Gray-Box Across Architectures (SPA, SSR, MPA)

Why architecture matters for gray-box

Gray-box testing (IDOR/BOLA, broken access control, injection, CSRF) needs a request surface to replay and mutate. Where that surface lives depends entirely on how the app is built — and a scanner that only understands one architecture will quietly find nothing on the others:

• Single-Page App (SPA) — React/Vue/Angular/Svelte. The browser makes fetch/XHR calls to an API; that JSON traffic is the surface.
• Server-Rendered (SSR) — Next.js SSR, Nuxt, Rails, Django, Laravel, WordPress. The app makes its data calls server-side, so the browser makes no API calls to observe. The surface is the parameterized page URLs (/invoice/4012) and HTML forms.
• Multi-Page App (MPA) — classic server-rendered, no JS framework. Same surface as SSR: links, page URLs, and forms.
• Hybrid — server-rendered pages plus a client API (common with modern Next.js). Both surfaces.

Sectora detects the architecture and tests the right surface for each. A correctly authenticated scan of a server-rendered app is no longer an empty result — it tests object-scoped page URLs and forms instead of looking for API calls that don't exist.

What gets tested, per architecture

Server-rendered (SSR / MPA)

• IDOR / BOLA + broken access control — every crawled (or recorded) page URL that carries an object identifier (/invoice/4012, ?account=77, a UUID) is fetched as your session, then replayed (a) with no session, and (b) as a configured second identity. If a protected object is served to an anonymous user, or a second user can read the first user's object, that's a finding — confirmed by comparing the actual page content, double-checked, and gated to avoid flagging public pages.
• XSS & SQL injection via forms — HTML forms are the SSR app's state-changing surface. Sectora submits marked payloads through form fields and flags reflected XSS (payload echoed unencoded) and error-based SQL injection (a SQL error the benign control submission didn't produce).
• CSRF — state-changing forms with no anti-CSRF token are surfaced for review.
• Plus the always-on checks: parameter injection, security headers, TLS, and the Nuclei template engine.

Single-page / hybrid

• The authenticated client-side API calls captured during the crawl drive IDOR/BOLA, broken-access-control, and injection testing against the API — plus everything above where forms/pages also exist.

Reading the coverage report

Every scan now shows a Scan coverage card so a 0-finding result is never ambiguous. It states the detected architecture, whether the scan was authenticated, the surface found (pages, forms, client APIs, object-id URLs), the test classes that actually had a surface to run against, and honest notes — for example:

• “Server-rendered app: no client-side API calls exist to capture — IDOR/access-control was tested via page URLs + forms instead (expected, not a gap).”
• “No object-identified page URLs were found — increase crawl depth, or use a recorded browse to capture the authenticated pages.”
• “Ran unauthenticated — IDOR/access-control needs a session; run a gray-box scan.”

If a class shows no coverage, the note tells you exactly how to close the gap.

When to use recorded-browse

The automated crawl reaches what it can follow from the start URL. For surface behind interaction — wizards, dashboards, action-gated flows, or pages the crawler can't discover — use recorded-browse. It captures the exact pages and requests you actually used, and those feed the same gray-box engine: a recorded GET /invoice/42becomes an IDOR/access-control candidate for any architecture, SSR or SPA. It's the most reliable way to maximize coverage on a real app.

Getting the most accurate result

• Run authenticated (gray-box) — import a session or use recorded-browse. IDOR/BOLA/access-control are meaningless without a session.
• For IDOR across users, configure a second identity so Sectora can prove one user can read another's object.
• Increase Max Depth / page cap for large apps, or seed with a recorded browse, so object-scoped pages are reached.
• If the target is behind a WAF/CDN, allow-list Sectora's scanner egress IP so coverage isn't silently throttled.
• Enable aggressive mode (with the ownership acknowledgement) to let Sectora submit POST forms for injection testing — read-only checks run without it.