Recon Scanner

The Recon Scanner (its in-app heading reads Security Scanner) is a tabbed tool picker. You choose one of six tools, type a target, and press Scan. Five of the tools are read-only lookups served by /api/scanner/lookup; the sixth, the Web Scanner, runs through /api/webscan and saves its results. Every endpoint requires a signed-in session and returns 401 Unauthorized otherwise.

The six tools

Pick a tool from the row of tiles at the top, then enter a target. Each tool ships example inputs you can click to pre-fill the box, and pressing Enter runs the scan.

DNS Lookup

Enter a domain (e.g. google.com). The tool queries all six record types in parallel and groups the answers by type, showing each record's value and TTL.

IP Intelligence

Enter an IPv4 address (e.g. 8.8.8.8). Results show city/region/country, ISP, org, ASN and ASN name, timezone, coordinates, reverse DNS, and ZIP, with coloured badges when the address is flagged as PROXY/VPN, HOSTING, or MOBILE.

HTTP/TLS Headers

Enter a hostname (e.g. github.com). The tool makes a HEAD request over HTTPS and checks five controls: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options: nosniff, and whether CORS is not wildcard-open. Each present control adds 20 points to the security score (max 100). It also surfaces the Server and X-Powered-By headers.

CVE Search

Enter a product/keyword such as log4j or a CVE ID such as CVE-2021-44228. Up to 10 matches are returned, each with its CVSS v3.1 base score, severity label, description, and up to three reference links (the CVE ID links out to its NVD detail page). Repeat searches are served from a 10-minute in-memory cache.

Port Reference

Enter a comma-separated list (e.g. 22,80,443,3389), a range with a dash, or the keyword all/top to dump the full well-known-port table. For each port you get a service name and a risk note (Critical/High/Medium/Low/Info). This is a reference lookup only — it does not open any sockets or test whether a port is actually open.

Web Scanner

Enter a full URL (e.g. https://example.com) and press Scan to run a passive scan (see the next section). An optional checkbox, Enable Active Fuzzing (SQLi / XSS probes), adds two lightweight injection probes. When no result is open, this tab also lists your recent Web Scan History; clicking a row re-opens that scan's findings.

The Web Scanner performs read-only HTTP checks for misconfigurations and information disclosure — the same class of checks as SecurityHeaders.com or Mozilla Observatory. Each run is saved as a scan record scoped to your organisation and written to the audit log (webscan.run).

What it checks

• Security headers — flags missing HSTS, CSP, X-Frame-Options (or CSP frame-ancestors), and X-Content-Type-Options: nosniff, plus wildcard CORS and version-disclosing Server / X-Powered-By headers.
• Cookie flags — flags Set-Cookie values missing Secure, HttpOnly, or SameSite.
• Transport — flags a target served over plain http:// instead of HTTPS.
• Exposed paths — GET-probes a fixed list of sensitive paths: /.git/config, /.env, /.aws/credentials, /wp-config.php.bak, /server-status, /phpinfo.php, /.DS_Store, and notes /.well-known/security.txt as a positive if present.

Active fuzzing (optional)

When Active Fuzzing is enabled, the scanner appends a SQL-injection payload and an HTML-script payload to the q and id query parameters. It reports a possible SQLi if the response returns HTTP 5xx, and reflected XSS only if the exact payload is echoed back unencoded. These are deliberately basic heuristics, not full exploitation.

Risk score

Each finding contributes points by severity; the total is capped at 100.

Both endpoints are session-authenticated app routes — call them from a signed-in session.

Lookups — GET /api/scanner/lookup

Takes type (dns | ip | ssl | cve | ports) and q (the target). Both are required; a missing value returns 400.

curl "https://portal.guardfoxsecurity.com/api/scanner/lookup?type=cve&q=log4j"

The CVE search returns total and a cves array of { id, description, cvss, severity, refs[] }; cvss is null and severity is UNKNOWN when no CVSS v3.1 metric is published. NVD's free tier is rate-limited — a 429 means you hit the limit; an optional NVD_API_KEY environment variable raises it.

Web scan — POST /api/webscan

Body takes url (required) and optional activeScan (boolean). On success it returns 201 with the saved scan record: id, targetUrl, status, riskScore, findings[], scannedBy, and createdAt.

curl -X POST https://portal.guardfoxsecurity.com/api/webscan \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com","activeScan":false}'

Scan history — GET /api/webscan

Returns your organisation's 50 most recent scans, newest first. This is what powers the Web Scan History list in the UI.

curl "https://portal.guardfoxsecurity.com/api/webscan"