How the scan actually works

No hand-waving. Here's exactly what runs, what it proves, and — honestly — what it doesn't.

The AI writes the report. It does not run the scan.

A common misconception: that a chatbot "generates" the results. It doesn't. 19 real tools (Python, running on the server, in parallel) do the scanning. The AI only translates their raw output into plain Hebrew/English and a copy-paste fix. Every finding is backed by an actual tool result — mapped to CVSS, CWE and OWASP — not invented by a language model.

The 19 tools — what each one really does

TLS/SSL — real socket: which protocol versions the server accepts (TLS 1.0/1.1 = fail), weak ciphers (RC4/3DES/EXPORT), Forward Secrecy, cert chain, BEAST/Sweet32/ROBOT preconditions

Security headers — CSP, HSTS (max-age + preload), X-Frame-Options, referrer policy (Mozilla Observatory-style)

HTML/DOM — inline secrets, insecure forms, missing CSRF tokens, mixed content, sensitive comments

Tech fingerprint — server, framework and library versions (feeds CVE matching)

Crawler — maps pages, forms and inputs to build the attack surface

CORS/CSP policy — wildcard origins, credentialed CORS, weak or missing CSP

DNS — SPF, DMARC, DKIM, dangling records (email spoofing + takeover surface)

Exposure — .git / .env, backup files, directory listing, exposed config

HSTS preload — eligibility for the browser preload list

Open redirect — sends payloads and checks if Location escapes to a foreign domain

WAF detection — identifies the web application firewall in front of the site

Certificate transparency — subdomains discovered from public CT logs

API spec — discovers and inspects OpenAPI/Swagger endpoints

Subdomain takeover — dangling CNAMEs pointing to unclaimed services

Port scanner — exposed services on common ports

Cookie security — Secure / HttpOnly / SameSite flags

Deep JS crawler — renders the page with Playwright to catch client-side secret leaks, CSRF and hidden API endpoints

Breach exposure — checks the domain against public data-breach corpora (has this domain appeared in a known leak?)

URL reputation — checks the domain against the abuse.ch URLhaus malware/phishing feed

Plus — in the deep / PT scan

Nuclei — thousands of known-CVE templates run against the target (deep / PT scan only)

How the score is calculated

Each tool returns a 0–100 sub-score. The overall score is a weighted average (weights sum to 100 — e.g. TLS 13%, headers 9%, HTML 9%). A tool that couldn't run is excluded from the average rather than scored as zero, so the number stays honest and stable.

The honest part: passive ≠ unbreakable

A passive scan measures your external security hygiene. It does not prove nobody can break in — you can score 100 and still be vulnerable to an injection that only shows up when you actively attack the input. Proving real resilience requires exploitation, which is a different, gated capability.

Security scan (passive)

Looks at your site from the outside

Fast, safe, runs on any URL

Answers: "what's my security hygiene?"

Penetration test (active)

Actively attacks it — with proof

Blind SQLi/SSTI oracles, OOB canary, PoC

Answers: "can I actually be breached?"

Only on domains you've proven you own

Legal & safe by design

Active testing runs only on a domain you've proven you control (DNS record — not just a checkbox). Probes are non-destructive canaries: they prove a vulnerability exists, never delete or damage anything. This is the standard every professional pentest firm follows.

Back to home