Documentation
Ostorlab - Application Security Testing
Initializing search
Login
Demo
Home
Getting Started
Copilot
Scanning
Attack Surface
Policies & Remediation
Integrations & API
Organisation
Plans
Security & Privacy
FAQ
Ostorlab Docs
A comprehensive guide to using Ostorlab.
Getting Started
Getting Started
Dashboard
Copilot
Copilot
Copilot Examples
Copilot FAQ
Scanning
Scan Profiles
Run a scan
Manage Scans
View more...
Attack Surface
Discovery
AI Agent Attack Surface Discovery
Data
View more...
Policies & Remediation
Policies
Integrations & API
API
Organisation
Setup
Users
Settings
View more...
Plans
Add Plan
Transfer plans
Security & Privacy
Checklists
Security
Privacy
View more...
FAQ
FAQ
Documentation
Home
Getting Started
Getting Started
Getting Started
Dashboard
Dashboard
Overview
Scans & Risk
Remediation
Inventory & Attack Surface
Remediation Calendar
Copilot
Copilot
Copilot
Copilot Examples
Copilot FAQ
Scanning
Scanning
Scan Profiles
Scan Profiles
Mobile Scan Profiles
Web Scan Profiles
Network Scan Profile
Autodiscovery Scan Profile
Run a scan
Run a scan
Scan a Mobile Application from the Store
Scan a Mobile Application from a File
Scan an iOS Mobile Application using TestFlight
Mobile AI Pentest Scan
Whitelist domains in mobile scans
Scan a Web Application
Authenticated Web Application Scan
Web AI Pentest Scan
Authenticated Scans
Scans with SBOM or Lockfile
Scan Networks
Scan Assets from the inventory
Scan with custom config
Scan Web App with Chrome's Recorder Puppeteer Script
Scan with extra custom Agents
Scan with UI Prompts
Mobile Scan Prerequisites
How to add a new agent with a private repository
Scan Internal Web App
AI Pentest Prompt Guide
2FA for Authenticated Scans
Manage Scans
Manage Scans
Stop Scan
Archive Scan
Report
Report
Generate PDF report
Risk Rating
Change Risk Rating
Share Scan Report
Analysis
Analysis
IDE
Check Call Coverage
AI Pentest
Monitoring
Monitoring
Monitoring
Create Monitoring Rule
Whitelist domains in mobile application monitoring rules
On-prem Scanners
On-prem Scanners
Run a scan
BYOK
BYOK
Generate a BYOK Scan Key
Use your BYOK Scan Key in a Scan Profile
Recommended BYOK Models
Attack Surface
Attack Surface
Discovery
AI Agent Attack Surface Discovery
Data
Monitoring
Search and Navigation
Inventory
Inventory
Add Assets
Discover Assets
Edit Potential Owners
Bulk Import Assets
Edit Assets
Delete Asset
Filter by Asset
Exclude Asset
Advanced Search syntax
Graph
Graph
Share a Graph
Location
Location
Add Location
Owners
Owners
Add Owner
Policies & Remediation
Policies & Remediation
Remediation
Remediation
Ticketing
Ticketing
Guide
Create Ticket
Comment on Ticket
Add a Checklist to a Ticket
Configure Patching Policy
Vulnerabilities and Tickets Management
Identify the Location of a Vulnerability from a ticket
Ticket Aggregation
Ticket Aggregation
How it works?
