> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/pentests.md).

# Pentests

## Overview

Nullify runs on-demand penetration tests against REST and GraphQL APIs. To configure one, follow [Preparing for an Engagement](/capabilities/pentests/preparing-for-an-engagement.md).

## Triggering Pentests

Pentests run on demand — start one against a specific application whenever you need it, with full control over the scan parameters and results tracked in real time. Teams typically trigger a pentest on new application deployments, major feature releases, [Security Program Management](/capabilities/program-management.md) campaigns, or to validate a remediation.

## Supported Application Types

Nullify pentests **REST and GraphQL APIs**:

### REST APIs

* OpenAPI/Swagger schema-based testing.
* Automatic schema discovery (checks common locations such as `/openapi.json`, `/swagger.json`, `/api-docs`).
* Fuzzing of path parameters, query strings, and request bodies.
* Intelligent, schema-aware API testing that combines targeted vulnerability probing with Nullify's own reasoning agents.

### GraphQL APIs

* Introspection query analysis.
* Query testing.
* Schema-based attack generation.

## Authenticated Testing

### Authentication Methods

* **Bearer Tokens**: JWT, OAuth2 access tokens
* **Basic Auth**: Username/password pairs
* **OAuth 2.0 / OpenID Connect**: settings agreed with Nullify per engagement
* **Custom Headers**: API keys, custom authentication schemes
* **Login Flows**: POST to a login endpoint with credentials

Configure credentials as described in [Preparing for an Engagement](/capabilities/pentests/preparing-for-an-engagement.md#3-identities).

## Request Chaining & Multi-Stage Exploitation

Nullify validates vulnerabilities through multi-stage exploitation rather than reporting theory:

> This section describes exploit chaining *within* a pentest engagement. It is a different thing from [Exploit Validation](/capabilities/pentests/exploit-validation.md), the continuous capability that validates individual code findings against your deployed service.

### Stateful Session Management

* Preserves authentication context throughout a chain.
* Tracks session state and cookies.
* Supports multi-step workflows.

### Fuzzing

* Substitutes fuzz tokens across URLs, headers, query params, and bodies.
* Analyzes responses for status, size, and timing anomalies.

### Exploit Chain Execution

Example multi-stage attack:

1. **Endpoint Discovery** → identify API endpoints via schema.
2. **Parameter Fuzzing** → find injection points.
3. **SQL Injection** → extract database credentials.
4. **Lateral Access** → use credentials to reach admin endpoints.
5. **Data Exfiltration** → demonstrate breach capability.

### Response Analysis & Iteration

* Parses responses (status, headers, body).
* Extracts data from responses for subsequent requests.
* Analyzes error messages for information disclosure.
* Adapts strategy based on application behavior.

Runtimes vary with the size and complexity of the target; deep exploit chains can run for an extended period.

This is the exploitation Nullify performs *within* a single pentest. To prove or disprove an individual code-review or dependency finding on its own — driven by your own policies, without launching a full pentest — see [Exploit Validation](/capabilities/pentests/exploit-validation.md).

## Vulnerability Coverage

Pentests validate:

* **Injection Flaws**: SQL, NoSQL, Command, LDAP, XPath
* **Broken Authentication**: Weak passwords, session fixation, token manipulation
* **Broken Authorization**: IDOR, privilege escalation, missing access controls
* **Security Misconfiguration**: Debug mode, default credentials, verbose errors
* **Business Logic Flaws**: Price manipulation, workflow bypass, race conditions
* **SSRF**: Server-side request forgery with cloud metadata access
* **XXE**: XML external entity injection
* **File Upload**: Malicious file upload and execution

## Context from Code Review

Pentests are informed by everything Nullify has already learned:

* **Code review findings** — known injection points and vulnerable patterns are prioritized for testing, and code-level context guides payload selection.
* **Dependency findings** — exploitable CVEs (for example Log4Shell) are validated against the live application.

## Application Management

Every pentest is associated with an **Application**:

* Name and description
* Targets: host, port and protocol
* Web services: repository and path inside the repository, mapped to targets
* Credentials attached to each web service

## Evidence & Reporting

Pentest findings include:

* **Request/Response Pairs**: full HTTP traffic demonstrating the vulnerability.
* **Exploit Steps**: detailed reproduction instructions.
* **Impact Analysis**: business impact and blast radius.
* **Fix Guidance**: specific remediation recommendations.
* **Screenshots**: visual proof of exploitation where applicable.
* **Video Recordings**: a walkthrough of the exploit chain where applicable.

## Safety

A run can be stopped at any time from the dashboard.

## Where findings go

Review findings in the dashboard. Configure ticketing and notifications as described in [Configuration – General](/configuration/configuration-general.md).

## Configuration

Configure pentests during [Onboarding](/getting-started/getting-started.md):

* **Applications**: define applications and their targets.
* **Credentials**: add authentication credentials for testing.

## Pentests vs Bug Hunts

| Aspect        | Bug Hunts                                | Pentests                                          |
| ------------- | ---------------------------------------- | ------------------------------------------------- |
| **Scope**     | External attack surface (domains, IPs)   | Known applications (APIs)                         |
| **Discovery** | Subdomain enumeration, service discovery | API schema analysis, endpoint mapping             |
| **Depth**     | Reconnaissance and exposure detection    | Active exploitation with validated proof          |
| **Evidence**  | Service inventory, exposure detail       | Request/response pairs, reproduced exploit chains |
| **Cadence**   | Continuous, change-only surfacing        | On-demand                                         |