nord-sec 🛡️

A high-speed, full-featured web security CLI — passive scanning, SCA, secret hunting, WAF fingerprinting, subdomain takeover, WebSocket auditing, cache poisoning detection, JS deobfuscation, misconfiguration scanning, access control testing, cryptographic failure detection, injection scanning, insecure design analysis, authentication failure detection, supply chain auditing, software integrity checks, robots.txt and sitemap.xml audits, MFA bypass auditing, brute-force protection testing, password reset flow auditing, hidden admin path discovery, NPM package auditing, weak password policy detection, session hijacking risk checks, credential stuffing resistance testing, sensitive file extension scanning, GDPR data exposure check, session token rotation, concurrent session detection, backdoor scanner, supply chain trojan detection, open port detection, environment exposure check, TLS certificate validation, RAG poisoning detection, prompt injection detection, indirect prompt injection, multilingual prompt injection, live terminal progress tracking, technology fingerprinting, quick scan mode, safe mode, interactive wizard, and interactive HTML reports.

nord-sec is a lightweight, pure JavaScript security CLI built on undici and cheerio. It covers the full spectrum from safe passive header inspection to software composition analysis, secret detection, WAF fingerprinting, deep subdomain takeover enumeration, WebSocket vulnerability scanning, web cache poisoning, JavaScript deobfuscation, security misconfiguration auditing, broken access control detection, cryptographic failure scanning, multi-vector injection testing, insecure design pattern analysis, authentication failure detection (MFA bypass, brute-force protection, password reset tampering, weak password policy, session hijacking, credential stuffing resistance), admin path discovery, NPM dependency auditing, sensitive file extension scanning, GDPR data exposure check, session token rotation, concurrent session detection, backdoor scanner, supply chain trojan detection, open port detection, environment exposure check, TLS certificate validation, RAG poisoning detection, prompt injection detection, indirect prompt injection, multilingual prompt injection, supply chain auditing, software integrity checks, robots.txt and sitemap.xml audits, quick scan and safe mode profiles, interactive wizard, and live batch progress tracking — all in a single zero-install tool.

🆕 Latest Additions (Last Week)

This week’s updates expand nord-sec beyond a basic passive scanner into a more complete OWASP-focused security audit toolkit.

New authentication and abuse resistance modules

• MFA Bypass Audit — tests OTP replay, weak second-factor flows, backup code misuse, and device trust bypass patterns
• Brute-Force Protection Audit — validates rate limiting, lockout behavior, CAPTCHA enforcement, and IP blocking
• Password Reset Tampering Audit — checks reset token handling, replay issues, username enumeration, host-header abuse, and flow abuse paths
• Weak Password Policy Audit — tests registration and password-change flows with common weak credentials and policy pattern analysis
• Session Hijacking Risk Audit — reviews cookie hardening, session fixation, token leaks, logout integrity, and CSRF posture
• Credential Stuffing Resistance Audit — simulates leaked-password attacks, checks rate limiting, breached-password detection, and remember-device risk

New attack surface and exposure modules

• Hidden Admin Path Discovery — scans 170+ admin, monitoring, debug, and exposed management paths with signature verification
• Sensitive File Extension Scan — detects backup files, config files, Git metadata, logs, and archive exposures
• Robots.txt + Sitemap.xml Audits — checks crawl hygiene, exposed endpoints, and sitemap leakage risks

New UX and workflow improvements

• Live Terminal Progress Summary — real-time TUI update for active scanners, severity counts, elapsed time, and target type detection
• Pause/Resume Scan Support — gracefully saves progress with Ctrl+C and resumes using --resume
• One-Click --audit Mode — enables the full audit suite in a single command
• Interactive Wizard — first-time user setup for scan selection and report options
• AI Triage + AI Remediation — post-scan re-ranking and remediation roadmap generation when API keys are provided

New output and reporting

• HTML summary dashboards with OWASP, CWE, ASVS, CVSS, and business-impact views
• Executive PDF report for stakeholder-friendly security summaries
• Batch CSV and concurrency tuning for larger multi-target scans

New advanced security modules (added 9pm onwards)

• GDPR Data Exposure Check — scans for PII (emails, phone numbers, SSNs, credit cards, passport numbers, IP addresses), special category data (biometrics, health data, ethnic origin, political opinions, religious beliefs, sexual orientation, genetic data, trade union membership), security headers (CSP, HSTS, referrer policy, permissions policy), and privacy policy compliance
• Session Token Rotation — verifies tokens rotate across requests, checks for 8 token types (session IDs, JWT, API keys, OAuth/Access tokens, Refresh tokens, CSRF tokens, Password reset tokens, Remember me tokens), tests cookie security flags (HttpOnly, Secure, SameSite), and probes token revocation endpoints
• Concurrent Session Detection — tests session validity from different IPs and User-Agents, checks for multiple cookie handling, detects session management endpoints, verifies cookie security attributes, and checks for session timeout configuration
• Backdoor Scanner — detects 10 backdoor signature categories (PHP webshells, encoded commands, suspicious PHP functions, reverse shells, persistence mechanisms, data exfiltration, SQL injection backdoors, JavaScript backdoors, network listeners), scans 30+ suspicious paths, and probes API debug/actuator endpoints
• Supply Chain Trojan Detection — detects 65+ known compromised packages across npm, PyPI, RubyGems, Maven, and NuGet registries, performs typosquatting detection with similarity scoring, checks for malware behavior patterns (system info collection, obfuscated code, command execution, keylogging, clipboard access, crypto mining indicators), and detects dependency confusion attacks
• Open Port Detection — scans 46 common ports (FTP, SSH, Telnet, MySQL, PostgreSQL, Redis, MongoDB, RDP, VNC, Elasticsearch, Kibana, Memcached, etc.) to identify exposed services
• Environment Exposure Check — probes 16 .env file variants (.env, .env.local, .env.production, etc.) for publicly accessible environment variable files
• TLS Certificate Validation — validates certificate expiry, SAN (Subject Alternative Names), chain trust, key length (RSA <2048, ECC <256), self-signed detection, and signature algorithm (SHA-1/MD5)
• RAG Poisoning Detection — probes 30+ RAG/vector DB endpoints (/api/rag/query, /api/vector/search, /api/chat, etc.) and tests for malicious document injection
• Prompt Injection Detection — tests 20 prompt injection payloads including instruction override, context disregard, jailbreak attempts, system prompt leakage, filter bypass, and indirect injection
• Indirect Prompt Injection — detects 16 injection markers (<<INJECT>>, <<SYSTEM>>, <<ADMIN>>, etc.), 5 base64-encoded payloads, 8 Unicode homoglyph patterns (Cyrillic, Greek, Arabic, Thai, Korean, zero-width characters), and tests 10 malicious document contents
• Multilingual Prompt Injection — tests 22 payloads in 20+ languages (Chinese, Arabic, Cyrillic, Hindi, Japanese, Korean, Spanish, French, German, Portuguese, Russian, Turkish, Vietnamese, Thai, Indonesian, Dutch, Swedish, Polish) and detects 7 RTL override characters (\u202E, \u202D, \u202C, etc.)

