What is Vooki Pro?

What is Vooki Pro?

Vooki Pro is a desktop DAST (dynamic application security testing) scanner for web applications and REST APIs. It runs on your own machine on macOS, Windows and Linux. The scan engine, the vulnerability database, the AI triage and all of your findings stay on that machine, so no scan data leaves your network.

What Vooki Pro does

Vooki Pro covers the whole testing loop in one app:

  1. Define an application. Register a web app or REST API once, tag it as dev, staging or prod, and every scan, finding and report for it collects in one workspace.
  2. Discover the attack surface. Crawl the site, replay a browser recording, or combine both. An optional headless pass captures the background XHR and fetch calls that a plain crawler never sees.
  3. Authenticate. Use a bearer token, basic auth, API key, cookie, form login, OAuth2 client credentials, or a recorded login for SSO flows.
  4. Scan. Choose a policy, from a quick header check to the full catalogue of more than 480 individually selectable checks across 25+ attack categories.
  5. Triage. ThreatLens, an AI model that runs on your machine, demotes likely false positives and spots exposed secrets and personal data.
  6. Retest. When a developer says an issue is fixed, Retest re-runs the exact detector that raised it and returns a verdict.
  7. Report. Export HTML, PDF, Word or JSON reports, or compliance reports mapped to OWASP Top 10, PCI DSS, NIST, ISO 27001, HIPAA, GDPR and SOC 2.

What it tests

Coverage includes injection (SQL, NoSQL, command, XXE, SSTI, LDAP and more), cross-site scripting, broken access control and IDOR, authentication and JWT flaws, cryptographic failures, SSRF, insecure deserialization, information disclosure, business logic, the OWASP API Top 10, security headers and cookies, CSRF, session management, file upload, HTTP protocol attacks, OAuth/OIDC/SAML, prototype pollution, LLM prompt injection, client-side issues and outdated components.

What it does not do

Vooki Pro is DAST only: it tests running web applications and REST APIs. It does not do source-code analysis (SAST), dependency scanning (SCA), network scanning or mobile app scanning. It also has no manual pentest tooling such as a proxy interceptor, repeater or fuzzer. To re-check a finding, you use the automated Retest instead.

Android app scanning is not part of Vooki Pro.

Trial and licensing

Every feature is unlocked for 7 days in the free trial, and no credit card is needed. After that, Vooki Pro is licensed per year and per domain: one domain slot covers a domain and all of its subdomains, with unlimited installs. Email support@vookify.com to request a trial key, telling us whether you need the macOS, Windows or Linux build. See pricing for current plans.

Next steps