Network Penetration TestingInternal, external, continuous.
Your perimeter and everything behind it, tested like an attacker would.
Strix agents probe hosts, services, and paths between them.
Trusted by security teams at
What is network penetration testing?
What a network pentest covers
The two scopes auditors expect, and what each one probes.
External network
Internet-facing hosts and services: exposed ports, outdated software, weak TLS, and credential attacks against login surfaces.
Internal network
What an attacker can reach after the first foothold: shares, services, credential reuse, and paths toward critical systems.
Lateral movement
Chaining a foothold into adjacent hosts and higher privileges, the pattern behind most real breaches.
Cloud networks
Security groups, exposed storage, IAM reachability, and workload-to-workload paths across AWS, GCP, and Azure.
Compliance scope
PCI DSS Requirement 11.4 mandates internal and external testing at least annually and after significant changes.
Credential hygiene
Default passwords, reused credentials, and exposed secrets that turn one weak host into all of them.
Continuous network testing with Strix
Infrastructure changes as fast as code does. Point-in-time tests miss the drift.
Always-on coverage
Agents retest as infrastructure changes, instead of one snapshot a year.
Proven, not flagged
Findings ship with the steps that reproduce them, so triage starts from confirmed risk.
Inside your perimeter
Self-hostable and air-gappable with a local LLM, reaching internal hosts through a connector you control.
One agent, whole stack
The same agent covers the app layer and the network beneath it, so chained findings across layers are visible.
Continuous agents vs annual network pentest
How autonomous testing compares to the scheduled engagement.
Strix agents
Annual engagement
Strix agents
Annual engagement
Strix agents
Annual engagement
Strix agents
Annual engagement
Strix agents
Annual engagement
Strix agents
Annual engagement
Strix agents
Annual engagement
From issue to fix in seconds
Find critical issues, auto-validate, and auto-fix with merge-ready PRs.
SSRF via URL Parameter in /api/proxy
TL;DR
The /api/proxy endpoint accepts a user-supplied URL without validation. An attacker can access internal services, read cloud metadata, and exfiltrate credentials.
Impact
Access to cloud metadata at 169.254.169.254, potential credential theft, and internal network scanning.
Location
acme/api · proxy-handler.ts:23Severity
CVSS
8.6Fix Effort
LowDiscovered
2h agoDiscover & Validate
Pentests your entire attack surface continuously. Reproduces each finding, confirms exploitability with proof, and prioritizes by real impact.
How do I fix it?
Validate and restrict the target URL using an allowlist of permitted hostnames. Reject private/internal IP ranges and enforce HTTPS-only.
| 23 | 23 | const targetUrl = req.query.url; |
| 24 | const resp = await fetch(targetUrl); | |
| 24 | const parsed = new URL(targetUrl); | |
| 25 | if (!ALLOWED_HOSTS.has(parsed.hostname)) { | |
| 26 | throw new ForbiddenError("blocked"); | |
| 27 | } | |
| 28 | const resp = await fetch(parsed.href); | |
| 25 | 29 | return res.json(await resp.json()); |
Auto-Fix
Generates a fix, retests to confirm the vulnerability is gone, and delivers a merge-ready PR. Review, merge, done.
Frequently asked questions
Common questions about network penetration testing.
Keep exploring
Solutions
Start testing in minutes
Continuous network testing with proven findings, from inside your own perimeter.