Crawling and Coverage¶

This reference page describes how NodeZero discovers routes and functionality, and how discovery behaves across different application types. (Note that discovered-route visibility is not a guarantee that every route, method, parameter, or vulnerability class was fully tested.)

Route Discovery Behavior¶

NodeZero explores the application the way a human tester would – clicking links, filling and submitting forms, and inspecting JavaScript resources for additional functionality. Discovered coverage depends on the application's reachable states and interaction requirements.

SPA and JavaScript Support¶

SPA and JavaScript frontend support is built into the WebApp test. The crawler uses browser-driven interaction rather than static parsing alone, allowing it to follow client-side navigation and stateful application behavior when those flows can be exercised by the headless browser.

API and UI Route Discovery¶

NodeZero discovers both API endpoints and UI routes through direct interaction with the application, and through analysis of JavaScript resources that might reveal hidden routes or backend endpoints. Discovery does not guarantee that every endpoint is reachable, in scope, authenticated, or fully testable.

Seeded Coverage Inputs¶

NodeZero accepts seed inputs to supplement route discovery. Supported inputs include OpenAPI/Swagger specifications, sitemaps, HAR (HTTP Archive) files, and other endpoint or route inventories.

NodeZero uses these inputs to seed route discovery, test endpoints that may not be linked in the application UI, and compare expected routes against those discovered and tested during the run.

Crawl Depth Behavior¶

NodeZero does not impose a fixed crawl-depth limit. The crawler is intended to discover as much reachable functionality as possible rather than stop at an arbitrary depth threshold. Actual discovery remains dependent on authentication, application state, route reachability, anti-bot controls, and other runtime conditions.