Scan Modules

CyberDoc uses two categories of scan modules: browser-side checks that run entirely in the user's browser, and server-side tools that execute on the backend scanner against a target domain.

Severity Levels

All findings are rated on a five-level severity scale:

The overall risk score is calculated as the sum of all finding severity scores divided by the maximum possible score (number of checks x 4).

Browser-Side Checks (8)

These checks run in the user's browser after explicit consent. They do not probe external systems — only the user's own browser environment.

1. Browser Fingerprint Analysis

Example findings by severity:

• INFO — Browser fingerprint is partially masked
• LOW — Canvas fingerprint is unique but common attributes hidden
• MEDIUM — Browser is uniquely identifiable across 94% of tested configurations
• HIGH — Full fingerprint exposed — screen, GPU, fonts, plugins all visible
• CRITICAL — Zero fingerprint protection — you are fully trackable across sites

2. WebRTC Leak Detection

Example findings by severity:

• INFO — WebRTC disabled — no leak possible
• LOW — WebRTC active but IP properly masked by VPN
• MEDIUM — Local IP address leaking via WebRTC
• HIGH — Public IP exposed through WebRTC despite VPN being active
• CRITICAL — Both local and public IPs fully exposed through WebRTC

3. HTTP Header Analysis

Example findings by severity:

• INFO — Security headers properly configured
• LOW — Minor header optimizations recommended
• MEDIUM — X-Frame-Options and CSP headers missing
• HIGH — Multiple critical security headers absent
• CRITICAL — No security headers detected — fully exposed to injection attacks

4. Cookie & Storage Audit

Example findings by severity:

• INFO — Minimal cookies, all first-party
• LOW — Some third-party cookies detected
• MEDIUM — 12 tracking cookies from 8 domains detected
• HIGH — Persistent supercookies and tracking pixels identified
• CRITICAL — 28 trackers active — complete browsing profile being built

5. TLS/SSL Configuration Check

Example findings by severity:

• INFO — TLS 1.3 with strong cipher suite
• LOW — TLS 1.2 — functional but upgrade recommended
• MEDIUM — Weak cipher suites accepted alongside strong ones
• HIGH — TLS 1.0/1.1 still accepted — vulnerable to downgrade attacks
• CRITICAL — SSL/TLS misconfigured — connection can be intercepted

6. DNS Leak Test

Example findings by severity:

• INFO — DNS queries encrypted via DoH
• LOW — DNS properly routed through VPN tunnel
• MEDIUM — Some DNS queries leaking outside VPN tunnel
• HIGH — Primary DNS queries exposed to ISP
• CRITICAL — Full DNS leak — all browsing activity visible to ISP

7. Common Port Exposure Scan

Example findings by severity:

• INFO — No unexpected open ports detected
• LOW — Standard ports only (80, 443) — expected
• MEDIUM — Port 8080 open — possible dev server exposed
• HIGH — Ports 22, 3389 open — SSH and RDP accessible
• CRITICAL — Multiple high-risk ports open including 445 (SMB), 3306 (MySQL)

8. Data Breach Exposure Check

Example findings by severity:

• INFO — No breached credentials found
• LOW — 1 old breach found — already remediated
• MEDIUM — 3 breaches found — password changes recommended
• HIGH — Email found in 7 breaches — several with plaintext passwords
• CRITICAL — 12+ breaches detected — credentials actively circulating on dark web

Scan Lab Tools (17)

These tools run on the backend scanner and require a target domain. They are triggered via the /api/deepscan endpoint and execute as a chain. Each tool's output can inform subsequent tools (e.g., discovered subdomains feed into further scans).

1. Nmap (Port & Service Scanner)

2. Nuclei (Vulnerability Scanner)

3. Nikto (Web Server Scanner)

4. testssl.sh (TLS/SSL Analyser)

5. httpx (HTTP Probe)

6. ffuf (Web Fuzzer)

7. DNS Enumeration

8. Subdomain Discovery

9. WHOIS Lookup

10. Origin IP Bypass Detection

11. Security Headers Check (Server-Side)

12. Technology Fingerprinting

13. WAF Analysis & Bypass

Checks performed:

• WAF vendor fingerprinting (14 vendors via response headers, error pages, and cookie signatures)
• XSS bypass payloads (script tag variations, event handlers, SVG injection)
• SQL injection bypass (UNION variants, comment injection, encoding tricks)
• Path traversal sequences (../, double-encoded, Unicode normalization)
• Header spoofing with 8 IP override headers to test WAF IP-based rules
• Nuclei WAF-specific templates for known bypass CVEs

14. Web App Vulnerabilities

Checks performed (14 OWASP checks):

15. OWASP Extended

Checks performed:

16. API Security

Checks performed (OWASP API Top 10):

17. AI/LLM Security

Checks performed (OWASP LLM Top 10):

Scan Chain

When a Lab scan is initiated, the tools execute in a specific order where earlier results feed into later tools:

1. DNS Enumeration (dig)
   |
   +--> 2. Subdomain Discovery (subfinder)
   |       |
   |       +--> 3. httpx probe on all discovered hosts
   |
   +--> 4. WHOIS lookup
   |
   +--> 5. Origin IP Bypass detection
          |
          +--> 6. Nmap scan (target + any discovered origin IPs)
          |
          +--> 7. testssl.sh (TLS analysis)
          |
          +--> 8. Nikto (web server scan)
          |
          +--> 9. Nuclei (vulnerability scan)
          |
          +--> 10. ffuf (directory fuzzing)
          |
          +--> 11. Security Headers check
          |
          +--> 12. Technology Fingerprinting
          |
          +--> 13. WAF Analysis & Bypass
          |
          +--> 14. Web App Vulnerabilities (OWASP checks)
          |
          +--> 15. OWASP Extended (CORS, SSRF, takeover)
          |
          +--> 16. API Security (OWASP API Top 10)
          |
          +--> 17. AI/LLM Security (OWASP LLM Top 10)

If the origin bypass tool discovers the real server IP behind a CDN, subsequent scans (nmap, nikto, nuclei) are re-run against the origin IP to test the unprotected server directly.