surisc Find what your frontend hides.
About Features Installation Usage

Usage

Running scans and interpreting results.

Basic scan

Perform a full reconnaissance scan against a target URL.

# Basic reconnaissance scan
surisc -u https://example.com

# JSON output for programmatic consumption
surisc -u https://example.com -o json

Security profiling

The -i flag skips secret scanning and focuses on target profiling. Supported scopes:

  • -i or -i all All informative sections
  • -i webinfo Infrastructure, security headers, API specs, GraphQL introspection
  • -i routes Discovered routes, hidden path probes, API spec references
  • -i robots robots.txt audit
  • -i sitemaps sitemap.xml audit
surisc -u https://example.com -i
surisc -u https://example.com -i webinfo
surisc -u https://example.com -i routes
surisc -u https://example.com -i robots
surisc -u https://example.com -i sitemaps

New in v2.3.0: Frontend security auditing checks CSP, CORS, cookies, SRI, XSS, open redirect, insecure forms, and vulnerable CDN libraries. Response headers are also scanned for exposed API keys and secrets. Client-side storage references (localStorage, sessionStorage, IndexedDB) are inspected for stored tokens. Results appear in the webinfo table.

Example output

surisc Completed. Results:
--------------------------------------------------------------------------------
[!]     [GOOGLE_API_KEY]
        [SOURCE_URL]: https://example.com/assets/index.js
        [GRAVITY_SCORE]: 9.00
        [SNIPPET]: AIzaSyBLT...