v1.0

Vulnerability Modules (9)

1. Command injection
2. XSS
3. Insecure deserialization
4. IDOR
5. No-SQL injection
6. Path traversal
7. SSRF
8. SQL injection
9. XXE

Input Placements (7)

1. URL query string
2. URL path segment
3. POST form data
4. JSON body field
5. HTTP header
6. Cookie value
7. Multipart form field

Sinks (4)

1. SQLite
2. Filesystem
3. Command
4. HTTP

Configuration

• YAML-based declarative configuration
• Pre-built vulnerability templates
• Configuration validation with detailed errors/warnings
• 4 response types: JSON, HTML, Template, File

CLI

• run - Start vulnerable server
• validate - Validate config without starting
• modules - List available modules

Server

• HTTP and HTTPS support
• JSON request logging
• Graceful shutdown
• Port override via CLI