What each check catches
Every weakness in the lab maps to a Scout check. Use this to see exactly what a given check detects, and how a scan covers the app.
Black-box (running app)
Section titled “Black-box (running app)”| Lab / artifact | Vulnerability | Scout check |
|---|---|---|
| (whole app) | No CSP / HSTS / X-Frame-Options / nosniff / Referrer / Permissions-Policy | headers.* |
session, lab_csrf cookies |
No HttpOnly / Secure / SameSite | headers.cookie-flags |
/.env, /.env.bak |
Exposed env file | exposure.dotenv |
/.git/config |
Exposed git metadata | exposure.git |
/metrics |
Exposed metrics | exposure.metrics |
/swagger.json |
Exposed API docs | exposure.swagger |
/backup.sql |
Exposed backup | exposure.backup-files |
/search?q= |
Reflected XSS (unescaped) | app.reflected-xss |
/transfer |
State-changing form, no CSRF token | app.csrf-form |
/api/redirect?url= |
Open redirect | app.open-redirect |
/api/data |
CORS reflects Origin + credentials | auth.cors |
session cookie |
Forgeable JWT (alg:none, no expiry) |
auth.jwt |
/api/users/[id] |
IDOR (no ownership check) | auth.idor (needs test identities) |
/api/debug |
Stack trace returned to client | app.info-disclosure |
/api/graphql |
Introspection enabled | api.graphql-introspection |
/api/v1/users + /api/v2/users |
Deprecated API version still live | api.improper-asset-mgmt |
/api/reset |
Reset link built from the Host header | app.host-header |
| (whole app) | X-Powered-By: Next.js banner |
app.version-disclosure |
Source (--repo)
Section titled “Source (--repo)”| File | Vulnerability | Scout check |
|---|---|---|
.env (committed) |
Hard-coded secrets | code.secrets |
Dockerfile |
Root user, unpinned base, secret in ENV | code.dockerfile |
lib/crypto.js |
MD5/SHA-1 hashing, Math.random tokens |
code.weak-crypto, code.insecure-random |
lib/logger.js |
Password/token written to logs | code.secret-logging |
| dangerous sinks | eval / exec / raw HTML |
code.dangerous-sink |
package.json |
Loose version ranges | code.unpinned-deps |
Active probes (attack logic)
Section titled “Active probes (attack logic)”The lab also exposes endpoints for the active injection probes. Several of these
are implemented (app.sqli, app.cmd-injection, app.ssrf, app.path-traversal,
app.open-redirect, app.reflected-xss); others ship as scaffolds that are
registered but report nothing until their payload logic is written:
| Endpoint | Vulnerability | Check |
|---|---|---|
/api/ping?host= |
OS command injection | app.cmd-injection (implemented) |
/api/ssti?name= |
Server-side template injection | app.ssti (scaffold) |
/api/xxe |
XXE | app.xxe (scaffold) |
/api/upload |
Unrestricted file upload | app.file-upload (scaffold) |
/api/profile |
Mass assignment (isAdmin) |
auth.mass-assignment (scaffold) |
/api/checkout |
Business logic (negative qty) | app.business-logic (scaffold) |
See the checks catalog for the complete list.