Crawls a web application and fuzzes the endpoints and forms it discovers. A three-step pipeline: a Playwright-based crawler explores pages and DOM states (with support for authenticated sessions), a fuzzer runs SecLists payloads against the discovered endpoints and form fields, and a triage step sorts the findings into vulnerability classes. Evaluated against OWASP Juice Shop, where it reliably detects (No)SQL injections.
Tech stack: Python, Playwright, ffuf, SecLists