HARVESTOR
authorized SQL injection assessment · closed environment
Access token required
This harvestor instance is protected. Enter the access token to continue.
Unlock
New scan
Target URL
Session
(optional — cookie string or Authorization header; asked for automatically if the site requires login)
Engines
(optional — extra technique engines, comma-separated: nosql, graphql, jwt, xxe, ldap, ssti, xpath, odata, sparql, hql, xslt — one scan task each)
Collectors
(optional — exposure collectors, comma-separated: storage, infoleak, bola, graphql, jwt)
thorough
(level 3 + time-based tests — much slower)
full harvest
(caps off — dumps everything; credential values extracted, encrypted)
auto-auth
(log in automatically from the login profiles when a login wall appears)
JS endpoints
(harvest API endpoints from the target's own JavaScript, probe + test them)
Scan
Scan
preflight
collectors
JS endpoints
detect
enumerate
PII hunt
done
🔒
This site requires login.
Paste a valid session into the Session field above, then
Attach session & resume
Stop scan
Live log
Finding
PII exposed
— what a breach of this database would leak
Extracted schema & data
Export harvest (JSON)
Export PII (CSV)
Recent scans