✨ Feature Overview

| Module | Flag | Description | |---|---|---| | 🔍 Passive Security Scanner | (always on) | Evaluates core security headers (CSP, HSTS), server technology disclosures, and unsafe DOM sinks. | | 📦 Software Composition Analysis | --sca | Detects outdated and vulnerable frontend JS libraries (jQuery, React, Vue, Bootstrap, AngularJS). | | 🔑 Secret & API Key Hunter | --secrets | Scans HTML and JS bundles for exposed API keys, tokens, and credentials (AWS, Stripe, GitHub, Slack, etc.). | | 🛡️ WAF Fingerprinting | --waf | Probes targets with controlled vectors to identify Web Application Firewalls (Cloudflare, AWS WAF, Akamai, Imperva, etc.). | | 🌐 Subdomain Takeover (basic) | --subdomains | Resolves CNAME records and flags dangling DNS entries pointing to unclaimed cloud infrastructure. | | 🕳️ Deep Subdomain Takeover | --takeover | Enumerates 70+ subdomain candidates, walks full CNAME chains, checks NS/MX records, and fingerprints 16 cloud providers. | | 🔌 WebSocket Scanner | --websocket | Tests WebSocket endpoints for CSWSH and frame-level injection (SQLi, XSS, path traversal). | | 💉 Cache Poisoning Prober | --cache-poison | Injects 14 unkeyed headers to detect CDN poisoning and audits Cache-Control misconfigurations. | | 🔬 JS Deobfuscator | --ai-deobfuscate | Decodes hex/unicode-escaped JS bundles and surfaces hidden internal API routes and debug flags. | | ⚙️ Misconfiguration Scanner | --misconfig | Audits cookies, CORS policies, and defensive headers for dangerous misconfigurations. | | 🔓 Access Control Scanner | --access-control / --bac | Probes privileged endpoints, tests HTTP method tampering, and flags IDOR patterns (OWASP A01:2025). | | 🔐 Cryptographic Failures Scanner | --crypto | Audits TLS, certificate validity, key strength, HSTS, mixed content, and exposed key files (OWASP A02:2021). | | 🧪 Injection Scanner | --injection / --inject | Probes for SQLi, XSS, CMDi, SSTI, LDAP, XPath, CRLF, LFI, and DOM sinks (OWASP A05:2025). | | 🏗️ Insecure Design Scanner | --insecure-design / --design | Detects missing rate limiting, absent anti-CSRF tokens, and exposed API documentation (OWASP A04:2021). | | 🔑 Auth Failures Scanner | --auth / --auth-failures | Probes login endpoints, lockout controls, user enumeration, MFA bypass, session fixation, and JWT exposure (OWASP A07:2025). | | ⚡ Exceptional Conditions Scanner | --exceptional / --except | Tests boundary inputs, debug endpoints, malformed methods, oversized bodies, and error disclosure (OWASP A10:2025). | | 📋 Logging Failures Scanner | --logging / --log-failures | Audits for missing security event logging and alerting controls (OWASP A09:2025). | | 🔗 Supply Chain Scanner | --supply-chain / --ssc | Detects software supply chain risks in frontend dependencies (OWASP A03:2025). | | 🔏 Integrity Failures Scanner | --integrity / --a08 | Checks for missing Subresource Integrity (SRI) and unsafe deserialization patterns (OWASP A08:2025). | | 🛡️ MFA Bypass Audit | --mfa-bypass / --mfa-audit | Tests 2FA/MFA flows for OTP replay, weak codes, backup code brute-force, device trust bypass, and session fixation (OWASP A07:2025). | | 🔐 Brute-Force Protection Audit | --brute-force / --brute-force-audit | Tests login endpoints for rate limiting, account lockout, CAPTCHA challenges, IP blocking, and progressive delays (OWASP A07:2025). | | 🔄 Password Reset Tampering Audit | --password-reset / --password-reset-audit | Audits reset flows for token prediction, replay, username enumeration, host header injection, and rate limiting (OWASP A07:2025). | | 🚫 Hidden Admin Path Discovery | --admin-discovery / --admin-paths | Enumerates 170+ admin/management paths (WordPress, Django, Laravel, Grafana, Actuator, phpMyAdmin, etc.) with signature-based verification. | | 📦 NPM Package Audit | --npm-audit / --sca-npm | Runs npm audit --json locally to detect vulnerable dependencies in package.json with severity mapping and CVE/CWE extraction. | | 🔐 Weak Password Policy Audit | --weak-passwords / --password-policy | Tests registration endpoints with common weak passwords, analyzes password strength patterns, and checks for policy enforcement signals (OWASP A07:2025). | | 🕵️ Session Hijacking Risk Audit | --session-hijacking / --session-hijack | Tests cookie attributes (HttpOnly, Secure, SameSite), session fixation, token exposure in URLs, logout effectiveness, and CSRF protection (OWASP A07:2025). | | 🎯 Credential Stuffing Resistance Audit | --credential-stuffing / --credential-stuffing-audit / --cs | Simulates credential stuffing attacks with leaked credentials, tests rate limiting, breached password detection, and device trust mechanisms (OWASP A07:2025). | | 📁 Sensitive File Extension Scan | --file-extension / --file-ext | Checks for 180+ exposed backup files, config files, version control metadata, logs, source code backups, archives, and directory listings. | | 🛡️ GDPR Data Exposure Check | --gdpr / --gdpr-audit / --data-protection | Scans for PII (emails, phone numbers, SSNs, credit cards, passport numbers, IP addresses), special category data (biometrics, health data, ethnic origin, political opinions, religious beliefs, sexual orientation, genetic data, trade union membership), security headers, and privacy policy compliance. | | 🔄 Session Token Rotation | --session-token-rotation / --token-rotation / --str | Verifies tokens rotate across requests, checks for 8 token types (session IDs, JWT, API keys, OAuth/Access tokens, Refresh tokens, CSRF tokens, Password reset tokens, Remember me tokens), tests cookie security flags, and probes token revocation endpoints. | | 📟 Concurrent Session Detection | --concurrent-session / --concurrent-sessions / --csd | Tests session validity from different IPs and User-Agents, checks for multiple cookie handling, detects session management endpoints, verifies cookie security attributes, and checks for session timeout configuration. | | 🚨 Backdoor Scanner | --backdoor / --backdoor-scan / --backdoor-scanner | Detects 10 backdoor signature categories (PHP webshells, encoded commands, suspicious PHP functions, reverse shells, persistence mechanisms, data exfiltration, SQL injection backdoors, JavaScript backdoors, network listeners), scans 30+ suspicious paths, and probes API debug/actuator endpoints. | | 🦠 Supply Chain Trojan Detection | --supply-chain-trojan / --trojan / --sct | Detects 65+ known compromised packages across npm, PyPI, RubyGems, Maven, and NuGet registries, performs typosquatting detection with similarity scoring, checks for malware behavior patterns, and detects dependency confusion attacks. | | 🔓 Open Port Detection | --open-ports / --port-scan / --ports | Scans 46 common ports (FTP, SSH, Telnet, MySQL, PostgreSQL, Redis, MongoDB, RDP, VNC, Elasticsearch, Kibana, Memcached, etc.) to identify exposed services. | | 📄 Environment Exposure Check | --env-exposure / --env-file / --env-scan | Probes 16 .env file variants (.env, .env.local, .env.production, etc.) for publicly accessible environment variable files. | | 🔒 TLS Certificate Validation | --tls-cert / --tls-validation / --tls-check | Validates certificate expiry, SAN (Subject Alternative Names), chain trust, key length (RSA <2048, ECC <256), self-signed detection, and signature algorithm (SHA-1/MD5). | | 🧠 RAG Poisoning Detection | --rag-poisoning / --rag / --vector-db | Probes 30+ RAG/vector DB endpoints (/api/rag/query, /api/vector/search, /api/chat, etc.) and tests for malicious document injection. | | 🎯 Prompt Injection Detection | --prompt-injection / --pi / --prompt-inject | Tests 20 prompt injection payloads including instruction override, context disregard, jailbreak attempts, system prompt leakage, filter bypass, and indirect injection. | | 🔄 Indirect Prompt Injection | --indirect-prompt-injection / --ipi / --rag-injection | Detects 16 injection markers (<<INJECT>>, <<SYSTEM>>, <<ADMIN>>, etc.), 5 base64-encoded payloads, 8 Unicode homoglyph patterns (Cyrillic, Greek, Arabic, Thai, Korean, zero-width characters), and tests 10 malicious document contents. | | 🌐 Multilingual Prompt Injection | --multilingual-prompt-injection / --mpi / --multilingual-pi | Tests 22 payloads in 20+ languages (Chinese, Arabic, Cyrillic, Hindi, Japanese, Korean, Spanish, French, German, Portuguese, Russian, Turkish, Vietnamese, Thai, Indonesian, Dutch, Swedish, Polish) and detects 7 RTL override characters (\u202E, \u202D, \u202C, etc.). | | ⚡ Quick Scan | --quick | Essential passive security checks under 10 seconds — tech fingerprint + header analysis only. | | 🛡️ Safe Mode | --safe | Conservative scan profile — skips all active/exploitative probing while keeping passive checks. | | 🎯 Auto Target Type Detection | (always on with --tech-detect) | Automatically classifies targets as Website, API, SPA, or Auth App based on headers, HTML structure, frameworks, and URL patterns. | | Technology Fingerprinting | --tech-detect | Detects framework/CMS/plugin versions, hosting/cloud, CDN/WAF headers, auth providers, gateways/proxies, DB error strings, bundlers, SSGs, and frontend libraries. | | 🧭 Robots.txt Audit | --robots | Checks for missing robots files, crawl policy gaps, and sensitive paths disclosed in site crawl rules. | | 🗺️ Sitemap.xml Audit | --sitemap | Finds sitemap.xml and sitemap_index.xml, checks for empty/invalid XML, and flags sensitive URLs in the index. | | 📺 Live Terminal Progress Bar | (batch mode) | Shows per-URL status, findings count so far, elapsed time, and completion progress during CSV scans. | | 🕷️ Recursive Web Crawler | --crawl <depth> | Discovers internal links via BFS and scales scans across deep sub-routes. | | 🚀 Concurrency Pool | -t <threads> | High-performance async execution with configurable thread limits (max 10) for batch CSV scanning. | | 📊 HTML Reporting | (always on) | Generates comprehensive tabbed HTML reports with findings, severities, and remediation context. |

