Skip to main content

Control efficacy - Breach & Attack Simulation

Path: /bas, and the Control efficacy tab of an Autonomous Pentest.

A vulnerability scan tells you whether an application is exploitable. Breach & Attack Simulation asks a different question: when a known attack shape hits your perimeter, does a control actually stop it? It measures whether your WAF, rate-limiter or auth layer intercepts an attack - not whether the app behind it is vulnerable.

How it works​

BAS replays the shape of 14 attack techniques against a target URL. Each is a single GET request carrying one inert marker parameter (the literal string bas-probe):

SQL injection, reflected XSS, path traversal, OS command injection, Log4Shell / JNDI, SSRF, NoSQL injection, SSTI, XXE, LDAP injection, open redirect, CRLF / response splitting, Shellshock, and insecure deserialization.

For each shape it classifies the response:

  • Blocked - a 401/403/406/419/429/451/501, or a WAF signature in the body (Cloudflare, Incapsula, Akamai, mod_security, "access denied", a captcha). The control fired.
  • Rate-limited (429) - the control fired.
  • Passed - no control fired and the bas-probe marker was reflected back: a genuine gap where the shape reached the application untouched.
  • Inconclusive - the endpoint simply ignored the parameter. This is excluded from scoring, so BAS never over-claims a gap.

The result is a control-efficacy percentage (intercepted ÷ measured), a split bar, a plain-English verdict, and a per-shape table.

Safe by design​

BAS is read-only and non-destructive. Every request is a GET, and every payload carries the inert bas-probe marker so it does nothing real - 1' OR '1'='1' -- bas-probe reads no data, <bas-probe onerror=1> runs no script, ../../../bas-probe targets a leaf that does not exist. The User-Agent identifies itself as apPosture-BAS/1.0 (benign control test).

Running a simulation​

  1. Open Control efficacy (BAS) (standalone at /bas, or the tab on a pentest).
  2. Enter the target URL.
  3. Tick the authorization checkbox - "I am authorized to test this target. Only benign, non-destructive marker requests are sent."
  4. Run simulation.

The endpoint requires the run scans permission, and the service refuses to run without the authorization consent.

note

Run BAS inside an Autonomous Pentest's Control-efficacy tab to see each control gap in the context of that scan's own confirmed findings.