Configure Aggregation based on the platforms
Configure Aggregation based on the applications IDs
Views
Views
Timeline
Policies
Policies
Automation Rules
Integrations & API
Integrations & API
Integrations
Integrations
CI/CD
CI/CD
GitHub
GitLab
Jenkins
Azure DevOps
App Center
CircleCI
Bitbucket
GoCD
TeamCity
Slack
Vanta
Bitrise
Harness
Ticketing
Ticketing
Jira
ServiceNow
SSO
SSO
Guide
Saml with Azure Active Directory
Saml with Google Workspace (formerly G Suite)
Saml with Okta
Saml with OneLogin
API
API
GraphQl API
Organisation
Organisation
Setup
Setup
Create Organisation
Users
Users
User Roles
Add Users
Switch Organisation
Modify User Permissions
Disable email notifications
Settings
Settings
Add Two-factor authentication device to your account
Add Organisation Tags
Owner-Based RBAC Feature
Access
Access
Manage Access and Attack Surface Auditor Owners
Plans
Plans
Add Plan
Transfer plans
Security & Privacy
Security & Privacy
Checklists
Checklists
Mobile App Security Checklist
iOS App Security Checklist
Android App Security Checklist
Flutter App Security Checklist
Security
Security
Mobile App Security Testing
Streamlining Mobile App Security in the SDLC with Ostorlab
Detection
Platform Support
Security at Ostorlab
Vulnerability Disclosure
Network IPs for Scanning and Integrations
Privacy
Privacy
Privacy Policy Analysis
Knowledge Base
Knowledge Base
Cordova Cross-Site Scripting (XSS)
Insecure whitelist
Source Map Code Leak
Insecure whitelist configuration
Cordova debug mode enabled
Insecure App Transport Security (ATS) Settings
Missing privacy manifest file
iOS URL Scheme Hijacking
iOS URL Scheme Injection
IPA Plist files
IPA files list
URL Scheme list
Mach-O entitlements
Strings Bplist files
IPA symbol table
IPA Frameworks list
Unclaimed Cocoapods Vulnerability
Application implements anti-debug techniques
Privacy manifest files
No sensitive data stored outside App
Malformed ATS Configuration
Deprecated Minimum iOS Version
Stack smashing protection not enforced
Automatic Reference Counting (ARC) not enforced
Address Space Layout Randomization (ASLR) not enforced
iTunes UI File Sharing Enabled
Insecure Keychain Storage
iOS Sensitive data stored in keyboard cache
Debug Symbols Present in the IOS Application
IPA contains only bitcode
Mach-O encrypted
addJavaScriptInterface Remote Code Execution.
Webview loadurl injection
Redis Library detected
Facebook SDK debug mode enabled
Use of an insecure Bluetooth connection
File Path Traversal
Insecure Shared Preferences Permissions
Android Class Loading Hijacking
Webview Remote Debugging Enabled
Abuse of mobile network connection
Implicit PendingIntent
Insecure Register Receiver Flag
Insecure File Provider Paths Setting
Android Class Load Hijacking
Intent Redirection
Application signed with an expired certificate
Call to dangerous WebView settings API
Notification Spoofing
Remote Command Execution
Android Package Context created without security restrictions
Recorded calls to logging API
Implementation of a FileObserver
Call to Inter-Process-Communication (IPC) API
Broadcast receiver dynamic registration
Call to Reflection API
Hardcoded SQL queries list
Application certificate information
Call to native methods
Recorded calls to dynamic code loading API
Recorded calls to TLS Pinning API
Expansion APK enabled
Call to External Storage API
Call to Random API
Recorded calls to TLS API
Call to delete file API
Recorded calls to SQLite query API
Call to Socket API
Call to logging API
Hardcoded urls list
Recorded calls to Inter-Process-Communication (IPC) API
Recorded calls to dangerous WebView settings API
Recorded calls to HTTP API
Classes list
Call to dynamic code loading API
Call to XML parsing API
Recorded calls to Shared Preferences API
Recorded calls to Process API
Recorded calls to Crypto API
Hardcoded strings list
Implementation of a WebViewClient
