Confirmed injection testing
SQL injection, XSS, command injection, path traversal and open redirect — validated with differential and timing signals, not guesses.
Local-first · Ethical by design
Find real vulnerabilities, before attackers do.
WebScan Pro is a professional desktop scanner that confirms SQL injection, XSS, IDOR/BOLA and modern SPA / API weaknesses — with low false positives and AI-written, boardroom-ready reports. Your scans run locally, on your machine.
Free plan available · No target data ever leaves your device
42
CRITICALSQL Injection — login form
CVSS 9.1
HIGHReflected XSS — search
CVSS 7.4
MEDIUMMissing security headers
CVSS 5.0
LOWCookie without Secure flag
CVSS 3.1
Runs locally
The scanner lives on your machine. Target data and credentials never touch our servers.
Confirmed findings
Multi-signal verification (error, boolean, timing, execution) keeps false positives low.
Ethical gate
Every scan requires an explicit authorization acknowledgement. Test only what you own.
Capabilities
Built for the way modern apps actually break
From classic injection to single-page apps and JSON/GraphQL APIs — WebScan Pro sees the real attack surface.
Modern SPA & DOM-XSS
A hardened headless browser renders JavaScript, discovers the real surface, and confirms DOM-based XSS by actual execution.
API testing (JSON/GraphQL)
Fuzzes intercepted API endpoints for injection in JSON fields, GraphQL introspection exposure and verbose error leakage.
Authenticated & IDOR/BOLA
Scan behind a login and use a second identity to detect broken object-level authorization — with no guesswork, so no false positives.
AI-written expert reports
A senior-analyst AI writes the executive summary and prioritized remediation, delivered as a branded, signed PDF report.
Adaptive & respectful
Fingerprints WAFs, paces requests, and backs off gracefully — thorough coverage without hammering the target.
Workflow
From target to report in three steps
Authorize & target
Enter a URL you're authorized to test and confirm the ethical acknowledgement. Add a login token for authenticated scans.
Choose a profile
Passive, Active, or Full — from read-only checks to modern SPA/API testing. The engine adapts to what it finds.
Get a signed report
Review confirmed findings in-app and export a professional, AI-written PDF report signed with your researcher identity.
Pricing
Start free. Upgrade when you're ready.
Simple monthly plans. Billing handled securely by Paddle (our Merchant of Record), with global tax included.
Free
$0/ forever
Everything you need to get started with security testing.
- Passive & active scanning
- 5 scans per day
- Professional PDF reports
MOST POPULAR
Pro
$29/ month
The full modern-scanning suite for professionals.
- Everything in Free
- Modern SPA / DOM-XSS scanning
- API (JSON / GraphQL) testing
- Authenticated scans + IDOR/BOLA
- JWT & business-logic + SSRF / secrets / CVE
- Scheduled scans, alerts & scan diff
- 200 scans per day
Team
$99/ month
Higher limits and throughput for busy teams.
- Everything in Pro
- 2,000 scans per day
- 10 concurrent scans
Security & ethics
A powerful tool, used responsibly
WebScan Pro is engineered for authorized security testing. We keep you in control and on the right side of the line.
- Local execution. Scans never run from our infrastructure — a deliberate safeguard against misuse.
- Explicit authorization. Each scan requires you to confirm you're permitted to test the target.
- Credential safety. Auth tokens are sent only to your local engine and are never stored or transmitted to us.
- Hardened by design. SSRF classification, DNS pinning, strict input validation and rate limiting throughout.
Our cloud only handles licensing
The account service issues your identity and plan entitlements — nothing more. It never receives scan targets, requests or results.
AccountIdentity & entitlements
Never sentTargets, payloads, results
FAQ
Frequently asked questions
Is it legal to use WebScan Pro?
Yes — when you scan systems you own or have explicit written permission to test. Unauthorized scanning is illegal in most jurisdictions. WebScan Pro requires you to acknowledge authorization before every scan.
Where do scans run?
Entirely on your own machine. The scanner is a local desktop engine. Our cloud only manages your account and subscription — it never sees your targets or results.
Which platforms are supported?
WebScan Pro ships for Windows today, with the desktop app downloaded from this site. You sign in with your account to unlock your plan's features.
How does billing work?
Subscriptions are handled by Paddle, our Merchant of Record, which processes payments and global sales tax/VAT on our behalf. You can cancel anytime from your account.
Do you offer a free plan?
Yes. The Free plan includes passive and active scanning, PDF reports and 5 scans per day — no credit card required.
Ship more secure software
Download WebScan Pro and run your first authorized scan in minutes.