SLRFA
SLRFA is the Salesforce Lightning Request Fuzzer & Analyzer. It helps security engineers inspect captured Aura requests, build new ones, and test Salesforce instances they own or are explicitly authorized to assess.
See the request. Shape the test.
Decode the URL-encoded message in a captured Aura request and inspect its actions, descriptors, and parameters. Edit the parameters, re-encode the body, or start from built-in templates for standard controllers and custom Apex methods.
Investigate the Aura surface
The toolkit includes a vulnerability scanner, a SOQL-injection payload builder, session extraction and validation, and JavaScript analysis for object names, field names, Apex references, and embedded queries. Experience Cloud tools support endpoint discovery and guest-access testing.
Scan controls include a request cap, configurable delay, and timeout. Findings can be exported as HTML, JSON, XML, CSV, or Markdown using the reporting templates.
CLI, web UI, or Python package
Use slrfa.py from the command line, launch the Flask interface with web_server.py, or import the slrfa package in your own Python workflow. The web interface includes a request parser, templates, and a guided assessment view with live progress.
Start locally
Follow the repository installation instructions, then inspect the command help or launch the local web interface:
python slrfa.py --help
python slrfa.py examples
python web_server.pyThe documented web-interface default is http://127.0.0.1:5000. The repository provides setup instructions, the command reference, and advanced usage examples.
MIT licensed. For authorized security testing, defensive self-assessment, and education only. Test systems you own or have explicit written permission to assess, respect rate limits, and avoid accessing real personal data. The web UI is intended to run locally and is not hardened for public internet exposure. This portfolio only links to the project; it does not run scans, collect sessions, or send requests to Salesforce.
