> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/pentests.md).

# Pentests

## Overview

Nullify runs continuous, hands-off penetration tests as a deep assessment of your deployed applications. These tests find authentication, authorization, and business-logic flaws by actively exploiting the weaknesses Nullify already understands from reviewing your code — using the knowledge model it builds from your codebase, dependencies, and cloud. Nullify maps endpoints, replays authenticated flows, crafts payloads informed by code-level context, and validates exploit chains with reproduction evidence.

Where a [Bug Hunt](/capabilities/bug-hunts.md) watches your external surface for exposure, a Pentest goes deep on a known application and *proves* what's exploitable.

## Triggering Pentests

Pentests run on demand — start one against a specific application whenever you need it, with full control over the scan parameters and results tracked in real time. Teams typically trigger a pentest on new application deployments, major feature releases, [Security Program Management](/capabilities/program-management.md) campaigns, or to validate a remediation.

## Supported Application Types

Nullify pentests **REST and GraphQL APIs**:

### REST APIs

* OpenAPI/Swagger schema-based testing.
* Automatic schema discovery (checks common locations such as `/openapi.json`, `/swagger.json`, `/api-docs`).
* Fuzzing of path parameters, query strings, and request bodies.
* Intelligent, schema-aware API testing that combines targeted vulnerability probing with Nullify's own reasoning agents.

### GraphQL APIs

* Introspection query analysis.
* Mutation and query testing.
* Schema-based attack generation.
* Authorization-matrix testing across resolvers.

## Authenticated Testing

Nullify supports comprehensive authenticated pentest workflows:

### Authentication Methods

* **Bearer Tokens**: JWT, OAuth2 access tokens
* **Basic Auth**: Username/password pairs
* **OAuth Flows**: Authorization code, client credentials
* **Custom Headers**: API keys, custom authentication schemes
* **Login Flows**: POST to a login endpoint with credentials

### Single-User Testing

Tests authenticated endpoints with a single user context:

```yaml
auth:
  method: "bearer"
  token: "${API_TOKEN}"
  headers:
    X-API-Key: "${API_KEY}"
```

### Authorization Matrix Testing

Tests access control across multiple user roles:

```yaml
auth:
  users:
    - role: "admin"
      method: "bearer"
      token: "${ADMIN_TOKEN}"
    - role: "user"
      method: "bearer"
      token: "${USER_TOKEN}"
    - role: "readonly"
      method: "bearer"
      token: "${READONLY_TOKEN}"
```

**Matrix Analysis**:

* Validates each role can only reach the endpoints it should.
* Detects privilege-escalation opportunities.
* Identifies broken access control (IDOR, vertical/horizontal escalation).
* Tests for missing authorization checks.

### Pre-Authentication Validation

Before testing begins, Nullify:

1. Authenticates all configured users.
2. **Fails fast** if any user cannot authenticate.
3. Confirms tokens/credentials are valid.
4. Maintains authenticated sessions throughout testing.

## Request Chaining & Exploit Validation

Nullify validates vulnerabilities through multi-stage exploitation rather than reporting theory:

### Stateful Session Management

* Preserves authentication context throughout a chain.
* Tracks session state and cookies.
* Supports multi-step workflows.

### Fuzzing

* Substitutes fuzz tokens across URLs, headers, query params, and bodies.
* Supports custom wordlists for targeted fuzzing.
* Analyzes responses for status, size, and timing anomalies.

### Exploit Chain Execution

Example multi-stage attack:

1. **Endpoint Discovery** → identify API endpoints via schema.
2. **Parameter Fuzzing** → find injection points.
3. **SQL Injection** → extract database credentials.
4. **Lateral Access** → use credentials to reach admin endpoints.
5. **Data Exfiltration** → demonstrate breach capability.