Obfuscated methods
Recorded calls to command execution API
Recorded calls to Intent API
Recorded calls to Hash API
APK attack surface
List of JNI methods
Call to TLS API
Call to command execution API
Call to SQLite query API
Recorded calls to FileSystem API
APK files list
Call to Android Security API
Declared permissions list
Recorded calls to Serialization API
Call to Crypto API
Android Manifest
Call to ZIP API
Call to Bluetooth and BLE API
Secure Network Configuration Settings
Application checks rooted device
Debug mode disabled
Backup mode disabled
ELF binaries do not enforce secure binary properties
Debug mode enabled
Application code not obfuscated
Attribute hasFragileUserData not set
Unused permissions (overprivileged)
Facebook React development settings exposed
Insecure Network Configuration Settings
Debug Symbols Present in the Android Application
Attribute usesCleartextTraffic set
Undeclared Permissions
Intent Spoofing
Attribute requestLegacyExternalStorage set
Android Sensitive data stored in keyboard cache
Deprecated Target API Version
Task Hijacking
Services declared without permissions
Backup mode enabled
Source to Sink
Application prevents taking screenshots
Exported activities, services and broadcast receivers list
Privacy Policy CCPA Rights Reference missing
Voice Data Collection Not Disclosed in Privacy Policy
Missing Declaration of Video Collection in Privacy Policy
Personally Identifiable Information (PII) Leakage
Genetic Data Collection Not Disclosed in Privacy Policy
Missing Privacy Policy Link
Missing Mention of User Data Deletion in Privacy Policy
Device ID Data Type Declaration Mismatch
Mobile SQL Injection Vulnerability
Precise Location Data Type Declaration Mismatch
Religious Beliefs Collection Not Disclosed in Privacy Policy
Political Affiliations Collection Not Disclosed in Privacy Policy
Gender Identity Collection Not Disclosed in Privacy Policy
Biometric Authentication Bypass
Email Address Collection Not Disclosed in Privacy Policy
Insecure Dynamic Library Loading
OAuth Account Takeover by hijacking custom schemes
Collection of Users' Purchase History in Privacy Policy
Missing Mention of User Data Correction Rights in Privacy Policy
Insecure password storage
Cryptographic Vulnerability: Weak Hashing Algorithm
Missing Declaration of Email Collection in Privacy Policy
App Usage Data Collection Not Disclosed in Privacy Policy
Missing Privacy Policy Disclosure for Fitness Info Collection
Sensitive Information Data Type Declaration missing
ZIP Vulnerabilities: Path Traversal, Zip Symbolic Link, and Zip Extension Spoofing
XML Injection
Missing GDPR Rights Reference in Privacy Policy
Health and Biometric Data Type Declaration Mismatch
Collection of Users' Crash Logs without Consent
Credentials exposed in URLs
External Account Information Collection Not Disclosed in Privacy Policy
Credentials exposed in logs
In-App Search Queries Collection Not Disclosed in Privacy Policy
Biometric Data Collection Not Disclosed in Privacy Policy
Missing Declaration of Health Info Collection in Privacy Policy
Insecure Storage of Application Data
Missing Declaration of Phone Number Collection in Privacy Policy
User Credentials Handling Not Clearly Disclosed in Privacy Policy
Insecure hostname validation check
Missing Opt-out Information in Privacy Policy
Information Concerning Sex Life Collection Not Disclosed in Privacy Policy
User ID Collection in Privacy Policy
Text Messages Data Type Declaration Mismatch
Missing Declaration of Photo Collection in Privacy Policy
Privacy Policy Personal Data Categories Disclosure mismatch
Identity Verification Information Collection Not Disclosed in Privacy Policy
Missing Declaration of Voice or Sound Recording Collection in Privacy Policy
Personal Identifiers Collection Not Disclosed in Privacy Policy
