Pentests
Overview
Nullify runs continuous, hands-off penetration tests as a deep assessment of your deployed applications. These tests find authentication, authorization, and business-logic flaws by actively exploiting the weaknesses Nullify already understands from reviewing your code — using the knowledge model it builds from your codebase, dependencies, and cloud. Nullify maps endpoints, replays authenticated flows, crafts payloads informed by code-level context, and validates exploit chains with reproduction evidence.
Where a Bug Hunt watches your external surface for exposure, a Pentest goes deep on a known application and proves what's exploitable.
Triggering Pentests
Pentests run on demand — start one against a specific application whenever you need it, with full control over the scan parameters and results tracked in real time. Teams typically trigger a pentest on new application deployments, major feature releases, Security Program Management campaigns, or to validate a remediation.
Supported Application Types
Nullify pentests REST and GraphQL APIs:
REST APIs
OpenAPI/Swagger schema-based testing.
Automatic schema discovery (checks common locations such as
/openapi.json,/swagger.json,/api-docs).Fuzzing of path parameters, query strings, and request bodies.
Intelligent, schema-aware API testing that combines targeted vulnerability probing with Nullify's own reasoning agents.
GraphQL APIs
Introspection query analysis.
Mutation and query testing.
Schema-based attack generation.
Authorization-matrix testing across resolvers.
Authenticated Testing
Nullify supports comprehensive authenticated pentest workflows:
Authentication Methods
Bearer Tokens: JWT, OAuth2 access tokens
Basic Auth: Username/password pairs
OAuth Flows: Authorization code, client credentials
Custom Headers: API keys, custom authentication schemes
Login Flows: POST to a login endpoint with credentials
Single-User Testing
Tests authenticated endpoints with a single user context:
Authorization Matrix Testing
Tests access control across multiple user roles:
Matrix Analysis:
Validates each role can only reach the endpoints it should.
Detects privilege-escalation opportunities.
Identifies broken access control (IDOR, vertical/horizontal escalation).
Tests for missing authorization checks.
Pre-Authentication Validation
Before testing begins, Nullify:
Authenticates all configured users.
Fails fast if any user cannot authenticate.
Confirms tokens/credentials are valid.
Maintains authenticated sessions throughout testing.
Request Chaining & Multi-Stage Exploitation
Nullify validates vulnerabilities through multi-stage exploitation rather than reporting theory:
This section describes exploit chaining within a pentest engagement. It is a different thing from Exploit Validation, the continuous capability that validates individual code findings against your deployed service.
Stateful Session Management
Preserves authentication context throughout a chain.
Tracks session state and cookies.
Supports multi-step workflows.
Fuzzing
Substitutes fuzz tokens across URLs, headers, query params, and bodies.
Supports custom wordlists for targeted fuzzing.
Analyzes responses for status, size, and timing anomalies.
Exploit Chain Execution
Example multi-stage attack:
Endpoint Discovery → identify API endpoints via schema.
Parameter Fuzzing → find injection points.
SQL Injection → extract database credentials.
Lateral Access → use credentials to reach admin endpoints.
Data Exfiltration → demonstrate breach capability.
Response Analysis & Iteration
Parses responses (status, headers, body).
Extracts data from responses for subsequent requests.
Analyzes error messages for information disclosure.
Adapts strategy based on application behavior.
Distinguishes a genuine authorization denial from a dead credential, so it never mistakes a broken test setup for a secure endpoint.
Runtimes vary with the size and complexity of the target; deep exploit chains can run for an extended period.
This is the exploitation Nullify performs within a single pentest. To prove or disprove an individual code-review or dependency finding on its own — driven by your own policies, without launching a full pentest — see Exploit Validation.
Vulnerability Coverage
Pentests validate:
Injection Flaws: SQL, NoSQL, Command, LDAP, XPath
Broken Authentication: Weak passwords, session fixation, token manipulation
Broken Authorization: IDOR, privilege escalation, missing access controls
Security Misconfiguration: Debug mode, default credentials, verbose errors
Business Logic Flaws: Price manipulation, workflow bypass, race conditions
SSRF: Server-side request forgery with cloud metadata access
XXE: XML external entity injection
File Upload: Malicious file upload and execution
Context from Code Review
Pentests are informed by everything Nullify has already learned:
Code review findings — known injection points and vulnerable patterns are prioritized for testing, and code-level context guides payload selection.
Dependency findings — exploitable CVEs (for example Log4Shell) are validated against the live application.
Discovered secrets — credentials Nullify has found are used for authenticated testing, and their scope and validity are exercised.
Application Management
Every pentest is associated with an Application:
Application Attributes:
Name and description
One or more instances (URLs/endpoints)
Business criticality level
Environment (dev, staging, prod)
Pre-configured credentials
Scan preferences
Instance Configuration:
Base URL for testing
API schema location (file path, URL, or auto-discovery)
GraphQL endpoint (if applicable)
Authentication requirements
Evidence & Reporting
Pentest findings include:
Request/Response Pairs: full HTTP traffic demonstrating the vulnerability.
Exploit Steps: detailed reproduction instructions.
Impact Analysis: business impact and blast radius.
Fix Guidance: specific remediation recommendations.
Screenshots: visual proof of exploitation where applicable.
Video Recordings: a walkthrough of the exploit chain where applicable.
Every reported exploit is independently re-reviewed against the recorded evidence before it reaches you, filtering out false positives such as a denied request that merely returned a 200 — so a Pentest finding means Nullify actually reproduced the issue.
Safety & Rate Limiting
Pentests respect production stability:
Adaptive rate limiting — backs off if the application shows signs of stress.
One run per application — Nullify won't run overlapping scans against the same application.
Timeout handling — degrades gracefully on slow responses.
Emergency stop — aborts on systemic failures (auth expired, target down).
Failure distinction — separates hypothesis failures from environmental issues.
Where findings go
Pentest findings flow into the dashboard, Jira and other ticketing with severity-based prioritization, Slack and Teams notifications for critical findings, and Security Program Management for campaign-driven remediation. Validated findings are prioritized for autofix where a fix applies.
Configuration
Configure pentests during Onboarding:
Applications: define target applications and instances.
Credentials: add authentication credentials for testing.
Scope: specify included/excluded endpoints.
Pentests vs Bug Hunts
Scope
External attack surface (domains, IPs)
Known applications (APIs)
Discovery
Subdomain enumeration, service discovery
API schema analysis, endpoint mapping
Depth
Reconnaissance and exposure detection
Active exploitation with validated proof
Evidence
Service inventory, exposure detail
Request/response pairs, reproduced exploit chains
Cadence
Continuous, change-only surfacing
On-demand
Last updated