### Response Analysis & Iteration

* Parses responses (status, headers, body).
* Extracts data from responses for subsequent requests.
* Analyzes error messages for information disclosure.
* Adapts strategy based on application behavior.
* Distinguishes a genuine authorization denial from a dead credential, so it never mistakes a broken test setup for a secure endpoint.

Runtimes vary with the size and complexity of the target; deep exploit chains can run for an extended period.

## Vulnerability Coverage

Pentests validate:

* **Injection Flaws**: SQL, NoSQL, Command, LDAP, XPath
* **Broken Authentication**: Weak passwords, session fixation, token manipulation
* **Broken Authorization**: IDOR, privilege escalation, missing access controls
* **Security Misconfiguration**: Debug mode, default credentials, verbose errors
* **Business Logic Flaws**: Price manipulation, workflow bypass, race conditions
* **SSRF**: Server-side request forgery with cloud metadata access
* **XXE**: XML external entity injection
* **File Upload**: Malicious file upload and execution

## Context from Code Review

Pentests are informed by everything Nullify has already learned:

* **Code review findings** — known injection points and vulnerable patterns are prioritized for testing, and code-level context guides payload selection.
* **Dependency findings** — exploitable CVEs (for example Log4Shell) are validated against the live application.
* **Discovered secrets** — credentials Nullify has found are used for authenticated testing, and their scope and validity are exercised.

## Application Management

Every pentest is associated with an **Application**:

**Application Attributes**:

* Name and description
* One or more instances (URLs/endpoints)
* Business criticality level
* Environment (dev, staging, prod)
* Pre-configured credentials
* Scan preferences

**Instance Configuration**:

* Base URL for testing
* API schema location (file path, URL, or auto-discovery)
* GraphQL endpoint (if applicable)
* Authentication requirements

## Evidence & Reporting

Pentest findings include:

* **Request/Response Pairs**: full HTTP traffic demonstrating the vulnerability.
* **Exploit Steps**: detailed reproduction instructions.
* **Impact Analysis**: business impact and blast radius.
* **Fix Guidance**: specific remediation recommendations.
* **Screenshots**: visual proof of exploitation where applicable.
* **Video Recordings**: a walkthrough of the exploit chain where applicable.

Every reported exploit is independently re-reviewed against the recorded evidence before it reaches you, filtering out false positives such as a denied request that merely returned a 200 — so a Pentest finding means Nullify actually reproduced the issue.

## Safety & Rate Limiting

Pentests respect production stability:

* **Adaptive rate limiting** — backs off if the application shows signs of stress.
* **One run per application** — Nullify won't run overlapping scans against the same application.
* **Timeout handling** — degrades gracefully on slow responses.
* **Emergency stop** — aborts on systemic failures (auth expired, target down).
* **Failure distinction** — separates hypothesis failures from environmental issues.

## Where findings go

Pentest findings flow into the dashboard, Jira and other ticketing with severity-based prioritization, Slack and Teams notifications for critical findings, and [Security Program Management](/capabilities/program-management.md) for campaign-driven remediation. Validated findings are prioritized for [autofix](/capabilities/remediations.md) where a fix applies.

## Configuration

Configure pentests during [Onboarding](/getting-started/getting-started.md):

* **Applications**: define target applications and instances.
* **Credentials**: add authentication credentials for testing.
* **Scope**: specify included/excluded endpoints.

## Pentests vs Bug Hunts

| Aspect        | Bug Hunts                                | Pentests                                          |
| ------------- | ---------------------------------------- | ------------------------------------------------- |
| **Scope**     | External attack surface (domains, IPs)   | Known applications (APIs)                         |
| **Discovery** | Subdomain enumeration, service discovery | API schema analysis, endpoint mapping             |
| **Depth**     | Reconnaissance and exposure detection    | Active exploitation with validated proof          |
| **Evidence**  | Service inventory, exposure detail       | Request/response pairs, reproduced exploit chains |
| **Cadence**   | Continuous, change-only surfacing        | On-demand                                         |