Module components assert and log entities of security interest about a web application.
Audit modules actively test the web application via inputs like link parameters, forms, cookies and headers in order to assert the existence of security Issues.
Recon modules passively test the web application, mainly analyzing server configuration, responses and looking for directories and files.