 1.4.9

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

AngularJS template injection - HTML entity delimiters 1.4.0 to 1.4.9

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

AngularJS template injection - reflected 1.0.1 to 1.1.5

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

AngularJS template injection - reflected 1.2.0 to 1.2.1

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

AngularJS template injection - reflected 1.2.19 to 1.2.23

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

AngularJS template injection - reflected 1.2.2 to 1.2.5

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

AngularJS template injection - reflected 1.2.24 to 1.2.29

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

AngularJS template injection - reflected 1.2.6 to 1.2.18

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

AngularJS template injection - reflected 1.4.0 to 1.4.9

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

AngularJS template injection - reflected 1.5.0 to 1.5.8

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

AngularJS template injection - reflected 1.6 and later

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

AngularJS template injection - reflected marker 1.4.0 to 1.4.9

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

AngularJS template injection - reflected short legacy 1.0.1 to 1.1.5

Mon, 01 Jan 0001 00:00:00 +0000

Generated by OWASP PTK DAST Module

api_key/key in URL

Mon, 01 Jan 0001 00:00:00 +0000

Detects access tokens, JWTs, and API keys present in URLs or query strings observed in traffic.

Generated by OWASP PTK DAST Module

Apple app-site-association observed

Mon, 01 Jan 0001 00:00:00 +0000

Flags security-relevant well-known resources and metadata files when they appear in observed traffic.

Generated by OWASP PTK DAST Module

AWS Access Key ID pattern

Mon, 01 Jan 0001 00:00:00 +0000

Flags secret-like tokens and exposed configuration values in observed HTML/JS/JSON responses. These are recon leads; validate sensitivity before reporting.

Generated by OWASP PTK DAST Module

Cloud metadata IP referenced

Mon, 01 Jan 0001 00:00:00 +0000

Detects internal hostnames/IPs and environment hints (staging/dev/local) disclosed in observed responses.

Generated by OWASP PTK DAST Module

CORS allows broad headers

Mon, 01 Jan 0001 00:00:00 +0000

Adds passive CORS posture checks: missing Vary: Origin for dynamic ACAO, and permissive allowed headers/methods.

Generated by OWASP PTK DAST Module

CORS allows broad methods

Mon, 01 Jan 0001 00:00:00 +0000

Adds passive CORS posture checks: missing Vary: Origin for dynamic ACAO, and permissive allowed headers/methods.

Generated by OWASP PTK DAST Module

Debug/diagnostic path observed

Mon, 01 Jan 0001 00:00:00 +0000

Flags high-value endpoint patterns observed in traffic (admin panels, debug endpoints, consoles, and backup/config file paths).

Generated by OWASP PTK DAST Module

Dynamic ACAO without Vary: Origin

Mon, 01 Jan 0001 00:00:00 +0000

Adds passive CORS posture checks: missing Vary: Origin for dynamic ACAO, and permissive allowed headers/methods.

Generated by OWASP PTK DAST Module

Environment hints (dev/staging/test) in response

Mon, 01 Jan 0001 00:00:00 +0000

Detects internal hostnames/IPs and environment hints (staging/dev/local) disclosed in observed responses.

Generated by OWASP PTK DAST Module

Environment/config file observed

Mon, 01 Jan 0001 00:00:00 +0000

Flags high-value endpoint patterns observed in traffic (admin panels, debug endpoints, consoles, and backup/config file paths).

Generated by OWASP PTK DAST Module

File/path candidate parameter

Mon, 01 Jan 0001 00:00:00 +0000

Flags request parameters and JSON keys commonly associated with high-impact findings (open redirect, SSRF, IDOR, file/path traversal).

Generated by OWASP PTK DAST Module

Firebase config exposed

Mon, 01 Jan 0001 00:00:00 +0000

Flags secret-like tokens and exposed configuration values in observed HTML/JS/JSON responses. These are recon leads; validate sensitivity before reporting.

Generated by OWASP PTK DAST Module

GitHub token pattern

Mon, 01 Jan 0001 00:00:00 +0000

Flags secret-like tokens and exposed configuration values in observed HTML/JS/JSON responses. These are recon leads; validate sensitivity before reporting.

Generated by OWASP PTK DAST Module

Google API key pattern

Mon, 01 Jan 0001 00:00:00 +0000

Flags secret-like tokens and exposed configuration values in observed HTML/JS/JSON responses. These are recon leads; validate sensitivity before reporting.

Generated by OWASP PTK DAST Module

GraphQL path observed

Mon, 01 Jan 0001 00:00:00 +0000

Flags high-value endpoint patterns observed in traffic (admin panels, debug endpoints, consoles, and backup/config file paths).

