Skip to main content

Autonomous Pentest

Path: /scans · Sidebar: Testing → Autonomous Pentest

apPosture's Autonomous Pentest behaves like a human penetration tester: it sends a probe, reads the response, and decides the next payload - instead of replaying a fixed signature list. Every verdict is backed by deterministic proof.

How it differs from a signature scanner​

  • Adaptive, agentic loop - probe → observe → mutate → escalate. A blocked payload is mutated; a dead parameter is swapped; a quote-error is escalated to a timing or out-of-band proof.
  • Proof, not guesses - a finding is raised only when an exploit/leak is confirmed in-band, differentially, or via OAST (off-default out-of-band callback). Arithmetic-eval, benign time-based sleeps and unique markers/nonces are the oracles.
  • Deterministic adjudication - the LLM drives the search, but a deterministic adjudicator (marker / timing / canary) gives the verdict - so it's "here's the proof", not "the model said so". False positives drop sharply.

Safety (dual-use restraint)​

The engine is for authorised testing and is non-destructive by design:

  • benign markers only - no real exploit, no gadget execution, no destructive verbs (DELETE/PUT/transfer);
  • host-pinned, read-only, with a request budget;
  • live/production targets require confirmed authorisation; no DoS / bursting.

What it tests​

Injection (SQLi, command, SSTI, XPath, LDAP, NoSQL), XSS (reflected/DOM/stored), SSRF & cloud-metadata, path traversal/LFI/RFI, deserialization, BOLA/IDOR & business-logic, auth/session flaws, and more - with results merged into the unified findings and back-mapped to the app's threat model coverage.

Running it​

Start a scan and pick a profile (quick / standard / deep); the autonomous pentest phase runs after crawl + active scan and feeds proven findings into the posture. See Scan Results for the proof-of-exploit (PoC request/response) on each finding.

Last updated on