Focused diagnostics
Security tools
Run focused security checks with verdicts, measured values, evidence and exact fixes. Every tool is available in the browser and through the public SysGlass API.
TLS Configuration Audit
Free TLS configuration audit. Test a server for Heartbleed, POODLE, DROWN, FREAK, Logjam, Sweet32, BEAST and CCS Injection, plus OCSP/CRL certificate revocation — with a clear verdict and fixes.
Input: example.com[:443]
Exposed Files Check
Free exposed files check. Check a website for publicly readable .env, .git, .svn/.hg, Spring Boot Actuator, Tomcat Manager, phpinfo, server-status and swagger files that leak secrets and source code — with a fix.
Input: https://example.com
CORS Configuration Audit
Free CORS configuration audit. Test whether a website or API reflects an arbitrary Origin, trusts the null origin, allows credentials, or has a bypassable allowlist — the cross-origin bugs that let any site read your authenticated responses.
Input: https://api.example.com
Open Redirect Check
Free open redirect check. Test whether a login, logout or tracking endpoint lets a request parameter (next, url, redirect_uri, return…) send visitors to an arbitrary external site — the flaw behind phishing links and OAuth token theft.
Input: https://example.com/login?next=/home
GraphQL Exposure Audit
Free GraphQL exposure audit. Check whether a GraphQL API still has schema introspection enabled in production or leaves an interactive GraphiQL / Apollo Playground IDE exposed — and how to lock both down.
Input: https://api.example.com or https://api.example.com/graphql
CVE Lookup
Free CVE lookup. Enter a product and version (or a CPE) and see the known CVEs published for it, each with its CVSS score, severity and a link to the NVD record. Data comes from the public NVD vulnerability feed.
Input: nginx, or cpe:2.3:a:nginx:nginx:1.24.0:*:*:*:*:*:*:*
IP / Host Exposure Audit
Free live IP/host exposure scan. Enter an IP or hostname and SysGlass scans it in real time and shows what is actually exposed: open ports, the detected service and version on each, the CVEs it's affected by (confirmed-exposed vs version-vulnerable), DDoS-amplification vectors, exposed gateways/admin panels, and TLS/header issues — with exact fixes.
Input: 1.2.3.4 or host.example.com