Cyberlop lists ten vulnerability classes on the profile form: Injection, Xss, Auth, Authz, Ssrf, Crypto, Config, Business-logic, Dependency and Secrets. Tick the classes you want to test, or tick none and the profile scans all ten.
The short version
Ten checkboxes in the Scope section of a scan profile make up the list. Tick none and the profile covers all of them, which is the widest scan you can run on a target and the usual choice for a first full audit. The profile list then shows "All" in the Vuln classes column.
How it works in Cyberlop
Eight of the classes match the eight specialist agents that analyse your code in phase three. Each stays in its own lane, so one weakness is not reported eight times. The other two, Dependency and Secrets, complete the list on the form.
| Class | Covers |
|---|---|
| Injection | SQL, NoSQL, command and template injection, XXE, SSTI, deserialisation |
| Xss | Reflected, stored and DOM cross-site scripting |
| Auth | Login, logout, MFA, OAuth and SSO, JWT lifetime, rate limiting |
| Authz | IDOR, missing ownership or tenant checks, privilege escalation |
| Ssrf | Server-side request forgery |
| Crypto | Weak secrets or keys, wrong algorithm, JWT signing, unsafe comparisons |
| Config | Security headers, CORS, cookies, TLS, error detail, risky defaults |
| Business-logic | Payment, pricing and quota bypass, replay, race conditions, workflow flaws |
| Dependency | Listed on the form; see the note below |
| Secrets | Listed on the form; see the note below |
The in-app documentation describes the first eight in detail. It does not spell out the exact checks behind Dependency and Secrets, so we do not guess here. Ask us if you need that detail.
What to do next
Pick classes by what you want to learn. A narrow set gives a focused run. Leaving the list empty gives the widest run, which suits a first full audit of a new application and takes the longest. To learn about each group, read the Injection class, Auth versus Authz, the Config class and the Business-logic class.
To set them on a profile, follow how to pick vulnerability classes. The longer tutorial is choose vulnerability classes.
Related questions
- How do I choose which vulnerability classes a profile tests?
- How do I make a profile test all vulnerability classes?
- What kinds of injection does the Injection class cover?
- What's the difference between the Auth and Authz classes?
- Does Cyberlop check for exposed secrets and vulnerable dependencies?
Choose vulnerability classes in a Cyberlop scan profile
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.