Generated by OWASP PTK DAST Module

HTML references .map files

Mon, 01 Jan 0001 00:00:00 +0000

Detects source map references and common debug artifacts in observed HTML/JS responses. These are high-value recon leads for code disclosure and hidden endpoints.

Generated by OWASP PTK DAST Module

IDOR candidate parameter

Mon, 01 Jan 0001 00:00:00 +0000

Flags request parameters and JSON keys commonly associated with high-impact findings (open redirect, SSRF, IDOR, file/path traversal).

Generated by OWASP PTK DAST Module

Internal IP address leaked in response

Mon, 01 Jan 0001 00:00:00 +0000

Detects internal hostnames/IPs and environment hints (staging/dev/local) disclosed in observed responses.

Generated by OWASP PTK DAST Module

JavaScript includes sourceMappingURL

Mon, 01 Jan 0001 00:00:00 +0000

Detects source map references and common debug artifacts in observed HTML/JS responses. These are high-value recon leads for code disclosure and hidden endpoints.

Generated by OWASP PTK DAST Module

JSONP callback parameter controls JavaScript response

Mon, 01 Jan 0001 00:00:00 +0000

Tests callback-like parameters for JSONP-style JavaScript responses where user input controls the executed callback name.

Generated by OWASP PTK DAST Module

JWT None Algorithm (Authorization header)

Mon, 01 Jan 0001 00:00:00 +0000

This attack occurs when an attacker alters the token and changes the hashing algorithm to indicate, through the none keyword, that the integrity of the token has already been verified

Generated by OWASP PTK DAST Module

JWT None Algorithm (Cookie)

Mon, 01 Jan 0001 00:00:00 +0000

This attack occurs when an attacker alters the token and changes the hashing algorithm to indicate, through the none keyword, that the integrity of the token has already been verified

Generated by OWASP PTK DAST Module

JWT None Algorithm (Form body param)

Mon, 01 Jan 0001 00:00:00 +0000

This attack occurs when an attacker alters the token and changes the hashing algorithm to indicate, through the none keyword, that the integrity of the token has already been verified

Generated by OWASP PTK DAST Module

JWT None Algorithm (JSON body)

Mon, 01 Jan 0001 00:00:00 +0000

This attack occurs when an attacker alters the token and changes the hashing algorithm to indicate, through the none keyword, that the integrity of the token has already been verified

Generated by OWASP PTK DAST Module

JWT Probe (Authorization + JWT cookies removed)

Mon, 01 Jan 0001 00:00:00 +0000

This attack occurs when an attacker alters the token and changes the hashing algorithm to indicate, through the none keyword, that the integrity of the token has already been verified

Generated by OWASP PTK DAST Module

JWT Probe (Authorization header removed)

Mon, 01 Jan 0001 00:00:00 +0000

This attack occurs when an attacker alters the token and changes the hashing algorithm to indicate, through the none keyword, that the integrity of the token has already been verified

Generated by OWASP PTK DAST Module

JWT Probe (Form body JWT removed)

Mon, 01 Jan 0001 00:00:00 +0000

This attack occurs when an attacker alters the token and changes the hashing algorithm to indicate, through the none keyword, that the integrity of the token has already been verified

Generated by OWASP PTK DAST Module

JWT Probe (JSON body JWT removed)

Mon, 01 Jan 0001 00:00:00 +0000

This attack occurs when an attacker alters the token and changes the hashing algorithm to indicate, through the none keyword, that the integrity of the token has already been verified

Generated by OWASP PTK DAST Module

JWT Probe (JWT cookies removed)

Mon, 01 Jan 0001 00:00:00 +0000

This attack occurs when an attacker alters the token and changes the hashing algorithm to indicate, through the none keyword, that the integrity of the token has already been verified

Generated by OWASP PTK DAST Module

JWT-like value in URL

Mon, 01 Jan 0001 00:00:00 +0000

Detects access tokens, JWTs, and API keys present in URLs or query strings observed in traffic.

Generated by OWASP PTK DAST Module

localhost/127.0.0.1 referenced in response

Mon, 01 Jan 0001 00:00:00 +0000

Detects internal hostnames/IPs and environment hints (staging/dev/local) disclosed in observed responses.

Generated by OWASP PTK DAST Module

Mapbox token exposed

Mon, 01 Jan 0001 00:00:00 +0000

Flags secret-like tokens and exposed configuration values in observed HTML/JS/JSON responses. These are recon leads; validate sensitivity before reporting.

Generated by OWASP PTK DAST Module

Next.js build metadata exposed

Mon, 01 Jan 0001 00:00:00 +0000

Detects source map references and common debug artifacts in observed HTML/JS responses. These are high-value recon leads for code disclosure and hidden endpoints.