🚀 Quick Start

No installation needed — run instantly with npx:

# Single URL (minimal)
npx nord-sec -u https://example.com

# Positional shorthand
npx nord-sec https://example.com

# Full audit with every module enabled
npx nord-sec -u https://example.com \
  --sca --secrets --waf --subdomains --takeover \
  --websocket --cache-poison --ai-deobfuscate \
  --misconfig --bac --crypto --injection \
  --insecure-design --auth --exceptional \
  --logging --supply-chain --integrity \
  --mfa-bypass --brute-force --password-reset \
  --weak-passwords --session-hijacking --credential-stuffing \
  --file-extension \
  --admin-discovery --npm-audit \
  --crawl 2 -r report.html

# Quick scan (under 10 seconds)
npx nord-sec -u https://example.com --quick

# Safe mode (passive only, skips aggressive tests)
npx nord-sec -u https://example.com --safe

# One-click comprehensive audit (all scanners except aggressive active fuzzing)
npx nord-sec -u https://example.com --audit

# Batch scan from CSV
npx nord-sec --csv targets.csv -t 5 --report audit.html

🚀 Quick Scan & Safe Mode Examples

In multi-target runs, nord-sec shows a live spinner/progress display with:

• per-URL status
• number of findings collected so far
• elapsed time since scan start
• completion progress across the batch

This makes large CSV scans easier to monitor without changing the underlying scan workflow.

🚀 Live Scan Summary

When running scans (both single URL and batch), nord-sec now displays a real-time TUI-style live summary panel that updates as the scan progresses. This gives you immediate visibility into what's happening without waiting for the final report.

Features

• Live findings counter — Updates in real-time as each scanner completes, broken down by severity (Critical/High/Medium/Low/Info)
• Current scanner indicator — Shows exactly which scanner is running (e.g., "Passive Scan", "Tech Fingerprint", "WAF Fingerprint", "Injection Scanner", "AI Triage")
• Scanner progress bar — Visual progress through all enabled scanners
• Target type detection — Shows detected target type (Website/API/SPA/Auth) with confidence level
• Elapsed time — Live clock since scan start
• Batch progress — For CSV scans: URL completion progress and per-URL status
• Zero dependencies — Pure ANSI/TTY rendering, works in any terminal

Visual Example

┌─ nord-sec Live Scan Summary ─────────────────────────────┐
│ Target: 1/1  https://api.example.com
│ Type: 🔌 API (high)
│ Elapsed: 00:00:12
│ Scanner: 8/24  Injection Scanner
│ Progress: [██████████░░░░░░░░░░░░░░]  33%
│ Findings: ● 2 CRITICAL  ● 5 HIGH  ● 12 MEDIUM  ● 3 LOW  Total: 22
└────────────────────────────────────────────────────────────┘

Behavior

• Single URL scans — Full live panel with all scanner progress
• Batch CSV scans — Enhanced batch progress with live findings per URL, plus the existing spinner
• Non-TTY/CI environments — Gracefully falls back to simple console output
• Zero configuration — Enabled automatically when stdout is a TTY

# Single URL with live summary
npx nord-sec -u https://example.com --tech-detect --injection --auth

# Batch with enhanced progress
npx nord-sec --csv targets.csv -t 5 --injection --auth

⏸️ Pause & Resume Scans

Long-running batch scans can be paused and resumed at any time. Press Ctrl+C during a scan to gracefully save progress, then resume later from exactly where you left off.

How it works

• Automatic state persistence — Scan state is saved to .nord-sec-state.json every 30 seconds and after each URL completes
• Graceful pause — Press Ctrl+C (or send SIGINT/SIGTERM) to save current progress and exit cleanly
• Exact resume — Re-run with --resume to continue from the last completed URL with all findings preserved
• Custom state file — Use --state-file <path> to specify a custom state file location

Usage

# Start a long batch scan
npx nord-sec --csv targets.csv -t 5 --audit --report full-audit.html

# ... press Ctrl+C to pause ...
# [+] Scan state saved to .nord-sec-state.json
# [+] Resume with: npx nord-sec --resume

# Resume from where you left off
npx nord-sec --resume

# Resume with custom state file
npx nord-sec --resume --state-file /path/to/state.json

State File Contents

The .nord-sec-state.json file contains:

• Scan configuration (all enabled scanners, crawl depth, concurrency, etc.)
• URL queue: pending, completed, and currently scanning URLs
• All findings collected so far (with severity, details, target type)
• Current scan position and elapsed time

{
  "version": 1,
  "createdAt": "2026-01-15T10:30:00.000Z",
  "updatedAt": "2026-01-15T10:45:22.000Z",
  "config": { "enableTechDetect": true, "enableAudit": true, ... },
  "urls": {
    "pending": ["https://example.com/page3", "https://example.com/page4"],
    "completed": ["https://example.com/", "https://example.com/page1"],
    "current": null
  },
  "findings": [...],
  "currentUrlIndex": 2,
  "totalUrls": 4
}

Notes

• State file is automatically deleted on successful scan completion
• Resume requires the same target URLs (from same CSV or same single URL)
• Configuration changes between pause/resume are not supported — use the same flags
• Works with both single URL and batch CSV scans

🎯 One-Click Comprehensive Audit (--audit / --full-audit)

The --audit flag enables a complete security assessment with a single command. It activates all scanners except the most aggressive active fuzzing modes (--active, --injection), giving you maximum coverage without risking application instability.

What --audit enables:

| Category | Scanners | |---|---| | Recon & Discovery | --tech-detect, --subdomains, --takeover, --admin-discovery | | Infrastructure | --waf, --websocket, --cache-poison, --robots, --sitemap | | Code & Dependencies | --sca, --secrets, --ai-deobfuscate, --npm-audit | | OWASP A01–A10 | --misconfig, --access-control, --crypto, --insecure-design, --auth, --exceptional, --logging, --supply-chain, --integrity, --brute-force, --mfa-bypass, --password-reset, --weak-passwords, --session-hijacking, --credential-stuffing, --file-extension | | AI Enhancement | --ai-triage, --ai-remediation (if OPENROUTER_API_KEY or --ai-key provided) |

Intentionally excluded: --active, --injection, --quick, --safe (mutually exclusive or too aggressive)

# One-click comprehensive audit
npx nord-sec -u https://example.com --audit

# With AI enhancement (requires API key)
npx nord-sec -u https://example.com --audit --ai-key sk-or-...

# Batch CSV audit
npx nord-sec --csv targets.csv --audit -t 5 --report full-audit.html

📄 CSV Format

When using --csv, nord-sec reads the first column. It automatically skips empty lines and any header row named url.

url
https://example.com
https://demo.guru99.com/telecom/index.html
https://httpbin.org

🛠️ Passive Scan — Always-On Findings

Every scan runs the passive scanner automatically, checking for:

| Finding ID | Name | Severity | |---|---|---| | MISSING_CSP | Missing Content-Security-Policy | 🔴 HIGH | | MISSING_HSTS | Missing HSTS Header | 🟡 MEDIUM | | TECH_BANNER_LEAK | Server Technology Disclosure | 🔵 LOW | | UNSAFE_DOM_SINK | Unsafe DOM Sink (innerHTML, document.write) | 🟡 MEDIUM | | (mixed content) | Insecure Form Submission over HTTP | 🔴 HIGH |

Passive-only guarantee: no exploit payloads are sent in passive mode. All checks are based solely on what the server voluntarily returns.

