Checks
Ce contenu n’est pas encore disponible dans votre langue.
proxyaudit scan runs every check below against the target in a single pass. Each check is non-destructive and read-only (a single or a few requests, no brute-forcing or state mutation), and reports zero or more findings with a stable ID, CVSS score, CWE, and OWASP API Security Top 10 mapping.
TLS / Transport Protocol version, cipher strength, certificate, HTTPS redirect, HSTS.
HTTP Security Headers CSP, frame options, content-type options, referrer/permissions policy, banner disclosure, cookies.
Client-IP & Header Trust Boundary X-Forwarded-For, X-Real-IP, True-Client-IP, X-Forwarded-Host, Host header injection, virtual-host confusion, Forwarded consistency.
Information Disclosure Verbose errors, exposed admin interfaces, directory listing, config/secrets exposure.
Severity
Section titled “Severity”Severity is derived from each check’s CVSS 4.0 score. A check with cvss_score: 0 (e.g. a missing Referrer-Policy header) is reported at informational severity — worth fixing, but not itself exploitable.
--aggressive
Section titled “--aggressive”The --aggressive flag threads through to every check via ScanContext.Aggressive, for future, more intrusive checks. v0.1 has no Agg-tier checks, so it currently has no effect.