Net Labs SecHunter

Find your site's weak spots before attackers do.

HTTP headers, session cookies, forgotten API keys, mixed content, forms: SecHunter sifts through up to 50 pages in minutes, attacks nothing, and tells you what to fix.

Overview

A score out of 100, then every flaw, page by page

Start security audit now →

The Method

From address to fix, in five steps

  1. 01

    Enter

    Your website address, with or without https:// protocol.

    An address

  2. 02

    Explore

    Your browser follows internal links, batch by batch, respecting robots.txt.

    Up to 50 pages

  3. 03

    Analyze

    Every response is read passively: security headers, HTTPS and cookie attributes.

    Headers & Cookies

  4. 04

    Detect

    API keys in the code, mixed content, exposed forms: everything ranked by severity.

    Categorized flaws

  5. 05

    Fix

    Each flaw explains the risk and gives the configuration line to add.

    Fixes & CSV

Checks

22 checks on every page

HTTP Headers

  • Content-Security-Policy (CSP) and permissive directives
  • Strict-Transport-Security (HSTS) and max-age duration
  • Anti-Clickjacking protection (X-Frame-Options / frame-ancestors)
  • MIME-sniffing protection (X-Content-Type-Options: nosniff)
  • Referrer and Permissions-Policy (camera, mic, location)
  • Server version leaks (Server, X-Powered-By)

Cookies & Sessions

  • Secure flag: required transmission on encrypted HTTPS
  • HttpOnly flag: protection against session theft via XSS
  • SameSite attribute: protection against cross-site CSRF
  • SameSite=None rejected without the Secure attribute
  • CORS open to everyone (*) combined with cookies
  • Every cookie listed with its attributes in the page detail

Secrets & DOM

  • API keys in the HTML and the site's .js files (AWS, Google, Stripe, GitHub, Slack, JWT, private keys)
  • JavaScript sourcemaps announced by the page or its scripts
  • Mixed content (unencrypted HTTP scripts, styles, iframes on HTTPS)
  • Insecure forms with password submitted over cleartext HTTP
  • External target=_blank links vulnerable to Reverse Tabnabbing
  • Sensitive HTML comments revealing IP addresses or TODOs

Standards

Public thresholds, not a black box

Every check relies on an OWASP, ANSSI or RFC recommendation, and every alert comes with a fix you can apply right away.

Check Recommended standard Framework
Content-Security-Policy Strict CSP without unsafe-inline W3C CSP Level 3 / OWASP
Strict-Transport-Security max-age ≥ 15,552,000 (6 months) RFC 6797 / ANSSI
Anti-Clickjacking DENY or SAMEORIGIN RFC 7034
MIME Sniffing nosniff required Fetch Standard / OWASP
Session cookies Secure; HttpOnly; SameSite=Lax RFC 6265bis
Secrets in the code No hardcoded private keys OWASP Top 10 (A01/A02)

The sources

Foundational security references

SecHunter checks are grounded in widely recognized web security guidance and standards.

OWASP Top 10

An overview of the leading web application security risks.

OWASP Cheat Sheet Series

Practical advice for preventing application vulnerabilities.

ANSSI

Guides and security recommendations for information systems.

W3C — Content Security Policy

The specification for web content security policies.

IETF — Web security RFCs

HTTP, HSTS, cookies, and vulnerability disclosure standards.

WHATWG — Fetch Standard

Standardized behavior for web requests and their headers.

Under the hood

A passive audit, honest about what it sees

No attack, ever

SecHunter reads what any visitor receives: headers, cookies, HTML and scripts. No injection, no brute force, no needless load on your server.

Your browser drives

It keeps the page queue and asks the server for batches of four. Nothing is stored: the report stays with you.

Polite to the site

robots.txt is followed and the crawl slows down as soon as the server asks. No private network address can be reached.

A first safety net, not a pentest

A passive audit catches the most common misconfigurations. It does not replace a penetration test, and says so.

Does your site pass the test?

Up to 50 pages audited for free, no account, no install.

Audit my site →

Community

Join Net Labs on Discord

Ask questions about your audits, discuss web security, and get updates about our tools.

Join the Discord

Project technologies