📦 Software Composition Analysis (--sca)

Detects outdated and vulnerable frontend JavaScript libraries by inspecting script filenames and source signatures.

Detected libraries: jQuery, React, Vue.js, Bootstrap, AngularJS

npx nord-sec -u https://example.com --sca

🔑 Secret & API Key Hunter (--secrets)

Scans HTML documents and inline/external JS bundles using regex signatures to surface exposed credentials.

Detected types: AWS Access Key IDs, Stripe Secret Keys, Google API Keys, GitHub Personal Access Tokens, Slack Tokens, RSA Private Keys, Twilio API Keys, Mailgun API Keys

npx nord-sec -u https://example.com --secrets

🛡️ WAF Fingerprinting (--waf)

Probes with controlled security vectors and analyses response headers, status codes, and body signatures to identify Web Application Firewalls.

Detected WAFs: Cloudflare, AWS WAF / CloudFront, Akamai, Imperva / Incapsula, F5 BIG-IP, ModSecurity, Sucuri

npx nord-sec -u https://example.com --waf

🌐 Subdomain Takeover (--subdomains)

Resolves CNAME records and flags dangling DNS entries pointing to unclaimed cloud infrastructure.

Checked providers: AWS S3, GitHub Pages, Heroku, Azure, Shopify, Fastly, Pantheon

npx nord-sec -u https://example.com --subdomains

🕳️ Deep Subdomain Takeover Scanner (--takeover)

Goes further than --subdomains with active enumeration across four phases:

1. Subdomain Enumeration — 70-entry wordlist + live NS and MX records from the root domain
2. CNAME Chain Walking — Resolves the full chain to its terminal target for every live host
3. NXDOMAIN Detection — Flags stale DNS records an attacker could re-register
4. Cloud Provider Fingerprinting — Matches CNAMEs against 16 providers and HTTP-probes for unclaimed error pages

Extended provider coverage: All --subdomains providers, plus Netlify, Vercel, Surge.sh, WP Engine, Ghost (Pro), HubSpot, Tumblr, Zendesk, Bitbucket, Cargo Collective, Strikingly, Webflow, Squarespace, Fly.io, and Render

| Finding | Severity | |---|---| | Confirmed Subdomain Takeover | 🔴 CRITICAL | | Dangling CNAME — Unreachable Cloud Endpoint | 🟡 MEDIUM | | NXDOMAIN Subdomain (stale DNS entry) | 🔵 LOW |

--takeover is a superset of --subdomains. Running both is valid but redundant.

npx nord-sec -u https://example.com --takeover

🔌 WebSocket Vulnerability Scanner (--websocket / -w)

Probes common WebSocket endpoints and runs two test classes:

1. CSWSH — Attempts a handshake with a forged Origin: https://evil-attacker.com header
2. Frame Injection — Sends SQLi, XSS, and path traversal payloads and inspects server responses for reflected payloads, database errors, or stack traces

Probed endpoints: /, /ws, /socket.io/?EIO=4&transport=websocket

npx nord-sec -u https://example.com --websocket
npx nord-sec -u https://example.com -w

💉 Cache Poisoning Prober (--cache-poison)

Injects 14 unkeyed HTTP request headers and checks for reflection in responses. Confirms live poisoned cache entries served to real users.

Headers tested:

| Category | Headers | |---|---| | Host override | X-Forwarded-Host, X-Host, X-Forwarded-Server, X-Original-Host, Forwarded | | Scheme / port | X-Forwarded-Scheme, X-Forwarded-Proto, X-Forwarded-Port | | IP spoofing | X-Forwarded-For, X-Real-IP, True-Client-IP | | Path override | X-Original-URL, X-Rewrite-URL, X-Override-URL, X-Forwarded-Prefix |

| Finding | Severity | |---|---| | Confirmed poisoned cache entry | 🔴 CRITICAL | | Unkeyed header reflected — cacheability unconfirmed | 🔴 HIGH | | Public response missing Vary: Cookie / Authorization | 🟡 MEDIUM | | Inconsistent Pragma vs Cache-Control | 🔵 LOW | | No cache directives present | 🔵 LOW |

npx nord-sec -u https://example.com --cache-poison

🔬 JS Deobfuscator & Semantic Analyzer (--ai-deobfuscate)

Fetches and decodes the top 5 external JS bundles, then performs semantic analysis to surface hidden information.

Deobfuscation pipeline: hex escapes (\x41 → A), unicode escapes (\u0041 → A), string concatenation collapse ("/ap" + "i/v1" → "/api/v1")

Semantic checks:

• Internal Route Discovery — API and admin URL patterns embedded in frontend routers or axios configs
• Debug & Admin Flag Detection — Active boolean assignments like debug: true, testMode: true, adminOverride: true

Performs static analysis only — no code is executed. The --ai-deobfuscate name reflects the intelligence of the analysis, not a dependency on an external AI API.

npx nord-sec -u https://example.com --ai-deobfuscate

⚙️ Misconfiguration Scanner (--misconfig)

Audits three categories of security misconfiguration:

• Cookie Security — Flags missing HttpOnly, Secure, and SameSite attributes
• Permissive CORS — Detects Access-Control-Allow-Origin: * combined with Access-Control-Allow-Credentials: true
• Defensive Headers — Flags missing X-Content-Type-Options, X-Frame-Options / CSP frame-ancestors, and Referrer-Policy

npx nord-sec -u https://example.com --misconfig

🔓 Access Control Scanner (--access-control / --bac)

Aligned with OWASP A01:2025 (Broken Access Control):

• Privileged Endpoint Exposure — Probes /admin, /administrator, /server-status, /api/v1/users, /config, /actuator/env, and more for unauthenticated 200 OK responses
• HTTP Method Tampering — Tests PUT and DELETE verbs to detect authorization bypass
• IDOR Detection — Scans query parameters for sequential numeric identifiers (?user_id=102, ?id=45)

npx nord-sec -u https://example.com --bac
npx nord-sec -u https://example.com --access-control

🔐 Cryptographic Failures Scanner (--crypto)

Aligned with OWASP A02:2021 (Cryptographic Failures):

| Finding ID | Name | Severity | |---|---|---| | CRYPTO_EXPOSED_PRIVATE_KEY | Exposed Private Key or Cryptographic Secret | 🔴 CRITICAL | | CRYPTO_DEPRECATED_TLS | Deprecated TLS Protocol Version (TLS 1.0/1.1) | 🔴 HIGH | | CRYPTO_EXPIRED_CERT | Expired SSL/TLS Certificate | 🔴 HIGH | | CRYPTO_WEAK_KEY_LENGTH | Weak Public Key Length (RSA < 2048-bit) | 🔴 HIGH | | CRYPTO_UNENCRYPTED_HTTP | Unencrypted Transport Protocol (HTTP) | 🔴 HIGH | | CRYPTO_INSECURE_FORM_ACTION | Insecure Form Submission Target | 🔴 HIGH | | CRYPTO_WEAK_SIG_ALG | Weak Certificate Signature Algorithm (MD5/SHA-1) | 🟡 MEDIUM | | CRYPTO_MISSING_HSTS | Missing HTTP Strict Transport Security | 🟡 MEDIUM | | CRYPTO_MIXED_CONTENT | Insecure Mixed Content Detected | 🟡 MEDIUM | | CRYPTO_SENSITIVE_DATA_IN_URL | Sensitive Cryptographic Token in URL Parameter | 🟡 MEDIUM | | CRYPTO_WEAK_HSTS | Weak HSTS Max-Age Policy (< 182 days) | 🔵 LOW |

Probed key file paths: /.env, /server.key, /private.key, /id_rsa

npx nord-sec -u https://example.com --crypto

🧪 Injection Scanner (--injection / --inject)

Aligned with OWASP A05:2025 (Injection). Tests URL parameters, POST form fields, and inline DOM sources.

