> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/pentests.md).

# Pentests

> **Maturity: Operator-assisted** — Engagements are set up with a Nullify operator by default: customer-initiated pentests are gated on `dast_enable_self_serve_pentest`, whose in-code default is off (`dast/internal/config/config.go`).

## Overview

Nullify runs on-demand penetration tests against REST and GraphQL APIs. To configure one, follow [Preparing for an Engagement](/capabilities/pentests/preparing-for-an-engagement.md).

## Triggering Pentests

Pentests run on demand — start one against a specific application whenever you need it, with full control over the scan parameters and results tracked in real time. Teams typically trigger a pentest on new application deployments, major feature releases, [Security Program Management](/capabilities/program-management.md) campaigns, or to validate a remediation.

## Supported Application Types

Nullify pentests **REST and GraphQL APIs**:

### REST APIs

* OpenAPI/Swagger schema-based testing.
* Automatic schema discovery (checks common locations such as `/openapi.json`, `/swagger.json`, `/api-docs`).
* Fuzzing of path parameters, query strings, and request bodies.
* Intelligent, schema-aware API testing that combines targeted vulnerability probing with Nullify's own reasoning agents.

### GraphQL APIs

* Introspection query analysis.
* Query testing.
* Schema-based attack generation.

## Authenticated Testing

### Authentication Methods

* **Bearer Tokens**: JWT, OAuth2 access tokens
* **Basic Auth**: Username/password pairs
* **OAuth 2.0 / OpenID Connect**: settings agreed with Nullify per engagement
* **Custom Headers**: API keys, custom authentication schemes
* **Login Flows**: POST to a login endpoint with credentials

Configure credentials as described in [Preparing for an Engagement](/capabilities/pentests/preparing-for-an-engagement.md#3-identities).

## Request Chaining & Multi-Stage Exploitation

Nullify can investigate vulnerabilities through multi-stage exploitation within the engagement scope:

> This section describes exploit chaining *within* a pentest engagement. It is a different thing from [Exploit Validation](/capabilities/pentests/exploit-validation.md), the continuous capability that validates individual code findings against your deployed service.

### Stateful Session Management

* Preserves authentication context throughout a chain.
* Tracks session state and cookies.
* Supports multi-step workflows.

### Fuzzing

* Substitutes fuzz tokens across URLs, headers, query params, and bodies.
* Analyzes responses for status, size, and timing anomalies.

### Exploit Chain Execution

An investigation can discover an endpoint, establish a test identity, probe an input, compare the result against a second identity, and capture the request/response evidence. The permitted depth depends on the engagement's scope and mutation consent. Use disposable test data where write testing is explicitly authorized.

### Response Analysis & Iteration

* Parses responses (status, headers, body).
* Extracts data from responses for subsequent requests.
* Analyzes error messages for information disclosure.
* Adapts strategy based on application behavior.

Runtimes vary with the size and complexity of the target; deep exploit chains can run for an extended period.

This is the exploitation Nullify performs *within* a single pentest. To prove or disprove an individual code-review or dependency finding on its own — driven by your own policies, without launching a full pentest — see [Exploit Validation](/capabilities/pentests/exploit-validation.md).

## Vulnerability Coverage

Pentests validate:

* **Injection Flaws**: SQL, NoSQL, Command, LDAP, XPath
* **Broken Authentication**: Weak passwords, session fixation, token manipulation
* **Broken Authorization**: IDOR, privilege escalation, missing access controls
* **Security Misconfiguration**: Debug mode, default credentials, verbose errors
* **Business Logic Flaws**: Price manipulation, workflow bypass, race conditions
* **SSRF**: Server-side request forgery with cloud metadata access
* **XXE**: XML external entity injection
* **File Upload**: Malicious file upload and execution

## Context from Code Review

Pentests are informed by everything Nullify has already learned:

* **Code review findings** — known injection points and vulnerable patterns are prioritized for testing, and code-level context guides payload selection.
* **Dependency findings** — exploitable CVEs (for example Log4Shell) are validated against the live application.

## Application Management

Every pentest is associated with an **Application**:

* Name and description
* Targets: host, port and protocol
* Web services: repository and path inside the repository, mapped to targets
* Credentials attached to each web service

## Evidence & Reporting

Pentest findings include:

* **Request/Response Pairs**: full HTTP traffic demonstrating the vulnerability.
* **Exploit Steps**: detailed reproduction instructions.
* **Impact Analysis**: business impact and blast radius.
* **Fix Guidance**: specific remediation recommendations.
* **Screenshots**: visual proof of exploitation where applicable.
* **Video Recordings**: a walkthrough of the exploit chain where applicable.

## Safety

A run can be stopped at any time from the dashboard.

## Where findings go

Review findings in the dashboard. Configure ticketing and notifications as described in [Configuration – General](/configuration/configuration-general.md).

## Configuration

Configure pentests during [Onboarding](/getting-started/getting-started.md):

* **Applications**: define applications and their targets.
* **Credentials**: add authentication credentials for testing.

## Pentests vs Bug Hunts

| Aspect        | Bug Hunts                                                              | Pentests                                          |
| ------------- | ---------------------------------------------------------------------- | ------------------------------------------------- |
| **Scope**     | External attack surface (domains, IPs)                                 | Known applications (APIs)                         |
| **Discovery** | Subdomain enumeration, service discovery                               | API schema analysis, endpoint mapping             |
| **Depth**     | Selected discovery, authenticated, malware, and backend-testing suites | Application-focused testing and exploit chains    |
| **Evidence**  | Service inventory, exposure detail                                     | Request/response pairs, reproduced exploit chains |
| **Cadence**   | Continuous, change-only surfacing                                      | On-demand                                         |

## Surface discovery and authorization coverage

The pipeline can combine a supplied or discovered API contract with application crawling, JavaScript endpoint hints, and routes inferred from connected source. Inferred routes are candidates to validate, not proof that the deployed endpoint exists. Surface and stage coverage distinguish tested, excluded, unavailable, and unresolved paths.

Authorization-matrix testing compares permitted identities across endpoints and object access. Missing or invalid credentials reduce what can be established. Mutation testing requires explicit consent as well as the relevant test configuration; supplying an administrator credential alone does not authorize arbitrary writes. The public CLI and the hosted workflow expose different controls, so arrange advanced matrix and mutation settings with your Nullify contact rather than adding undocumented flags.