Philosophical Beliefs Collection Not Disclosed in Privacy Policy
Contact Information missing in Privacy Policy
Missing Mention of User Data Access in Privacy Policy
In-App Search History Collection in Privacy Policy
Criminal Record Information Collection Not Disclosed in Privacy Policy
Trade Union Membership Information Collection Not Disclosed in Privacy Policy
Missing Declaration of Approximate Location Collection in Privacy Policy
Contacts Data Type Declaration Mismatch
Missing Mention of Users' Right to Know in Privacy Policy
Health and Fitness Data Collection Not Disclosed in Privacy Policy
PII Data Type Declaration Mismatch
Location History Collection Not Disclosed in Privacy Policy
Missing Declaration of Installed Apps Collection in Privacy Policy
Racial or Ethnic Origin Information Collection Not Disclosed in Privacy Policy
Missing Declaration of User Files Collection in Privacy Policy
Sexual Orientation Information Collection Not Disclosed in Privacy Policy
Missing Privacy Policy Disclosure for Calendar Events Collection
Device and Network Information Collection Not Disclosed in Privacy Policy
Insecure Filesystem Access
HTML Injection Vulnerability
Collection of Users' Text Messages in Privacy Policy
Missing Third-Party Sharing Information in Privacy Policy
Missing Declaration of Email Address Collection in Privacy Policy
User Photos and Media Collection Not Disclosed in Privacy Policy
Phone Number Data Type Declaration Mismatch
Payment and Financial Information Collection Not Disclosed in Privacy Policy
Missing Declaration of Web Browsing History Collection in Privacy Policy
User Account Info Data Type Declaration Mismatch
Missing Legal Basis in Privacy Policy
Missing Declaration of Contact Collection in Privacy Policy
Browsing Activity Collection Not Disclosed in Privacy Policy
Current Precise Location Data Collection Not Disclosed in Privacy Policy
Cryptographic Vulnerability: Hardcoded Key
Privacy Policy Data Retention Description
Missing Declaration of Device or Other IDs Collection in Privacy Policy
Missing Declaration of Precise Location Collection in Privacy Policy
PII Categories Data Type Declaration Mismatch
Template Injection
Format String Vulnerability
Insecure JWT Signature Validation
XPath Injection Vulnerability
VirusTotal scan flagged malicious asset(s) (MD5 based search)
Biometric Authentication Without Cryptographic Binding
Domain name and IP address reputation report
Mobile WiFi API Personal Identifiable Information concerns
Tapjacking Vulnerability
List of calls to dangerous low-level C functions
Calls to Privacy API
Malicious Package: com.outsystems.plugins.fileviewer
Dependency Confusion
Identity Verification Information Collection Disclosed in Privacy Policy
Declaration of Photo Collection in Privacy Policy
Mention of Users' Right to Know in Privacy Policy
Third-Party Sharing Information in Privacy Policy is Present
Health and Biometric Data Type Declaration Match
Browsing Activity Collection Disclosed in Privacy Policy
Declaration of Contact Collection in Privacy Policy
Secure Virustotal malware analysis (MD5 based search)
User Account Info Data Type Declaration Match
GDPR Rights Reference Present in Privacy Policy
Declaration of Health Info Collection in Privacy Policy
Precise Location Data Type Declaration Match
Religious Beliefs Collection Disclosed in Privacy Policy
Information Concerning Sex Life Collection Disclosed in Privacy Policy
Political Affiliations Collection Disclosed in Privacy Policy
Gender Identity Collection Disclosed in Privacy Policy
Secure Collection of Users' Crash Logs without Consent
Location History Collection Disclosed in Privacy Policy
User Photos and Media Collection Disclosed in Privacy Policy
Declaration of Installed Apps Collection in Privacy Policy
Declaration of Voice or Sound Recording Collection in Privacy Policy