Attack classes:

| Finding ID | Name | Severity | |---|---|---| | INJECT_SQLI_ERROR | SQL Injection — Error-Based | 🔴 CRITICAL | | INJECT_SQLI_POST | SQL Injection via POST Form | 🔴 CRITICAL | | INJECT_CMD | OS Command Injection | 🔴 CRITICAL | | INJECT_SSTI | Server-Side Template Injection | 🔴 CRITICAL | | INJECT_LFI | Local File Inclusion / Path Traversal | 🔴 CRITICAL | | INJECT_RXSS | Reflected XSS — URL Parameter | 🔴 HIGH | | INJECT_RXSS_POST | Reflected XSS via POST Form | 🔴 HIGH | | INJECT_LDAP | LDAP Injection | 🔴 HIGH | | INJECT_XPATH | XML / XPath Injection | 🔴 HIGH | | INJECT_CRLF | HTTP Header Injection / CRLF Splitting | 🔴 HIGH | | INJECT_DOM_ATTR_REFLECTION | URL Parameter Reflected in Event Handler | 🔴 HIGH | | INJECT_DOM_SINK | Dangerous DOM Sink Execution Pattern | 🔴 HIGH | | INJECT_PLAINTEXT_POST | Form Data Submitted Over Plaintext HTTP | 🔴 HIGH |

Coverage per class:

• SQLi — 10 payloads covering error-based, boolean-blind, time-blind, UNION, and stacked queries; detects MySQL, PostgreSQL, SQLite, MSSQL, Oracle, ODBC errors
• XSS — 6 payloads: bare tag, attribute-break, img onerror, javascript: protocol, SVG onload
• CMDi — 7 payloads using ;, |, backtick, subshell, and && patterns; detects id, echo markers, /etc/passwd
• SSTI — 6 payloads targeting Jinja2, Twig, Freemarker, EL/SpEL, ERB, EJS, Ruby, Pebble, Thymeleaf
• LDAP — 4 payloads with wildcard bypass and filter manipulation; detects LDAPException, ldap_bind
• XPath — 5 payloads with tautologies, comment injection, XXE DOCTYPE probes; detects XPathException, libxml
• CRLF — 3 payloads; confirms via injected X-Injected-Header appearing as a real response header
• LFI — 6 payloads covering Unix/Windows traversal, URL-encoded variants, double-slash bypass, PHP wrappers
• DOM Sink Analysis — Passive inspection for event-handler reflections and dangerous sink patterns

npx nord-sec -u "https://example.com/search?q=test" --injection
npx nord-sec -u "https://example.com/search?q=test" --inject

For best results, provide a URL with query parameters. POST forms are auto-discovered regardless.

🏗️ Insecure Design Scanner (--insecure-design / --design)

Aligned with OWASP A04:2021 (Insecure Design):

| Finding ID | Name | Severity | |---|---|---| | DESIGN_MISSING_CSRF_TOKEN | Form Missing Anti-CSRF Token | 🔴 HIGH | | DESIGN_MISSING_RATE_LIMIT_HEADERS | Missing Rate Limiting Controls | 🟡 MEDIUM | | DESIGN_EXPOSED_API_DOCS | Publicly Accessible API Specifications | 🔵 LOW |

Probed API documentation paths: /swagger-ui.html, /swagger-ui/index.html, /v2/api-docs, /v3/api-docs, /openapi.json, /api/docs, /graphiql

Anti-CSRF detection checks POST, PUT, DELETE, and PATCH forms for hidden fields matching csrf, token, xsrf, or _token.

npx nord-sec -u https://example.com --insecure-design
npx nord-sec -u https://example.com --design

🔑 Authentication Failures Scanner (--auth / --auth-failures)

Aligned with OWASP A07:2025 (Authentication Failures). Probes login endpoints for lockout controls, user enumeration, MFA bypass, session fixation, and exposed JWT tokens.

npx nord-sec -u https://example.com --auth
npx nord-sec -u https://example.com --auth-failures

⚡ Exceptional Conditions Scanner (--exceptional / --except)

Aligned with OWASP A10:2025 (Mishandling of Exceptional Conditions). Tests boundary inputs, debug endpoints, malformed HTTP methods, oversized bodies, and error disclosure.

Checks include:

• Boundary value inputs (empty strings, max-length integers, null bytes)
• Debug and diagnostic endpoint exposure
• Malformed Content-Type and method handling
• Oversized request body behaviour (500 responses, stack traces)
• Deep JSON nesting (200 levels) to probe async parser limits

| Finding | Severity | |---|---| | EXCEPT_DEEP_JSON_EXCEPTION | Unhandled Exception on Deep-Nested JSON Body | 🔴 HIGH | | EXCEPT_DEEP_JSON_500 | HTTP 500 on Deep-Nested JSON Body | 🟡 MEDIUM |

npx nord-sec -u https://example.com --exceptional
npx nord-sec -u https://example.com --except

📋 Logging Failures Scanner (--logging / --log-failures)

Aligned with OWASP A09:2025 (Security Logging & Alerting Failures). Audits for the absence of security event logging signals and alerting controls that would allow attacks to go undetected.

npx nord-sec -u https://example.com --logging
npx nord-sec -u https://example.com --log-failures

🔗 Supply Chain Scanner (--supply-chain / --ssc)

Aligned with OWASP A03:2025 (Software Supply Chain Failures). Detects risky frontend dependency patterns including use of unpinned CDN scripts, unverified third-party libraries, and packages with known supply chain compromise indicators.

npx nord-sec -u https://example.com --supply-chain
npx nord-sec -u https://example.com --ssc

🔏 Integrity Failures Scanner (--integrity / --a08)

Aligned with OWASP A08:2025 (Software & Data Integrity Failures). Checks for missing Subresource Integrity (SRI) attributes on external scripts and stylesheets, and scans for unsafe deserialization patterns in inline JavaScript.

npx nord-sec -u https://example.com --integrity
npx nord-sec -u https://example.com --a08

🛡️ MFA Bypass Audit (--mfa-bypass / --mfa-audit)

Aligned with OWASP A07:2025 (Authentication Failures). Audits Multi-Factor Authentication flows for common bypass vectors that rule-based scanners often miss.

What it checks:

| Finding ID | Name | Severity | |---|---|---| | MFA_OTP_REPLAY_ALLOWED | OTP/TOTP Replay Attack Possible | 🔴 CRITICAL | | MFA_OTP_REPLAY_AFTER_FAILURE | OTP Accepted After Initial Failure | 🔴 HIGH | | MFA_WEAK_OTP_ACCEPTED | Weak/Predictable OTP Accepted | 🔴 CRITICAL | | MFA_RATE_LIMIT_ACTIVE | Rate Limiting on 2FA Endpoint | 🔵 INFO | | MFA_NO_RATE_LIMIT | No Rate Limiting on 2FA Endpoint | 🔴 HIGH | | MFA_WEAK_BACKUP_CODE | Weak Backup/Recovery Code Accepted | 🔴 CRITICAL | | MFA_BACKUP_CODE_NO_RATE_LIMIT | No Rate Limiting on Backup Code Endpoint | 🔴 HIGH | | MFA_TRUST_DEVICE_BYPASS | "Trust Device" Accessible Without MFA | 🔴 HIGH | | MFA_TRUST_COOKIE_NO_HTTPONLY | Trusted Device Cookie Missing HttpOnly | 🟡 MEDIUM | | MFA_TRUST_COOKIE_NO_SECURE | Trusted Device Cookie Missing Secure | 🟡 MEDIUM | | MFA_TRUST_COOKIE_NO_SAMESITE | Trusted Device Cookie Missing SameSite | 🔵 LOW | | MFA_SESSION_FIXATION | Session ID Not Rotated After MFA | 🔴 HIGH | | MFA_SMS_RESEND_NO_RATE_LIMIT | SMS/Email OTP Resend Not Rate Limited | 🟡 MEDIUM | | MFA_SMS_OTP_OVER_HTTP | SMS/Email OTP Endpoint Over HTTP | 🔴 HIGH |

How it works:

1. Discovers login endpoints and associated 2FA/MFA verification endpoints (TOTP, SMS, email, push, backup codes)
2. Tests OTP replay by submitting the same code twice — a valid code must be single-use
3. Fuzzes 14 common weak codes (000000, 123456, qwerty, etc.) to check for weak OTP acceptance
4. Fires 10 rapid verification attempts to detect rate limiting on 2FA endpoints
5. Tests backup/recovery code endpoints with 10 common weak codes
6. Probes "trust this device" functionality for cookie security and bypass potential
7. Verifies session ID rotation after successful MFA challenge
8. Checks SMS/email OTP resend rate limiting and HTTPS enforcement

npx nord-sec -u https://example.com --mfa-bypass
npx nord-sec -u https://example.com --mfa-audit

🔐 Brute-Force Protection Audit (--brute-force / --brute-force-audit)

Aligned with OWASP A07:2025 (Authentication Failures). Comprehensively tests login endpoints for the presence (or absence) of brute-force mitigations.

