> Attack Modules
Every check BREACH.LAB fires against your site, mapped to the OWASP Top-10. Drag-ready payloads, probed through a headless browser + HTTP engine.
API keys, tokens, and credentials committed to the public web.
Configuration and environment files left publicly accessible.
Database query injection through unvalidated user input.
Absent CSP, HSTS, X-Frame-Options, or X-Content-Type-Options.
Wildcard or overly-permissive cross-origin resource sharing.
Server exposes file directory listings to anonymous users.
Backup archives, .git, or source dumps available to the public.
Untrusted data rendered as executable script in the browser.
Protected resources reachable without proper authorization.
Session cookies without HttpOnly / Secure / SameSite attributes.
Weak TLS configuration or expired / misconfigured certificates.
Stack traces and internal details surfaced in error responses.