For the complete documentation index, see llms.txt. This page is also available as Markdown.

Pentests

Overview

Nullify runs continuous, hands-off penetration tests as a deep assessment of your deployed applications. These tests find authentication, authorization, and business-logic flaws by actively exploiting the weaknesses Nullify already understands from reviewing your code — using the knowledge model it builds from your codebase, dependencies, and cloud. Nullify maps endpoints, replays authenticated flows, crafts payloads informed by code-level context, and validates exploit chains with reproduction evidence.

Where a Bug Hunt watches your external surface for exposure, a Pentest goes deep on a known application and proves what's exploitable.

Triggering Pentests

Pentests run on demand — start one against a specific application whenever you need it, with full control over the scan parameters and results tracked in real time. Teams typically trigger a pentest on new application deployments, major feature releases, Security Program Management campaigns, or to validate a remediation.

Supported Application Types

Nullify pentests REST and GraphQL APIs:

REST APIs

  • OpenAPI/Swagger schema-based testing.

  • Automatic schema discovery (checks common locations such as /openapi.json, /swagger.json, /api-docs).

  • Fuzzing of path parameters, query strings, and request bodies.

  • Intelligent, schema-aware API testing that combines targeted vulnerability probing with Nullify's own reasoning agents.

GraphQL APIs

  • Introspection query analysis.

  • Mutation and query testing.

  • Schema-based attack generation.

  • Authorization-matrix testing across resolvers.

Authenticated Testing

Nullify supports comprehensive authenticated pentest workflows:

Authentication Methods

  • Bearer Tokens: JWT, OAuth2 access tokens

  • Basic Auth: Username/password pairs

  • OAuth Flows: Authorization code, client credentials

  • Custom Headers: API keys, custom authentication schemes

  • Login Flows: POST to a login endpoint with credentials

Single-User Testing

Tests authenticated endpoints with a single user context:

Authorization Matrix Testing

Tests access control across multiple user roles:

Matrix Analysis:

  • Validates each role can only reach the endpoints it should.

  • Detects privilege-escalation opportunities.

  • Identifies broken access control (IDOR, vertical/horizontal escalation).

  • Tests for missing authorization checks.

Pre-Authentication Validation

Before testing begins, Nullify:

  1. Authenticates all configured users.

  2. Fails fast if any user cannot authenticate.

  3. Confirms tokens/credentials are valid.

  4. Maintains authenticated sessions throughout testing.

Request Chaining & Multi-Stage Exploitation

Nullify validates vulnerabilities through multi-stage exploitation rather than reporting theory:

This section describes exploit chaining within a pentest engagement. It is a different thing from Exploit Validation, the continuous capability that validates individual code findings against your deployed service.

Stateful Session Management

  • Preserves authentication context throughout a chain.

  • Tracks session state and cookies.

  • Supports multi-step workflows.

Fuzzing

  • Substitutes fuzz tokens across URLs, headers, query params, and bodies.

  • Supports custom wordlists for targeted fuzzing.

  • Analyzes responses for status, size, and timing anomalies.

Exploit Chain Execution

Example multi-stage attack:

  1. Endpoint Discovery → identify API endpoints via schema.

  2. Parameter Fuzzing → find injection points.

  3. SQL Injection → extract database credentials.

  4. Lateral Access → use credentials to reach admin endpoints.

  5. Data Exfiltration → demonstrate breach capability.

Response Analysis & Iteration

  • Parses responses (status, headers, body).

  • Extracts data from responses for subsequent requests.

  • Analyzes error messages for information disclosure.

  • Adapts strategy based on application behavior.

  • Distinguishes a genuine authorization denial from a dead credential, so it never mistakes a broken test setup for a secure endpoint.

Runtimes vary with the size and complexity of the target; deep exploit chains can run for an extended period.

This is the exploitation Nullify performs within a single pentest. To prove or disprove an individual code-review or dependency finding on its own — driven by your own policies, without launching a full pentest — see Exploit Validation.

Vulnerability Coverage

Pentests validate:

  • Injection Flaws: SQL, NoSQL, Command, LDAP, XPath

  • Broken Authentication: Weak passwords, session fixation, token manipulation

  • Broken Authorization: IDOR, privilege escalation, missing access controls

  • Security Misconfiguration: Debug mode, default credentials, verbose errors

  • Business Logic Flaws: Price manipulation, workflow bypass, race conditions

  • SSRF: Server-side request forgery with cloud metadata access

  • XXE: XML external entity injection

  • File Upload: Malicious file upload and execution

Context from Code Review

Pentests are informed by everything Nullify has already learned:

  • Code review findings — known injection points and vulnerable patterns are prioritized for testing, and code-level context guides payload selection.

  • Dependency findings — exploitable CVEs (for example Log4Shell) are validated against the live application.

  • Discovered secrets — credentials Nullify has found are used for authenticated testing, and their scope and validity are exercised.

Application Management

Every pentest is associated with an Application:

Application Attributes:

  • Name and description

  • One or more instances (URLs/endpoints)

  • Business criticality level

  • Environment (dev, staging, prod)

  • Pre-configured credentials

  • Scan preferences

Instance Configuration:

  • Base URL for testing

  • API schema location (file path, URL, or auto-discovery)

  • GraphQL endpoint (if applicable)

  • Authentication requirements

Evidence & Reporting

Pentest findings include:

  • Request/Response Pairs: full HTTP traffic demonstrating the vulnerability.

  • Exploit Steps: detailed reproduction instructions.

  • Impact Analysis: business impact and blast radius.

  • Fix Guidance: specific remediation recommendations.

  • Screenshots: visual proof of exploitation where applicable.

  • Video Recordings: a walkthrough of the exploit chain where applicable.

Every reported exploit is independently re-reviewed against the recorded evidence before it reaches you, filtering out false positives such as a denied request that merely returned a 200 — so a Pentest finding means Nullify actually reproduced the issue.

Safety & Rate Limiting

Pentests respect production stability:

  • Adaptive rate limiting — backs off if the application shows signs of stress.

  • One run per application — Nullify won't run overlapping scans against the same application.

  • Timeout handling — degrades gracefully on slow responses.

  • Emergency stop — aborts on systemic failures (auth expired, target down).

  • Failure distinction — separates hypothesis failures from environmental issues.

Where findings go

Pentest findings flow into the dashboard, Jira and other ticketing with severity-based prioritization, Slack and Teams notifications for critical findings, and Security Program Management for campaign-driven remediation. Validated findings are prioritized for autofix where a fix applies.

Configuration

Configure pentests during Onboarding:

  • Applications: define target applications and instances.

  • Credentials: add authentication credentials for testing.

  • Scope: specify included/excluded endpoints.

Pentests vs Bug Hunts

Aspect
Bug Hunts
Pentests

Scope

External attack surface (domains, IPs)

Known applications (APIs)

Discovery

Subdomain enumeration, service discovery

API schema analysis, endpoint mapping

Depth

Reconnaissance and exposure detection

Active exploitation with validated proof

Evidence

Service inventory, exposure detail

Request/response pairs, reproduced exploit chains

Cadence

Continuous, change-only surfacing

On-demand

Last updated