What it checks:

| Finding ID | Name | Severity | |---|---|---| | BRUTE_RATE_LIMIT_ACTIVE | Rate Limiting Detected on Login Endpoint | 🔵 INFO | | BRUTE_NO_RATE_LIMIT | No Rate Limiting on Login Endpoint | 🔴 HIGH | | BRUTE_ACCOUNT_LOCKOUT_ACTIVE | Account Lockout / Brute-Force Protection Active | 🔵 INFO | | BRUTE_NO_ACCOUNT_LOCKOUT | No Account Lockout After Repeated Failed Logins | 🔴 HIGH | | BRUTE_CAPTCHA_CHALLENGE | CAPTCHA / Challenge Detected After Failed Attempts | 🔵 INFO | | BRUTE_NO_CAPTCHA | No CAPTCHA / Challenge After Repeated Failed Logins | 🟡 MEDIUM | | BRUTE_PROGRESSIVE_DELAY | Progressive Delay / Exponential Backoff Detected | 🔵 INFO | | BRUTE_NO_PROGRESSIVE_DELAY | No Progressive Delay / Exponential Backoff | 🔵 LOW | | BRUTE_IP_BLOCKING_ACTIVE | IP-Based Blocking / WAF Protection Detected | 🔵 INFO | | BRUTE_NO_IP_BLOCKING | No IP-Based Rate Limiting / Blocking Detected | 🟡 MEDIUM | | BRUTE_CAPTCHA_ON_LOGIN_PAGE | CAPTCHA Present on Login Page | 🔵 INFO | | BRUTE_REMEMBER_ME_DETECTED | "Remember Me" Functionality Detected | 🔵 LOW | | BRUTE_LOGIN_NO_CSRF | Login Form Missing CSRF Token | 🟡 MEDIUM | | BRUTE_USERNAME_ENUMERATION | Username Enumeration via Differential Responses | 🟡 MEDIUM |

How it works:

1. Discovers login endpoints via common path probing and form detection
2. Fires 8 rapid requests to detect HTTP 429 / rate-limit headers (Retry-After, X-RateLimit-*)
3. Attempts 10 consecutive failed logins with a known username to trigger account lockout (checks for 423/429 or lockout messages)
4. Attempts 8 failed logins to detect CAPTCHA challenges in responses and headers
5. Measures response times across 6 sequential failures to detect progressive delay (2x slowdown threshold)
6. Simulates 10 distinct client IPs via X-Forwarded-For to test IP-based blocking
7. Parses login page for CAPTCHA elements, "remember me" checkboxes, and CSRF tokens
8. Compares responses for valid vs. bogus usernames to detect enumeration via status/body/timing differences

npx nord-sec -u https://example.com --brute-force
npx nord-sec -u https://example.com --brute-force-audit

🔄 Password Reset Flow Tampering Audit (--password-reset / --password-reset-audit)

Aligned with OWASP A07:2025 (Authentication Failures). Audits password reset functionality for tampering vulnerabilities that could allow account takeover.

What it checks:

| Finding ID | Name | Severity | |---|---|---| | RESET_USER_ENUMERATION | Username Enumeration via Password Reset Flow | 🟡 MEDIUM | | RESET_TOKEN_PREDICTABLE | Predictable Reset Token Accepted | 🔴 CRITICAL | | RESET_TOKEN_REPLAY_ALLOWED | Reset Token Replay Accepted | 🔴 CRITICAL | | RESET_TOKEN_REPLAY_AFTER_FAILURE | Reset Token Accepted After Initial Failure | 🔴 HIGH | | RESET_HOST_HEADER_REFLECTED | Reset Flow Reflects Host Header | 🔵 LOW | | RESET_RATE_LIMIT_ACTIVE | Rate Limiting Active on Password Reset Endpoint | 🔵 INFO | | RESET_NO_RATE_LIMIT | No Rate Limiting on Password Reset Endpoint | 🔴 HIGH |

How it works:

1. Discovers password reset endpoints via 30+ common paths (/forgot-password, /api/auth/reset, etc.)
2. Compares responses for existing vs. non-existent users to detect enumeration (status code, body length, timing)
3. Tests 10 common weak tokens (123456, password, admin, etc.) against the reset endpoint
4. Submits the same token twice to test replay protection
5. Probes Host header injection by sending a malicious Host header and checking for reflection
6. Fires 10 rapid reset requests to verify rate limiting

npx nord-sec -u https://example.com --password-reset
npx nord-sec -u https://example.com --password-reset-audit

🔐 Weak Password Policy Audit (--weak-passwords / --password-policy)

Aligned with OWASP A07:2025 (Authentication Failures). Tests registration and password change endpoints for weak password acceptance and policy enforcement.

What it checks:

| Finding ID | Name | Severity | |---|---|---| | WEAK_PASSWORD_ACCEPTED | Weak Password Accepted During Registration | 🔴 CRITICAL | | COMMON_PASSWORD_ACCEPTED | Common Password (Top 1000) Accepted | 🔴 HIGH | | WEAK_PATTERN_ACCEPTED | Weak Pattern Password Accepted | 🟡 MEDIUM | | NO_PASSWORD_POLICY_SIGNALS | No Client-Side Password Policy Enforcement Signals | 🔵 LOW | | NO_STRENGTH_METER | No Password Strength Meter Detected | 🔵 LOW | | NO_COMPLEXITY_REQUIREMENTS | No Complexity Requirements Indicated | 🔵 LOW | | NO_BREACHED_PASSWORD_CHECK | No Breached Password Check (PwnedPasswords) Detected | 🟡 MEDIUM |

How it works:

1. Discovers registration endpoints via 15+ common paths (/register, /signup, /api/auth/register, etc.)
2. Attempts registration with 10 common weak passwords (123456, password, admin, letmein, etc.)
3. Attempts registration with 10 pattern-based weak passwords (Password1, Welcome123, Admin123, etc.)
4. Checks for client-side policy signals: strength meters, complexity hints, breached password API calls
5. Reports any endpoint accepting weak credentials

npx nord-sec -u https://example.com --weak-passwords
npx nord-sec -u https://example.com --password-policy

🕵️ Session Hijacking Risk Audit (--session-hijacking / --session-hijack)

Aligned with OWASP A07:2025 (Authentication Failures). Audits session management for cookie security, fixation, token exposure, and logout effectiveness.

What it checks:

| Finding ID | Name | Severity | |---|---|---| | SESSION_COOKIE_MISSING_HTTPONLY | Session Cookie Missing HttpOnly Flag | 🔴 HIGH | | SESSION_COOKIE_MISSING_SECURE | Session Cookie Missing Secure Flag | 🔴 HIGH | | SESSION_COOKIE_MISSING_SAMESITE | Session Cookie Missing SameSite Attribute | 🟡 MEDIUM | | SESSION_COOKIE_SAMESITE_NONE | Session Cookie Has SameSite=None | 🔴 HIGH | | SESSION_COOKIE_WEAK_SAMESITE | Session Cookie Has SameSite=Lax | 🔵 LOW | | SESSION_FIXATION_VULNERABLE | Session Fixation — ID Not Rotated After Login | 🔴 CRITICAL | | SESSION_TOKEN_IN_URL | Session Token Exposed in URL | 🔴 CRITICAL | | LOGOUT_INEFFECTIVE | Logout Does Not Invalidate Server-Side Session | 🔴 HIGH | | CSRF_PROTECTION_MISSING | CSRF Protection Missing on State-Changing Forms | 🟡 MEDIUM | | SUBDOMAIN_COOKIE_LEAKAGE | Session Cookie Scoped to Parent Domain | 🟡 MEDIUM |

How it works:

1. Discovers login endpoints and captures Set-Cookie headers
2. Analyzes cookie attributes (HttpOnly, Secure, SameSite)
3. Tests session fixation by comparing session ID before/after login
4. Checks for token exposure in URLs (query params, fragment, path)
5. Verifies logout invalidates server-side session
6. Scans state-changing forms for CSRF tokens
7. Checks for overly permissive cookie domain scopes

npx nord-sec -u https://example.com --session-hijacking
npx nord-sec -u https://example.com --session-hijack

🎯 Credential Stuffing Resistance Audit (--credential-stuffing / --credential-stuffing-audit / --cs)

Aligned with OWASP A07:2025 (Authentication Failures). Simulates credential stuffing attacks using known leaked credential pairs and tests defensive controls.

