Sparrofox Security — Website Vulnerability Scanner & Threat Intelligence

// what we scan

9 security checks. One scan.

Each module runs independently and maps findings to industry compliance frameworks.

🔒

SSL/TLS Analysis

Certificate validity, chain trust, protocol version, cipher strength, expiry warnings, HSTS enforcement.

OWASP A02 NIST SC-8

🛡️

Security Headers

CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and 4 more critical headers.

OWASP A05 ISO 27001

🌐

DNS Records

A, AAAA, MX, TXT, NS records. SPF/DKIM/DMARC validation. DNSSEC checking. Mail security assessment.

NIST SC-20

🍪

Cookie Security

HttpOnly, Secure, SameSite flags. Cookie scope analysis. Session management assessment.

OWASP A07 CIS 16.9

🔄

CORS Configuration

Origin policy testing. Wildcard detection. Credential exposure risks. Pre-flight configuration validation.

OWASP A01

📡

Port Scanning

Common service ports (20+). Unexpected open port detection. Service identification. Risk classification per port.

NIST CM-7 CIS 9.1

🔍

Technology Detection

Identify web server, CMS, frameworks, CDNs, analytics tools. Known vulnerability mapping for detected tech.

OWASP A06

🤖

Robots.txt & Paths

Sensitive path exposure in robots.txt. Admin panel detection. Backup file discovery. Information leakage.

OWASP A01

📊

Composite Scoring

Weighted score across all modules. Letter grade (A-F). Severity distribution. Priority remediation order.

ISO 27001 NIST RA-5

// capabilities

More than a scanner.

🛡️ Threat Intelligence

Live RSS feeds from major security sources. CISA alerts, NIST bulletins, vendor advisories. Searchable, categorised, timestamped.

🐛 CVE Search

Search the NVD (National Vulnerability Database) for CVEs by keyword, product, or vendor. CVSS scores, severity, affected versions, references.

📊 Scan History

Every scan is stored locally in SQLite. Track your security posture over time. Compare scores across scans. Export results.

🎯 Compliance Mapping

Each finding maps to specific OWASP, ISO 27001, CIS, and NIST controls. Generate compliance-ready reports for auditors.

// frameworks

Maps to the standards that matter.

🅾

OWASP Top 10

Web application security risks. A01–A10 coverage across all scan modules.

🔷

NIST 800-53

Federal security controls. SC, CM, RA, and AC families mapped to findings.

✅

ISO 27001

Information security management. Annex A controls mapped to scan results.

🏛️

CIS Controls

Center for Internet Security benchmarks. Critical and foundational controls.

Sparrofox Security.