Security Lab Tools
Browser-based assessment tools for web security education. All scans run server-side — no CORS limitations. Results include live demos and export-ready PDF reports.
Use only for ethical purposes. Scan only systems you own or have written authorization to test. Not for unauthorized use.
ClickjackingTools
UI-Redressing assessment tool. Detects missing X-Frame-Options and CSP frame-ancestors headers, generates live iframe PoC demo, exports PDF report.
Key Features
- Clickjacking header check
- CORS, HSTS, CSP, X-Content-Type
- Referrer & Permissions Policy
- Server version disclosure
- Live PoC iframe demo
- Professional PDF report export
CORS Scanner
CORS misconfiguration scanner. Tests reflected origins, null origin, wildcard, and preflight responses. Shows JavaScript PoC attack code.
Key Features
- Attacker origin reflection test
- Null origin bypass test
- Subdomain prefix check
- OPTIONS preflight test
- JavaScript PoC attack snippet
- Batch scan up to 20 URLs
Headers Audit
Comprehensive security header audit with A+ to F grade. 12 header checks across 5 categories with Apache/Nginx/Express fix code snippets.
Key Features
- A+ to F security grade
- 12 header checks
- Grouped by category
- Apache, Nginx, Express snippets
- Quick-win fixes highlighted
- Batch scan up to 20 URLs
// Which tool should I use?
| Scenario | Recommended Tool |
|---|---|
| Student lab shows "X-Frame-Options missing" vuln | ClickjackingTools |
| Lab API appears to accept any Origin header | CORS Scanner |
| Client wants overall security grade for their site | Headers Audit |
| Class exercise: compare 10 student sites | All tools — batch mode |
| Generate report to hand in / send to client | ClickjackingTools (PDF) |