What it checks:

| Finding ID | Name | Severity | |---|---|---| | CS_CREDENTIAL_STUFFING_SUCCESS | Credential Stuffing Attack Successful | 🔴 CRITICAL | | CS_CREDENTIAL_STUFFING_RESISTED | Credential Stuffing Resistance Detected | 🔵 INFO | | CS_NO_RATE_LIMITING | No Rate Limiting Against Credential Stuffing | 🔴 HIGH | | CS_RATE_LIMITING_ACTIVE | Rate Limiting Active Against Credential Stuffing | 🔵 INFO | | CS_BREACHED_PASSWORD_CHECK_MISSING | Breached Password Check Missing | 🟡 MEDIUM | | CS_BREACHED_PASSWORD_DETECTION | Breached Password Detection Active | 🔵 INFO | | CS_NO_CREDENTIAL_REUSE_DETECTION | No Client-Side Credential Reuse Detection | 🔵 LOW | | CS_CREDENTIAL_REUSE_DETECTION | Client-Side Credential Reuse Detection Detected | 🔵 INFO | | CS_REMEMBER_ME_FUNCTIONALITY | "Remember Me" Functionality Detected | 🔵 INFO | | CS_SECURITY_HEADERS_MISSING | Security Headers Missing | 🔵 LOW |

How it works:

1. Discovers login endpoints via 25+ common paths
2. Tests 8 common usernames × 30 leaked passwords = 240 credential pairs
3. Fires 20 rapid attempts per endpoint to test rate limiting
4. Checks for breached password detection (bcrypt, scrypt, PwnedPasswords API)
5. Analyzes "remember me" cookie security implications
6. Verifies security headers (CSP, HSTS, X-Frame-Options, etc.)

npx nord-sec -u https://example.com --credential-stuffing
npx nord-sec -u https://example.com --credential-stuffing-audit
npx nord-sec -u https://example.com --cs

📁 Sensitive File Extension Scan (--file-extension / --file-ext)

Checks for 180+ exposed sensitive files including backups, configuration, version control metadata, logs, source code, and archives.

File categories checked:

| Category | Examples | Severity | |---|---|---| | Backup Archives | backup.zip, backup.tar.gz, backup.sql, database.sql, www.zip | 🔴 HIGH / 🟡 MEDIUM | | Config Files | .env, .env.local, .env.production, config.php, wp-config.php, docker-compose.yml | 🔴 HIGH / 🟡 MEDIUM | | Version Control | .git/, .git/config, .git/HEAD, .svn/, .hg/ | 🔴 HIGH | | Log Files | error.log, access.log, debug.log, laravel.log, mysql.log | 🟡 MEDIUM | | Source Code Backups | index.php.bak, index.php.old, index.php.swp, index.html.bak | 🔴 HIGH / 🟡 MEDIUM | | Archives | files.zip, uploads.zip, secret.zip, passwords.zip, credentials.zip | 🔴 HIGH / 🔴 CRITICAL | | Dependency Files | package.json, composer.json, requirements.txt, Gemfile, pom.xml | 🟡 MEDIUM | | Build Configs | webpack.config.js, vite.config.js, next.config.js, tsconfig.json | 🔵 LOW | | Directory Listings | /backup/, /wp-content/uploads/, /.git/, /.DS_Store | 🟡 MEDIUM |

How it works:

1. Performs HEAD requests for 180+ known sensitive file paths (batched, 10 concurrent)
2. Falls back to GET for 405/5xx responses
3. Treats 401/403 as potential exposure (file exists but access restricted)
4. Checks directory listings for Index of pages
5. De-duplicates findings by URL

npx nord-sec -u https://example.com --file-extension
npx nord-sec -u https://example.com --file-ext

🚫 Hidden Admin Path Discovery (--admin-discovery / --admin-paths)

Discovers hidden administrative interfaces, management consoles, monitoring dashboards, and sensitive endpoints across 170+ common paths with signature-based verification to minimize false positives.

Covered categories:

| Category | Examples | |---|---| | CMS Admin | /wp-admin, /administrator, /umbraco, /typo3, /concrete5 | | E-commerce | /shop/admin, /magento/admin, /prestashop/admin, /opencart/admin | | Frameworks | /rails/admin, /django-admin, /admincp, /modcp | | Monitoring | /grafana, /kibana, /prometheus, /metrics, /actuator/* | | Database | /phpmyadmin, /adminer, /pma, /mysql | | API Docs | /swagger, /swagger-ui, /v3/api-docs, /graphiql, /graphql | | Debug | /debug, /_profiler, /__debugbar, /telescope, /horizon | | Config/Secrets | /.env, /.env.local, /config, /settings.php | | VCS/Backup | /.git, /.svn, /backup, /dumps | | Cloud/Container | /.well-known/security.txt, /healthz, /readyz |

Verification logic: Each discovered path is verified against 13 signature patterns (admin titles, login forms, framework keywords) to confirm it's a genuine admin/management interface rather than a generic 404 page.

Severity tiers:

• 🔴 CRITICAL — Exposed sensitive files (.env, .git/config, wp-config.php)
• 🔴 HIGH — Exposed monitoring (Grafana, Kibana, Prometheus), phpMyAdmin, Actuator endpoints
• 🟡 MEDIUM — Custom admin panels, API documentation, debug endpoints
• 🔵 LOW — Generic accessible paths without clear admin signatures
• 🔵 INFO — Protected paths returning 401/403 (confirms existence without access)

npx nord-sec -u https://example.com --admin-discovery
npx nord-sec -u https://example.com --admin-paths

npx nord-sec -u https://example.com --admin-discovery
npx nord-sec -u https://example.com --admin-paths

🎯 Auto Target Type Detection

When --tech-detect is enabled (or --audit which implies it), nord-sec automatically classifies each target into one of four types:

| Type | Emoji | Description | Key Signals | |---|---|---|---| | Website | 🌐 | Traditional server-rendered site | CMS, server frameworks, navigation links, forms, SEO meta, server HTML | | API | 🔌 | REST/GraphQL backend | JSON responses, application/json headers, /api/, /graphql, /v1/ paths, no HTML body, CORS headers | | SPA | ⚡ | Single Page Application | React/Vue/Angular/Next.js/Nuxt/Svelte, client-side routing, root div (#root, #app), hydration signals, build tools (Vite, Webpack), PWA manifest, service worker | | Auth App | 🔐 | Authentication-focused | Login forms, password inputs, auth libraries (Auth0, Okta, NextAuth, Clerk), SSO/OAuth/SAML, 2FA/MFA signals, session/JWT cookies, CSRF tokens |

How it works

The classifier analyses multiple signal categories simultaneously:

1. API signals — Content-Type headers, URL paths (/api/, /graphql, /v1/), JSON responses, CORS headers, absence of HTML forms
2. SPA signals — Frontend frameworks (React, Vue, Angular, Svelte, Next.js, Nuxt, Svelte), build tools (Vite, Webpack, Rollup), client-side routing, hydration markers (__NEXT_DATA__, __NUXT__), root divs, service workers, PWA manifest
3. Auth signals — Login forms, password fields, auth providers (Auth0, Okta, NextAuth, Clerk, Keycloak), SSO/OAuth/SAML paths, 2FA/MFA signals, session cookies, JWT tokens, CSRF tokens
4. Website signals — CMS detection, server frameworks, navigation links, SEO meta tags, server-rendered HTML, content volume, internal links

Confidence levels

• High — 4+ strong signals in one category, or explicit URL patterns (/api/, /login)
• Medium — 2-3 supporting signals
• Low — 1-2 weak signals, defaults to Website

Output

└─ Target type: 🔌 API (confidence: high)
└─ Target type: ⚡ SPA (confidence: high)
└─ Target type: 🔐 AUTH (confidence: high)
└─ Target type: 🌐 WEBSITE (confidence: medium)

Usage

# Auto-detect with tech fingerprinting
npx nord-sec -u https://api.example.com --tech-detect

# Included in full audit
npx nord-sec -u https://example.com --audit

# Batch scan with target types
npx nord-sec --csv targets.csv --tech-detect -t 5

The target type is stored in the HTML report and can be used to tailor remediation advice (e.g., API-focused findings for API targets, CSP/frame protection for SPA targets, session/token hardening for auth targets).