Declaration of Approximate Location Collection in Privacy Policy
Health and Fitness Data Collection Disclosed in Privacy Policy
Mention of User Data Correction Rights in Privacy Policy
Privacy Policy Link is Present
Declaration of Phone Number Collection in Privacy Policy
Privacy Policy Disclosure for Fitness Info Collection is Present
Current Precise Location Data Collection Disclosed in Privacy Policy
Mention of User Data Deletion in Privacy Policy
Declaration of Email Address Collection in Privacy Policy
Text Messages Data Type Declaration Match
Genetic Data Collection Disclosed in Privacy Policy
Phone Number Data Type Declaration Match
Legal Basis Present in Privacy Policy
Proper Privacy Policy Data Retention Description
Sexual Orientation Information Collection Disclosed in Privacy Policy
Racial or Ethnic Origin Information Collection Disclosed in Privacy Policy
Personal Identifiers Collection Disclosed in Privacy Policy
Secure User ID Collection in Privacy Policy
Secure domain name and IP address reputation report
SSL/TLS Pinning Detected
Biometric Data Collection Disclosed in Privacy Policy
Contact Information Present in Privacy Policy
PII Data Type Declaration Match
Declaration of Video Collection in Privacy Policy
App Usage Data Collection Disclosed in Privacy Policy
Trade Union Membership Information Collection Disclosed in Privacy Policy
Privacy Policy Personal Data Categories Disclosure match
Secure In-App Search History Collection in Privacy Policy
Device and Network Information Collection Disclosed in Privacy Policy
Opt-out Information Present in Privacy Policy
Secure Collection of Users' Text Messages in Privacy Policy
Secure Collection of Users' Purchase History in Privacy Policy
Declaration of Precise Location Collection in Privacy Policy
Declaration of User Files Collection in Privacy Policy
Mention of User Data Access in Privacy Policy
User Credentials Handling Disclosed in Privacy Policy
In-App Search Queries Collection Disclosed in Privacy Policy
Philosophical Beliefs Collection Disclosed in Privacy Policy
Payment and Financial Information Collection Disclosed in Privacy Policy
Criminal Record Information Collection Disclosed in Privacy Policy
Sensitive Information Data Type Declaration is Present
Privacy Policy Disclosure for Calendar Events Collection is Present
Declaration of Email Collection in Privacy Policy
External Account Information Collection Disclosed in Privacy Policy
PII Categories Data Type Declaration Match
Voice Data Collection Disclosed in Privacy Policy
Device ID Data Type Declaration Match
Contacts Data Type Declaration Match
Declaration of Device or Other IDs Collection in Privacy Policy
Privacy Policy CCPA Rights Reference are Present
Email Address Collection Disclosed in Privacy Policy
Declaration of Web Browsing History Collection in Privacy Policy
Use of Deprecated Component
Memory Leak
Use non-random initialization vector (IV)
Cryptographic Vulnerability: Insecure Algorithm
Cryptographic Vulnerability: Insecure mode
Insecure Random Seed
Regular expression denial of service
Process crashes
Collection of Device Identifier
Use of Outdated Vulnerable Component
Continuous collection of GPS location
Port open on device
URL Manipulation
Secret information stored in the application
Obfuscated Flutter code
Public AWS S3 bucket with file listing enabled
Secure Firebase Database Permissions
Network Port Scan
DNS Vulnerability: Dangling Domain Records
Subdomain Takeover
DNS MX Record Misconfiguration
Unrestricted DNS Zone Transfers
DNS Vulnerability: Malicious Content in TXT Records
MTA-STS Misconfiguration
DNS Information Disclosure
Missing or misconfigured DNSSEC
DNS Check: SPF, DKIM, DMARC, and BIMI Validation
DNS High TTL Values
External DNS interaction
Alias Overloading in GraphQL API
Circular Fragment in GraphQL
Insecure TLS Certificate Validation
