Skip to main content

Findings

A black-box pentest detects vulnerabilities you can reach over HTTP. For each confirmed issue, AISafe stores the complete request and response as content-addressed evidence and links the finding to that captured exchange.

Categories detected​

The agents test OWASP Top 10 categories and the application's specific logic:

  • Injection: SQL injection, command injection, template injection, and cross-site scripting (reflected, stored, DOM-based). The agents craft payloads that demonstrate the injection and capture the response that proves exploitation.
  • Server-side request forgery (SSRF): internal network access through user-controlled URLs. The agents test whether user input can steer outbound requests to internal services.
  • Broken access control: insecure direct object references (IDOR), missing authorization checks, privilege escalation. The agents test whether an authenticated user can reach resources or actions outside their scope.
  • Authentication bypass: session fixation, token manipulation, brute-force susceptibility. The agents probe the authentication mechanism for weaknesses that allow impersonation or session takeover.
  • Information disclosure: verbose errors, exposed debug endpoints, backup files. The agents look for responses that leak details about the application or its infrastructure.
  • Business logic flaws: price manipulation, race conditions in transactions. The agents reason about the intended workflow and look for ways to subvert it for advantage.

Evidence​

Each confirmed finding carries:

  • Proof-of-concept: the request method and route, the observed result, and a reference to the captured request/response exchange. Sensitive headers are redacted in stored metadata.
  • Reproduction steps: a clear, step-by-step description of how to reproduce the issue, so you can verify it and hand it to the engineer fixing it.
  • Impact assessment: what an attacker could achieve, grounded in the observed response. This helps you rank the finding against others.
  • Suggested fix: concrete remediation tailored to the vulnerability type and the application's behavior.

Where possible, the agents map each finding to a standard category (CWE or OWASP) for cross-referencing with your existing security tracking and compliance frameworks.

Severity and status​

Each finding carries a severity and a lifecycle status you control.

  • Severity runs from Critical to Info. The discovering agent assigns an initial rating, and the triage pass refines it by exploitability, impact, and context. See Triage: severity levels.
  • Status starts as open and moves through your reviews: confirmed, fixed, false positive, accepted risk, or duplicate. See Triage: finding statuses.

A triage agent re-examines every finding, confirms or rejects it, deduplicates by root cause, and assigns a confidence score to keep the false-positive rate low. You keep final control. See Triage.