Every security review I do starts the same way: collect URLs, headers, API paths, and a list of the tech stack. It's 10 minutes of copy-paste that I've done hundreds of times.
I finally automated it. The script does:
- Pull response headers for the main pages
- Extract script/link URLs and look for API paths
- Check for common misconfigurations (missing CSP, open directory listing)
- Write everything into a timestamped notes file
It doesn't find bugs. It just removes the boring part, which means I spend the first 10 minutes thinking instead of typing.
I'm reading about Kotlin Multiplatform for some mobile testing experiments. Any good resources on mobile attack surfaces would be welcome.
Top comments (0)