🛡️ Security Tools Roadmap

Paste a dependency manifest (package.json, requirements.txt, go.mod) → check every package against known vulnerabilities.

Curated index of publicly available exploits with PoC links, affected versions, and patch status.

Paste a GitHub PR diff URL — scans for auth bypasses, IDOR patterns, SSRF, and credential leaks. Client-side only, no backend.

Select a CVE from the database → generates a sandboxed proof-of-concept snippet showing how the exploit works. Educational, read-only.

Enter a GitHub repo URL → checks for SECURITY.md, dependabot config, SAST workflow, CODEOWNERS, and signed commits. Grade A-F.

Paste a CI workflow YAML → detects secret exposure, missing SAST steps, runner misconfigurations, and privilege escalation vectors.

Select a vulnerability type (IDOR, XSS, SQLi, SSRF) → get a context-aware code fix block. Strix's auto-fix pattern adapted for education.

Interactive Content-Security-Policy builder. Toggle directives → see the generated header + live scoring. Export as ready-to-deploy header value.

Enter a package name + version → shows available patches, severity, and changelog links. Covers npm, PyPI, Maven, Go modules.

Query A, AAAA, MX, NS, TXT, CNAME, SOA records via DNS-over-HTTPS. Export as JSON.

Domain registration data — registrar, creation/expiry dates, name servers — via RDAP API.

Probe common ports (HTTP, SSH, MySQL, etc.) to detect open services on a target domain.

IP address → location, ISP, ASN, and risk score via public geolocation APIs.

Autonomous System Number lookup — owner, prefix list, peer networks, and country.

OUI database lookup — identify the hardware vendor from a MAC address prefix.

CIDR notation → network address, broadcast, usable hosts, subnet mask, wildcard.

Test CORS policies — send preflight requests and report allowed origins, methods, and headers.

Paste a Content-Security-Policy header → score it for bypass risks, missing directives, and unsafe allowlists.

Certificate details, expiry countdown, issuer chain, cipher suite support, and protocol versions.

Test a URL for open redirect vulnerabilities — common bypass patterns and parameter injection.

Analyze cookies for security flags: Secure, HttpOnly, SameSite, Path, Domain, and Expiry.

Build custom HTTP requests with headers, methods, and body. See raw response — like curl in the browser.

Generate MD5, SHA-1, SHA-256, SHA-512 hashes from text or files. Copy to clipboard with one click.

Paste a hash → identify the type by length, character set, and format patterns (MD5, SHA*, bcrypt, NTLM, etc.).

Base64, Hex, URL encoding, Base32 — encode and decode in both directions with live preview.

Decode JWTs — inspect header, payload, signature algorithm. Validate expiration and common signing issues.

Real-time entropy calculation, character class analysis, common password detection, and time-to-crack estimate.

Shannon entropy and bit strength calculation for passwords, tokens, and keys.

Paste Apache, NGINX, or syslog entries → parse into structured fields. Filter by status codes, IP, timestamps.

Test regex patterns for log analysis, WAF rules, and detection signatures. Built-in patterns for IPs, URLs, hashes.

Identify file types by magic bytes / header signatures — detect mismatched extensions and covert payloads.

Parse and explain cron schedules — human-readable next 5 fire times from any expression.

Interactive demo of reflected, stored, and DOM-based XSS — see how payloads execute and how to fix them.

Sandboxed SQL injection demo — test injection techniques against a simulated database. No real database connection.

Check if a domain is vulnerable to clickjacking — test X-Frame-Options, CSP frame-ancestors, and framebusting.

Interactive demo showing how misconfigured CORS policies enable cross-origin data theft.