Verified scans. Real exploits. Structured reports.
Once you have dependency visibility in place, point Rorix at the apps and APIs you own. DNS-based ownership verification, Nuclei + API fuzzing, and exec-ready reports with reproductions.
Scoped, verified, reproducible
Every finding is something you could paste into a terminal and reproduce. No vague 'misconfiguration detected' noise.
Verify ownership
Add a TXT record or place a file. We block scanning anything you haven't proven control over.
Discover surface
Crawl the app, enumerate APIs from OpenAPI/GraphQL schemas, map auth boundaries and tenancy lines.
Run detectors
Nuclei template library, parameter fuzzing, broken-auth and IDOR probes, dependency-driven CVE replays.
Triage + report
False-positive filter with manual triage queue. Findings land with reproduction, payload, and remediation.
3,291 templates. Updated weekly.
Built on Nuclei, extended with .NET-aware detectors, and filtered through our own triage to cut false positives.
- SQLi (boolean, time, UNION)
- Command injection
- NoSQL injection
- LDAP injection
- XXE / XML injection
- Broken session fixation
- JWT alg confusion
- IDOR across tenants
- Forced browsing
- OAuth redirect tricks
- Log4Shell replay
- Spring4Shell
- ProxyShell variants
- Struts OGNL
- Confluence CVE replays
- Exposed .git/.env
- Debug endpoints
- Default creds
- SSRF to metadata
- Header leaks
- Schema discovery
- Rate-limit bypass
- Mass assignment
- Excessive data exposure
- Shadow endpoints
- ViewState deserialization
- Telerik UI CVEs
- Kentico exploits
- DotNetNuke chains
- Razor SSTI
Every finding. Reproducible.
No screenshots. No hand-waving. A curl command and a payload.
$ curl -X POST \https://api.target.com/auth/whoami \-H "Authorization: Bearer $PAYLOAD"# $PAYLOAD = jwt signed with HS256 using# public key as secret (alg=none fallback)→ 200 OK{ "user": "admin", "scope": "*" }
- Pin the JWT library to accept only RS256.
- Reject tokens where header alg is HS256 or none.
- Rotate signing keys; revoke outstanding tokens.
- Add regression test: test_jwt_alg_enforcement.cs