> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/capabilities/pentests/supported-targets.md).

# Supported Targets

## Overview

The pentest workflow targets REST and GraphQL APIs. The [Bug Hunt](/capabilities/bug-hunts.md) workflow assesses server-side rendered applications and single-page applications instead.

## Application Types

| Type                         | Supported            | Notes                                                                                                                                                              |
| ---------------------------- | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **REST APIs**                | Yes                  | Full support. Deepest results with an OpenAPI or Swagger specification — see [Preparing for an Engagement](/capabilities/pentests/preparing-for-an-engagement.md). |
| **GraphQL APIs**             | Yes                  | Introspection, mutation testing, and authorization-matrix analysis.                                                                                                |
| **SSR HTML Apps**            | Bug Hunt only / beta | Server-side rendered apps (Django, Rails, Express) are assessed by the [Bug Hunt](/capabilities/bug-hunts.md) workflow, not the pentest workflow.                  |
| **SPAs**                     | Bug Hunt only / beta | Single-page apps (React, Vue, Angular) are assessed by the [Bug Hunt](/capabilities/bug-hunts.md) workflow, not the pentest workflow.                              |
| **SOAP APIs**                | Not yet              | Register interest with the Nullify team.                                                                                                                           |
| **WebSockets**               | Not yet              | Event-driven assessments are on the roadmap.                                                                                                                       |
| **gRPC**                     | Not yet              | Reach out if you would like to join the design partner programme.                                                                                                  |
| **Custom TCP/UDP Protocols** | Not yet              | On the roadmap.                                                                                                                                                    |

## APIs that carry XML

The pentester classifies a target as either REST or GraphQL. It can test an HTTP API that exchanges XML payloads as REST, provided an OpenAPI specification covers its endpoints.

A SOAP service is different. We do not support SOAP's envelope, WSDL contract, or operation dispatch, and a WSDL cannot stand in for an OpenAPI specification. If you are unsure which category your service falls into, send us the specification and we will confirm before the engagement starts.

## Network reachability

| Target location             | Pentest                                                                                                             | [Exploit validation](/capabilities/pentests/exploit-validation.md) |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ |
| Reachable from the internet | Yes                                                                                                                 | Yes                                                                |
| Private network             | Yes — via the CLI or AWS PrivateLink, see [Running in Private Networks](/capabilities/pentests/private-networks.md) | No                                                                 |

## Vulnerability coverage

Across supported target types the pentester tests for:

* Injection — SQL, NoSQL, command, LDAP, and XPath
* Broken authentication and broken authorization
* Insecure direct object references and broken object-level authorization
* Privilege escalation and authorization bypass across roles
* Server-side request forgery, including reachability of cloud metadata endpoints
* XML external entity processing
* Unsafe file upload
* Business logic flaws

Where an exploit succeeds, the pentester chains steps to show real impact — endpoint discovery, parameter fuzzing, injection, lateral access, and data exfiltration — and attaches the requests and responses that prove each step.