📦 NPM Package Audit (--npm-audit / --sca-npm)

Runs npm audit --json locally against the project's package.json and package-lock.json, mapping the output to nord-sec's finding format with severity remapping and CVE/CWE enrichment.

What it reports:

| Finding ID | Name | Severity | |---|---|---| | NPM_AUDIT_<vulnId> | Vulnerable NPM Dependency: <package> | Mapped from npm severity | | NPM_AUDIT_SUMMARY | NPM Audit Summary | Based on highest severity found |

What it extracts:

• Package name and vulnerable version
• Vulnerability ID and title
• CVE identifiers (when available)
• CWE classification (when available)
• Advisory URL
• Total counts by severity (critical/high/moderate/low)
• Total dependencies scanned

Notes:

• Runs entirely locally — no external API calls
• Requires package.json and npm in PATH
• Severity mapping: critical→CRITICAL, high→HIGH, moderate→MEDIUM, low→LOW, info→INFO
• Non-fatal — if npm audit fails, the scan continues with a warning

npx nord-sec --npm-audit
npx nord-sec --sca-npm

⚡ Quick Scan (--quick)

A minimal, ultra-fast security assessment that completes in under 10 seconds by running only essential passive checks.

What it runs:

• Passive security header analysis (CSP, HSTS, server banners, unsafe DOM sinks)
• Technology fingerprint detection (framework, CMS, hosting, CDN, auth, etc.)

What it skips:

• All active fuzzing, injection probing, and exploit payloads
• Subdomain takeover, WAF fingerprinting, secret hunting
• SCA, JS deobfuscation, WebSocket scanning
• Cache poisoning, cache misconfiguration, access control probing
• All OWASP-specific scanners (crypto, injection, insecure design, auth, etc.)
• AI Triage and AI Remediation
• PDF report generation (HTML report only)

Output: Standard report.html with only Quick Scan findings.

# Single URL quick scan (~5-8 seconds)
npx nord-sec -u https://example.com --quick

# Batch CSV quick scan
npx nord-sec --csv targets.csv --quick

# Compare with full scan (much longer)
npx nord-sec -u https://example.com  # Takes minutes

🛡️ Safe Mode (--safe)

A conservative scan profile that runs all passive checks but skips all active/exploitative probing to avoid triggering WAFs, account lockouts, rate limits, or application instability.

What it skips:

• Active fuzzing (--active) — SQLi, XSS, CMDi, SSTI, LFI, LDAP, XPath, CRLF, path traversal
• All injection payloads and exploit vectors
• Any test that sends malicious-looking requests

What it still runs:

• Passive security header analysis
• Technology fingerprinting
• Cookie/CORS/misconfiguration audits
• SSL/TLS certificate checks
• Robots.txt and sitemap.xml audits
• All other passive modules

# Safe mode — only passive checks
npx nord-sec -u https://example.com --safe

# Combined with other safe flags
npx nord-sec -u https://example.com --safe --admin-discovery --npm-audit

# Normal (aggressive) mode
npx nord-sec -u https://example.com  # Includes active fuzzing

Reviews the root robots.txt policy for crawl hygiene and operational exposure.

Checks include:

• missing or empty robots.txt
• no-disallow policy indicators
• sensitive paths inadvertently exposed in crawl directives
• sitemap references embedded in the file

npx nord-sec -u https://example.com --robots

🗺️ Sitemap.xml Audit (--sitemap)

Looks for sitemap discovery points and validates the index for accidental exposure or incomplete coverage.

Checks include:

• missing sitemap.xml or sitemap_index.xml
• empty or malformed XML
• potentially sensitive URLs in the sitemap index
• sitemap discovery and content validation for crawl hygiene

npx nord-sec -u https://example.com --sitemap

🕸️ Web Crawler (--crawl <depth>)

Enables a Breadth-First Search crawler for same-origin link discovery.

| Depth | Behaviour | |---|---| | 0 (default) | Scans only the provided URL | | 1 | Scans the target URL and all same-origin links found on it | | 2+ | Recursively crawls up to the specified depth |

• Same-origin scoped — only follows links on the same host
• De-duplicated — strips fragment anchors, skips visited URLs
• Structured reporting — each crawled path gets its own tab in the HTML report

npx nord-sec -u https://example.com --crawl 2
npx nord-sec --csv targets.csv --crawl 1 --report audit.html

🤖 AI Severity Re-Ranker (--ai-triage)

Aligned with real-world attacker thinking, the AI Triage module sends all scanner findings to a large language model via OpenRouter and re-evaluates severity based on cross-finding exploitability — something rule-based scanners fundamentally cannot do.

A CORS misconfiguration and an exposed JWT in isolation might each score MEDIUM. An attacker who chains them — forging a cross-origin request using the leaked token to hit an authenticated API endpoint — has a CRITICAL exploit. AI Triage catches that. It also works in reverse, de-escalating findings that look alarming on paper but are neutralised by compensating controls detected elsewhere in the scan.

What it produces:

• AI Risk Score (0–100) — an overall exploitability score for the target, separate from the rule-based finding counts, weighted by how chainable the findings are
• Exploit Chains — named attack paths that describe exactly how two or more findings combine into a real attack scenario, with the involved finding IDs listed
• Per-finding re-triage — every finding gets an AI-assigned severity alongside the original scanner severity, with a one-sentence reason for any change
• Escalations & de-escalations — printed to the terminal in colour so you can see at a glance what the AI upgraded or downgraded and why

How it handles large scans:

Findings are automatically batched into groups of 30 before being sent to the model. A scan with 104 findings becomes 4 API calls that are merged into one unified result — so token limits never cause a silent failure. If a single batch fails (API error or malformed model output), that batch passes findings through unchanged and the rest of the scan completes normally.

# Minimum — set key in environment, use default model
export OPENROUTER_API_KEY=sk-or-...
npx nord-sec -u https://example.com --misconfig --secrets --crypto --ai-triage

# Pass key inline and choose a specific model
npx nord-sec -u https://example.com --injection --bac --crypto --ai-triage \
  --ai-key sk-or-... \
  --ai-model google/gemini-2.0-flash-001

# Batch scan with AI triage across all targets
npx nord-sec --csv targets.csv -t 3 --misconfig --crypto --ai-triage --ai-key sk-or-...

Default model: nvidia/nemotron-3-ultra-550b-a55b:free (no cost, no OpenRouter credits required)

Any model available on OpenRouter can be substituted via --ai-model. Paid models such as anthropic/claude-sonnet-4-5 or google/gemini-2.0-flash-001 produce more consistent JSON output and tighter chain reasoning on complex scans.

| Flag | Description | |---|---| | --ai-triage | Enable AI severity re-ranking after all other scanners complete | | --ai-key <key> | OpenRouter API key (alternative to OPENROUTER_API_KEY env var) | | --ai-model <model> | OpenRouter model string to use (default: nvidia/nemotron-3-ultra-550b-a55b:free) |

AI Triage runs after every other enabled scanner on a given URL, so it always sees the complete picture before calling the model. It is non-fatal — if all API calls fail, the scan report is preserved exactly as the rule-based scanners produced it.

📊 AI Triage in the HTML Report

When --ai-triage is enabled, the HTML report is automatically upgraded beyond the standard findings table. Each scanned URL gets a dedicated AI Triage Panel above its findings, and the findings table gains a new AI Severity column — all rendered without affec