Offline application security scanner

Find what’s exploitable.
Prove nothing left the building.

Rassed crawls a target, maps its attack surface, and actively tests it for nineteen classes of vulnerability. Every request, every finding and every report stays on the machine that ran the scan — there is no phone-home, no telemetry, and no cloud account.

Runs locally, offline
Multi-target scans
Proof of concept included
Remediation guidance
Scheduled scans
Four scan profiles

Request a demo

Vulnerability classes tested: 19Vulnerability classes tested
Scan profiles: 4Scan profiles
Confidence grades: 2Confidence grades
Outbound connections: 0Outbound connections

It maps the attack surface before testing it

Rassed crawls the target, following links, forms and API routes, and extracts the endpoints and injectable parameters it finds. What gets tested is built from that inventory — not from a list of paths someone assumed would be there.

Scans

Running now

Findings

Endpoints

Active scansAll scans →

RUNNINGlocalhost:3001Full scan · 27%6
SUCCEEDEDlocalhost:3001Full scan · 2m 01s47

Severity distribution

53FINDINGS

Critical7
High6
Medium20
Low20

Inventory — discovered endpoints and parameters

It tests, rather than inferring from banners

Nothing is concluded from a version number or a response header: the payload goes out and the response comes back. What reaches you is what actually worked against your target, classified by severity and type — not a list of things that might be true of whatever is installed.

Distribution

CRITICAL4
HIGH3
MEDIUM20
LOW20
INFO0

TOTAL FINDINGS47

SEVERITYTYPEFINDING

▮ CRITICALCommand Injectioncmd_injection — body "host"

▮ CRITICALSQL Injectionsqli — query "id"

▮ CRITICALSQL Injectionsqli — body "password"

▮ HIGHPath Traversalpath_traversal — query "path"

▮ HIGHReflected XSSxss_reflected — query "q"

▮ MEDIUMCORS Misconfigurationcors_misconfig — /api/comments

▮ LOWSecurity Headersmissing_header — x-content-type-options

Findings — 47 results, one assessment

Every finding carries what proves it

Each result shows the payload that triggered it, the request verbatim, the injection point, the reflected output that proves execution, and a confidence grade separating the proven from what needs a look. A reviewer can reproduce it from the report alone.

Command Injection

cmd_injection — body "host"

▮ CRITICAL

CMD_INJECTIONfirm

TYPECommand Injection

ENDPOINTPOST http://localhost:3001/api/debug/ping

PARAMETERhost (body)

SEVERITYCritical

CONFIDENCEFirm

EVIDENCE · 2

PAYLOAD ⧉ Copy

& set /a 28001*29033

REQUEST ⧉ Copy

POST http://localhost:3001/api/debug/ping [body:host]

parameter "host" was concatenated into a server-side shell command; the injected command executed and its output 812953033 was reflected — OS command injection

◎ GENERAL GUIDANCE

Avoid shells; pass arguments as an argv array to a fixed executable and validate input strictly.

Finding detail — payload, request, evidence

“No vulnerabilities” is a verdict it has to earn

A run that hit a coverage budget, lost a capability to a failed step, or was cancelled mid-flight is reported as exactly that. Rassed only issues a clean verdict when the run both finished and covered its target — an absence of findings from a scan that stopped looking is not a clean result.

localhost:3001SUCCEEDED

WORKFLOW: full_scan
CAPABILITIES: 19 / 19 executed
COVERAGE: complete · 20 endpoints
FINDINGS: 0

◉ VERDICT ISSUEDThe run finished and covered its target, so an empty result means what it says.

staging.internalTRUNCATED

WORKFLOW: full_scan
CAPABILITIES: 14 / 19 executed
COVERAGE: budget reached · 11 of 34
FINDINGS: 3

◉ VERDICT WITHHELDFive capabilities never ran and most of the surface went untested. No clean result is claimed.

Run state — coverage declared with every scan

What Rassed tests for

Nineteen classes of vulnerability

Each class is a capability in its own right: it sends its own payloads and verifies their effect, and can run inside the full profile or on its own against a single endpoint.

SQL injection
Reflected XSS
Command injection
Path traversal
SSRF
Template injection (SSTI)
XML entities (XXE)
LDAP injection
XPath injection
NoSQL injection
CRLF injection
SSI injection
Open redirect
CORS misconfiguration
Host header injection
JWT weaknesses
Security headers
Error disclosure
Secret exposure

How findings are graded

Four severities, two confidence grades

Critical

Execution on the server or direct access to data: SQL injection, OS command injection. An exploitation path proven by reflected output.

High

Reading files outside the intended scope, or execution in a victim’s browser: path traversal, reflected XSS.

Medium

Configuration weakness that opens the door to a chained attack: CORS misconfiguration, SSRF, host header injection.

Low

Missing hardening that raises the impact of something else: absent security headers, error disclosure.

Alongside severity, every finding carries a confidence grade: firm where the reflected effect proves execution, tentative where behaviour indicates the flaw without settling it. The two are never mixed into the same list.

Scan profiles

From a quick pass to an entire estate

Full scan

A complete crawl, then all nineteen capabilities against every endpoint and parameter discovered. What a formal assessment runs.

Quick pass

A shallow crawl and only the highest-yield capabilities, to catch the serious mistakes before a release.

Reconnaissance only

Map the attack surface without sending a single payload — an inventory of endpoints and parameters to agree scope against before testing.

Single capability

One class against one endpoint, to verify a fix or chase an effect after a change.

Scan groups fan the same profile across many targets and merge what comes back into one report for the whole estate. And any profile can be scheduled to run on its own at a regular interval, so the verdict stays current without someone starting each scan by hand.

What comes out of a scan

Five formats from the same run

The report is not an abridged summary: every finding leaves with its payload, its request, its evidence and its grade, and every export states its own coverage — if a run was truncated it says so on its face, in the same words the console uses.

pdf

The document that gets filed

A PDF printed from the same document you read on screen, with the Arabic typeface embedded so it opens as designed anywhere.

html

A report sent as it is

A self-contained HTML page with no external resources, which opens on any machine with no connection.

json

The finding, in full

JSON carrying every finding with its payload, request and evidence, plus the exact run configuration — for your tooling and dashboards.

sarif

Inside your platform

SARIF 2.1.0 uploads into code scanning on GitHub or GitLab, so findings appear where the team already works.

csv

For the spreadsheet

CSV with a UTF-8 byte-order mark, so Arabic opens straight into Excel instead of arriving as mojibake.

How it works

1
Set the target and the scope
One address or a group, session credentials if the scan is authenticated, and boundaries the crawl will not cross.
2
Run the workflow that fits
A crawl maps the attack surface, then capabilities test it payload by payload, with every step recorded on the machine.
3
Receive reproducible results
Every finding with its evidence and its grade, and a report that states what the run covered and what it did not.

Run Rassed against a single target

Write to us and we will arrange a live walkthrough on your own environment, or a trial build that runs offline on your machine.

sales@safina.sa

Rassed — application security scanner · Developed by Safina, Jeddah

Find what’s exploitable.Prove nothing left the building.