Skip to main content

Findings

A black-box pentest detects vulnerabilities you can reach over HTTP. For each confirmed issue, AISafe stores the complete request and response as content-addressed evidence and links the finding to that captured exchange.

Categories detected​

The agents test OWASP Top 10 categories and the application's specific logic:

  • Injection: SQL injection, command injection, template injection, and cross-site scripting (reflected, stored, DOM-based). The agents craft payloads that demonstrate the injection and capture the response that proves exploitation.
  • Server-side request forgery (SSRF): internal network access through user-controlled URLs. The agents test whether user input can steer outbound requests to internal services.
  • Broken access control: insecure direct object references (IDOR), missing authorization checks, privilege escalation. The agents test whether an authenticated user can reach resources or actions outside their scope.
  • Authentication bypass: session fixation, token manipulation, brute-force susceptibility. The agents probe the authentication mechanism for weaknesses that allow impersonation or session takeover.
  • Information disclosure: verbose errors, exposed debug endpoints, backup files. The agents look for responses that leak details about the application or its infrastructure.
  • Business logic flaws: price manipulation, race conditions in transactions. The agents reason about the intended workflow and look for ways to subvert it for advantage.

Evidence​

Each confirmed finding carries:

  • Proof-of-concept: the observed result and the captured request and response, exactly as they were sent and received, with the full URL, the payload and every header.
  • Reproduction steps: the requests that proved the issue, in order, with the test user each was sent as and what to look for, so you can verify it and hand it to the engineer fixing it.
  • Impact assessment: what an attacker could achieve, grounded in the observed response. This helps you rank the finding against others.
  • Suggested fix: concrete remediation tailored to the vulnerability type and the application's behavior.

Where possible, the agents map each finding to a standard category (CWE or OWASP) for cross-referencing with your existing security tracking and compliance frameworks.

Severity and status​

Each finding carries a severity and a lifecycle status you control.

  • Severity runs from Critical to Info. The discovering agent assigns an initial rating, and the triage pass refines it by exploitability, impact, and context. See Triage: severity levels.
  • Status starts as open and moves through your reviews: confirmed, fixed, false positive, accepted risk, or duplicate. See Triage: finding statuses.

Before triage, AISafe merges candidates whose evidence establishes the same root cause at the same place. In a scan with validator-confirmed live proofs, repeated proofs of the same weakness at the same input and delivery site become one candidate even when different tests found them. A triage agent then re-examines each candidate's evidence, confirms or rejects it, and assigns a confidence score. You make the final decision on every finding. See Triage.

Documentation and Artifacts​

Web application assessments with a recorded live model also provide Documentation and Artifacts. Documentation shows services, entities, data flows, trust boundaries, threats and entry points. Entry-point details include recorded parameters and the responses observed for each role and session.

Artifacts shows coverage by operation and attack class, with confirmed, refuted, inconclusive and unchecked results. Coverage retains the versions tested even when an operation changes or is removed, and shows Needs review when those versions require review. Methodology and Audit record show the recorded rounds, agents, validators, test-user sign-in outcomes and session states. The overviews include HTTP activity and execution counts. A field an older run did not record stays absent, and assessments without source do not show source-file charts or code spans.