Generated by OWASP PTK DAST Module

OIDC well-known configuration observed

Mon, 01 Jan 0001 00:00:00 +0000

Flags security-relevant well-known resources and metadata files when they appear in observed traffic.

Generated by OWASP PTK DAST Module

Open redirect candidate parameter

Mon, 01 Jan 0001 00:00:00 +0000

Flags request parameters and JSON keys commonly associated with high-impact findings (open redirect, SSRF, IDOR, file/path traversal).

Generated by OWASP PTK DAST Module

Open redirect reflected in body destination

Mon, 01 Jan 0001 00:00:00 +0000

Tests for open redirect by forcing redirect-like parameters to an external, benign domain.

Generated by OWASP PTK DAST Module

Open redirect reflected in form action

Mon, 01 Jan 0001 00:00:00 +0000

Tests for open redirect by forcing redirect-like parameters to an external, benign domain.

Generated by OWASP PTK DAST Module

Open redirect via common param names

Mon, 01 Jan 0001 00:00:00 +0000

Tests for open redirect by forcing redirect-like parameters to an external, benign domain.

Generated by OWASP PTK DAST Module

phpinfo endpoint observed

Mon, 01 Jan 0001 00:00:00 +0000

Flags high-value endpoint patterns observed in traffic (admin panels, debug endpoints, consoles, and backup/config file paths).

Generated by OWASP PTK DAST Module

Potential .git exposure path observed

Mon, 01 Jan 0001 00:00:00 +0000

Flags high-value endpoint patterns observed in traffic (admin panels, debug endpoints, consoles, and backup/config file paths).

Generated by OWASP PTK DAST Module

Potential backup file observed

Mon, 01 Jan 0001 00:00:00 +0000

Flags high-value endpoint patterns observed in traffic (admin panels, debug endpoints, consoles, and backup/config file paths).

Generated by OWASP PTK DAST Module

Private key material exposed

Mon, 01 Jan 0001 00:00:00 +0000

Flags secret-like tokens and exposed configuration values in observed HTML/JS/JSON responses. These are recon leads; validate sensitivity before reporting.

Generated by OWASP PTK DAST Module

security.txt observed

Mon, 01 Jan 0001 00:00:00 +0000

Flags security-relevant well-known resources and metadata files when they appear in observed traffic.

Generated by OWASP PTK DAST Module

Sentry DSN exposed

Mon, 01 Jan 0001 00:00:00 +0000

Flags secret-like tokens and exposed configuration values in observed HTML/JS/JSON responses. These are recon leads; validate sensitivity before reporting.

Generated by OWASP PTK DAST Module

Slack token pattern

Mon, 01 Jan 0001 00:00:00 +0000

Flags secret-like tokens and exposed configuration values in observed HTML/JS/JSON responses. These are recon leads; validate sensitivity before reporting.

Generated by OWASP PTK DAST Module

SPA hash DOM XSS

Mon, 01 Jan 0001 00:00:00 +0000

Tests hash-based SPA parameters (http://host/#/route?param=…) for DOM XSS by mutating the hash in a dedicated attack tab and inspecting the DOM.

Generated by OWASP PTK DAST Module

Spring Boot actuator endpoint observed

Mon, 01 Jan 0001 00:00:00 +0000

Flags high-value endpoint patterns observed in traffic (admin panels, debug endpoints, consoles, and backup/config file paths).

Generated by OWASP PTK DAST Module

SSRF / webhook URL candidate parameter

Mon, 01 Jan 0001 00:00:00 +0000

Flags request parameters and JSON keys commonly associated with high-impact findings (open redirect, SSRF, IDOR, file/path traversal).

Generated by OWASP PTK DAST Module

Stripe publishable key exposed

Mon, 01 Jan 0001 00:00:00 +0000

Flags secret-like tokens and exposed configuration values in observed HTML/JS/JSON responses. These are recon leads; validate sensitivity before reporting.

Generated by OWASP PTK DAST Module

Swagger/OpenAPI path observed

Mon, 01 Jan 0001 00:00:00 +0000

Flags high-value endpoint patterns observed in traffic (admin panels, debug endpoints, consoles, and backup/config file paths).

Generated by OWASP PTK DAST Module

Webpack dev-server / hot reload artifacts

Mon, 01 Jan 0001 00:00:00 +0000

Detects source map references and common debug artifacts in observed HTML/JS responses. These are high-value recon leads for code disclosure and hidden endpoints.

Generated by OWASP PTK DAST Module

ws:// from HTTPS context

Mon, 01 Jan 0001 00:00:00 +0000

Looks for common WebSocket endpoints and insecure patterns such as ws:// from HTTPS pages.

Generated by OWASP PTK DAST Module