Skip to main content

Findings

A black-box pentest detects vulnerabilities you can reach over HTTP. For each confirmed issue, the agents capture the exact request that triggers it and the response that proves it, so you can replay and verify.

Categories detected​

The agents test OWASP Top 10 categories and the application's specific logic:

  • Injection: SQL injection, command injection, template injection, and cross-site scripting (reflected, stored, DOM-based). The agents craft payloads that demonstrate the injection and capture the response that proves exploitation.
  • Server-side request forgery (SSRF): internal network access through user-controlled URLs. The agents test whether user input can steer outbound requests to internal services.
  • Broken access control: insecure direct object references (IDOR), missing authorization checks, privilege escalation. The agents test whether an authenticated user can reach resources or actions outside their scope.
  • Authentication bypass: session fixation, token manipulation, brute-force susceptibility. The agents probe the authentication mechanism for weaknesses that allow impersonation or session takeover.
  • Information disclosure: verbose errors, exposed debug endpoints, backup files. The agents look for responses that leak details about the application or its infrastructure.
  • Business logic flaws: price manipulation, race conditions in transactions. The agents reason about the intended workflow and look for ways to subvert it for advantage.

Evidence​

Each confirmed finding carries:

  • Proof-of-concept: the exact HTTP request (method, URL, headers, body) that triggers the vulnerability, plus the response that shows exploitation. You can replay the request to verify the issue.
  • Reproduction steps: a clear, step-by-step description of how to reproduce the issue, so you can verify it and hand it to the engineer fixing it.
  • Impact assessment: what an attacker could achieve, grounded in the observed response. This helps you rank the finding against others.
  • Suggested fix: concrete remediation tailored to the vulnerability type and the application's behavior.

Where possible, the agents map each finding to a standard category (CWE or OWASP) for cross-referencing with your existing security tracking and compliance frameworks.

Severity and status​

Each finding carries a severity and a lifecycle status you control.

  • Severity runs from Critical to Info. The discovering agent assigns an initial rating, and the triage pass refines it by exploitability, impact, and context. See Triage: severity levels.
  • Status starts as open and moves through your reviews: confirmed, fixed, false positive, accepted risk, or duplicate. See Triage: finding statuses.

A triage agent re-examines every finding, confirms or rejects it, deduplicates by root cause, and assigns a confidence score to keep the false-positive rate low. You keep final control. See Triage.