Anonymous unauthenticated server accepted
HTTP Host Header Poisoning
CORS Misconfiguration Vulnerability
Insecure Access Control
GraphQL Circular References
Array-Based Batch Queries
Field Duplication in GraphQL API
GraphQL Debug Mode Enabled
Directive Overloading in GraphQL API
Use of deprecated TLS/SSL protocol version
Insecure TLS Ciphers supported
Insecure TLS certificate domain name validation
Clear text HTTP request
Insecure Cross-Origin Resource Sharing (CORS) policy
Object Limit Overriding in GraphQL
Insecure TLS certificate validation (accept self-signed certificate)
Insecure Authorization Restriction
Cross-Site Scripting (XSS)
LDAP Injection
Insecure Object Serialization
Web XML Injection
Publicly exposed Firebase Database
CRLF Injection
Path Traversal
Heartbleed (CVE-2014-0160)
Insecure Direct Object Reference
GraphQL Schema Traversal Paths
Generic Web Entry
Interesting response
TLS/SSL Server Configuration Settings
Server Side Inclusion
SQL injection
Expression Language (EL) Injection
XPath Injection
File inclusion vulnerability
Unrestricted file upload
Code Injection
Server-side template injection (SSTI)
NoSQL Injection
XML External Entity (XXE) Injection
Command Injection
Account Takeover Vulnerability
Protected Against GraphQL Tracing Risks
Protected Against GraphQL Object Limit Overriding
Protected Against GraphQL Field Duplication
Protected Against GraphQL Debug Mode Risks
Secure HTTP Header Settings
Secure TLS certificate validation
Protected Against GraphQL Alias Brute Forcing
Secure HTTP Header Setting: Secure Referrer Policy
Protected Against GraphQL Alias Overloading
Secure Cross-Origin Resource Sharing (CORS) Policy
Protected Against GraphQL Circular Fragments
Protected Against GraphQL Directive Overloading
Enforcer proper authentication
Protected Against GraphQL Batch Query Attacks
Protected Against HTTP Method Manipulation
Secure Content Security Policy
Protected Against GraphQL Circular References
Assign a unique name and/or number for identifying and tracking user identity
Secure Cookie Implementation
Secure HTTP Strict Transport Security (HSTS) Implementation
Strict-Transport-Security (HSTS) not enforced
Insecure HTTP Header Setting: HTTP Strict Transport Security (HSTS)
Insecure HTTP Header Setting: X-XSS-Protection Header
Insecure HTTP Header Setting: Content-Type
Insecure HTTP Header Setting: Content Security Policy (CSP)
Cookie missing security attributes
Insecure HTTP Header Setting: X-Frame-Options
Insecure HTTP Header Setting: Insecure Referrer Policy
Insecure HTTP Header Setting
Django Debug Mode Enabled
Username enumeration
GraphQL Tracing Enabled
HTTP Method Manipulation in GraphQL
Brute Force Login Using Alias Batching in GraphQL API
Secret information transmitted over the network
GraphQL Authorization Misconfiguration
CRIME Attack on TLS Compression
DROWN Attack on SSLv2/TLS
Lucky Thirteen Vulnerability in SSL/TLS
SWEET32 Attack on 64-bit Block Ciphers
SSL/TLS Certificate Hostname Mismatch
CERTIFICATE_EXPIRED
Weak Cryptographic Key and Signature Algorithm in SSL/TLS Certificate
FREAK Attack on Export-Grade RSA
Backdoored Cryptographic Algorithms in SSL
BEAST Attack on TLS 1.0/SSL 3.0
Forward Secrecy Not Implemented
LOGJAM Common Prime Vulnerability
Ticketbleed Memory Disclosure in F5 BIG-IP
TLS Client-Initiated Renegotiation DoS Vulnerability
Outdated SSL/TLS Protocols Supported
ALPACA Attack in SSL/TLS
BREACH Attack on HTTP Compression
LOGJAM Attack on Diffie-Hellman
Insecure TLS Renegotiation (CVE-2009-3555)
POODLE Attack on SSL 3.0
CCS Injection Attack on OpenSSL
Weak Cipher Suites Supported
Raccoon Attack on SSL/TLS
Weak Message Authentication Code (MAC) Algorithms Supported
TLS_FALLBACK_SCSV Not Supported
SSL Extension Bleed Vulnerability
Bleichenbacher Attack on RSA Encryption
SSL/TLS Certificates Expiring Soon
FAQ
