8 Security Checks

Comprehensive
Checks.

Deep dive into the 8 vulnerability checks powered by SpectreScan. Every check is precision-crafted — zero false positives.

CRITICAL×2
HIGH×3
MEDIUM×3
check_01

Missing Security Headers

"Your site is driving without a seatbelt."

MEDIUM

What it is

We check for CSP, HSTS, X-Frame-Options and other critical headers that prevent XSS, clickjacking, and protocol downgrade attacks.

How we detect it

We send an HTTP request to each live host and inspect the response headers against a checklist of required security headers.

Missing CSP alone accounts for the majority of XSS vulnerabilities in the wild.

Detection example

spectrescan probe
# Response headers we flag as missing
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'self'
Strict-Transport-Security: max-age=31536000
check_02

Exposed Sensitive Files

"Your keys are hanging outside the door."

HIGH

What it is

Finds .git, .env, and backup files left on production servers — files that contain passwords, API keys, database credentials, and source code.

How we detect it

We probe common sensitive paths on every live host using a curated wordlist of known-dangerous filenames and directories.

An exposed .env file gives an attacker your entire infrastructure — database, cloud keys, payment secrets.

Detection example

spectrescan probe
# Paths we probe on every live host
/.env
/.git/config
/backup.sql
/config.php.bak
/.DS_Store
check_03

TLS/SSL Misconfiguration

"Weak encryption is the same as no encryption."

MEDIUM

What it is

Detects weak protocol versions (SSLv3, TLS 1.0), expired certificates, self-signed certificates, and vulnerable cipher suites.

How we detect it

We perform a TLS handshake and inspect the negotiated protocol, cipher suite, certificate validity, and chain of trust.

TLS 1.0 and 1.1 are vulnerable to BEAST and POODLE attacks. Expired certificates break user trust and cause browser warnings.

Detection example

spectrescan probe
# What we flag
Protocol: TLSv1.0          ← WEAK
Cipher: RC4-MD5            ← VULNERABLE
Certificate expires: PAST  ← EXPIRED
Self-signed: true          ← UNTRUSTED
check_04

Directory Listing

"You left the filing cabinet open."

MEDIUM

What it is

Identifies open directory indexes that expose your file structure and contents to anyone who visits the URL.

How we detect it

We request directory paths and detect Apache/Nginx index page signatures in the HTML response.

Directory listing exposes backup files, configuration files, and source code that should never be public.

Detection example

spectrescan probe
# What an attacker sees
Index of /uploads/
../
backup_2024.sql    2.3MB
config_old.php     4.1KB
private_keys/      DIR
check_05

Exposed Admin Panels

"Your control room has no lock."

HIGH

What it is

Locates default admin portals and management interfaces left accessible without IP restrictions or additional authentication.

How we detect it

We probe 200+ known admin panel paths including /admin, /wp-admin, /phpmyadmin, /cpanel, and framework-specific routes.

Exposed admin panels are a direct path to full server compromise via brute force or known CVEs.

Detection example

spectrescan probe
# Admin paths we probe
/admin
/wp-admin/
/phpmyadmin/
/administrator/
/manager/html
/.well-known/admin
check_06

Subdomain Takeover

"Someone else can own your subdomain."

CRITICAL

What it is

Detects dangling CNAME records pointing to deprovisioned backends — S3 buckets, Heroku apps, GitHub Pages, Fastly edges — that an attacker can claim.

How we detect it

We resolve every subdomain CNAME chain and check if the final target is an unclaimed service using fingerprints from the can-i-take-over-xyz dataset.

An attacker who claims your dangling subdomain can serve malware, phishing pages, or steal session cookies under your brand domain.

Detection example

spectrescan probe
# Dangling CNAME example
dev.example.com
  → CNAME: myapp.herokuapp.com
  → Status: No such app      ← TAKEABLE

# Attacker claims myapp.herokuapp.com
# Now controls dev.example.com
check_07

Reflected XSS

"User input is being reflected unsanitised."

HIGH

What it is

Identifies unsanitised user input reflected in HTTP responses — a vector for session theft, credential harvesting, and malware distribution.

How we detect it

We inject safe, non-destructive XSS probe strings into URL parameters and form inputs and check if they appear unescaped in the HTML response.

Reflected XSS lets attackers steal session cookies, redirect users, and execute arbitrary JavaScript in the victim's browser.

Detection example

spectrescan probe
# Probe we send (safe, detection only)
GET /search?q=<spectrescan-probe-001>

# Vulnerable response contains:
<div>Results for: <spectrescan-probe-001></div>
                   ↑ unescaped — CONFIRMED XSS
check_08

SQL Injection

"Your database is one quote mark away from exposure."

CRITICAL

What it is

Detects error-based SQL injection vulnerabilities that expose your entire database to an attacker with a single crafted request.

How we detect it

We inject safe SQL probe strings and detect database error messages in HTTP responses — a reliable indicator of injectable parameters.

SQL injection gives an attacker full read/write access to your database — all user accounts, passwords, payment data, and private information.

Detection example

spectrescan probe
# Probe we send (safe, detection only)
GET /user?id=1'

# Vulnerable response contains:
You have an error in your SQL syntax...
near '1'' at line 1    ← CONFIRMED SQLi

Want to see it in action?

Run all 8 checks against your domain in under 5 minutes. Free.

Scan now — it's free