Security Lens

Security Lens: Advanced VAPT Recon & CVSS Scoring Suite Turn your browser into a powerhouse reconnaissance engine. Security Lens is an advanced Chrome extension that runs 7 targeted Vulnerability Assessment and Penetration Testing (VAPT) modules against your active tab, producing enterprise-grade findings with automated CVSS v3.1 scoring. Designed specifically for professional penetration testers, bug bounty hunters, and security engineers, this tool eliminates false positives and accelerates the manual testing workflow. Core Reconnaissance Modules Broken Link Hijacking (BLH) Engine: A zero-false-positive scanner that extracts external URLs (from scripts, iframes, and anchors) to detect highly critical expired domains (NXDOMAIN) and 404s, explicitly filtering out temporary 5xx server errors. JS Static Analyzer (SAST): Bypasses CORS to fetch and analyze cross-domain JavaScript bundles. It extracts hardcoded secrets (AWS, Stripe, OpenAI, JWTs), hidden API endpoints, and dangerous DOM XSS sinks (like innerHTML and eval). Active CORS Misconfiguration Scanner: Actively tests Cross-Origin Resource Sharing policies by injecting manipulated origins to confirm if Cross-Origin Data Theft or null-origin trusts are possible. Clickjacking Verifier & PoC: Evaluates X-Frame-Options and CSP frame-ancestors. Includes an interactive "Overlay Test" to visually confirm frameability directly within the extension. Internal IP & Path Disclosure: Deep-scans the DOM and JSON-responses to identify leaked internal network ranges and double-escaped Windows/Unix filesystem paths. Banner Grabbing & WAF Detection: Multi-layered fingerprinting that analyzes HTTP headers, inspects 4xx/5xx error body signatures, and detects Web Application Firewalls (e.g., Cloudflare, Akamai). Security Header Assessment: Instantly audits the active tab for missing critical protections like HSTS, strict-origin CSPs, and MIME-sniffing mitigations. Professional Reporting & Export Security Lens doesn't just find vulnerabilities; it categorizes and formats them for immediate delivery to your clients or bug bounty triagers: Executive PDF Summaries: Generate a clean, 1-page high-level presentation highlighting risk exposure and automated CVSS v3.1 metrics. Pentester Deliverables: Export structured JSON/Text reports containing full technical evidence, raw HTTP request headers, and vector strings ready for immediate ingestion into Burp Suite or OWASP ZAP. Privacy & Security First Security Lens operates entirely locally within your browser. It does not collect, store, track, or transmit any of your browsing history, targets, or vulnerability findings to external servers. Author: Pratham Verma Version: 1.1.0