Trusted by security teams at

What is web application penetration testing?

An authorized attack on a running web application: its pages, sessions, APIs, and the logic that ties them together. The tester works like a real attacker, probing auth flows and access control, not just matching known signatures.

What a web app pentest covers

The classes of flaws that decide whether an app holds up against a real attacker.

Authentication & sessions

Login flows, token handling, password reset, and session fixation, the doors an attacker tries first.

Access control

Horizontal and vertical privilege escalation: reading another user's data or reaching admin functions.

Injection

SQL, command, and template injection wherever user input reaches an interpreter.

Client-side flaws

XSS, CSRF, and unsafe redirects that turn a victim's browser into the attack vehicle.

Business logic

Flaws in the rules of the app itself: skipping payment steps, abusing coupons, racing checkouts.

The APIs underneath

REST and GraphQL endpoints behind the UI, including object-level authorization gaps.

Continuous web app testing with Strix

The app changes every week. Testing should keep up.

Pull request testing

Each PR gets an agent pass scoped to the diff before merge.

Proven findings

Every report ships with the request and response that reproduce the bug.

Merge-ready fixes

Findings arrive as fix PRs on your branch, then get retested after the merge.

Your infrastructure

Open-source, self-hostable, and BYO-LLM, so the app under test never leaves your network.

Agent-driven pentest vs DAST scanner

Both attack the running app. Only one proves impact.

Capability

Strix agents

DAST scanner

Coverage of auth and logic flaws

yes

no

Multi-step attack chains

yes

no

Evidence

Working exploit per finding

Pattern match

False positives

Low: validated first

High

Remediation

Merge-ready fix PR

Text description

Runs on pull requests

yes

rare

Best for

Proving what an attacker can actually do

Baseline hygiene scanning

Coverage of auth and logic flaws

Strix agents

yes

DAST scanner

no

Multi-step attack chains

Strix agents

yes

DAST scanner

no

Evidence

Strix agents

Working exploit per finding

DAST scanner

Pattern match

False positives

Strix agents

Low: validated first

DAST scanner

High

Remediation

Strix agents

Merge-ready fix PR

DAST scanner

Text description

Runs on pull requests

Strix agents

yes

DAST scanner

rare

Best for

Strix agents

Proving what an attacker can actually do

DAST scanner

Baseline hygiene scanning

From issue to fix in seconds

Find critical issues, auto-validate, and auto-fix with merge-ready PRs.

←Issues/STR-00847

SSRF via URL Parameter in /api/proxy

OpenHigh · 8.6CWE-918

TL;DR

The /api/proxy endpoint accepts a user-supplied URL without validation. An attacker can access internal services, read cloud metadata, and exfiltrate credentials.

Impact

Access to cloud metadata at 169.254.169.254, potential credential theft, and internal network scanning.

Location

acme/api · proxy-handler.ts:23

GET/api/proxy?url=

Severity

High

CVSS

8.6

Fix Effort

Low

Discovered

2h ago

Discover & Validate

Pentests your entire attack surface continuously. Reproduces each finding, confirms exploitability with proof, and prioritizes by real impact.

FixReproduction

How do I fix it?

Validate and restrict the target URL using an allowlist of permitted hostnames. Reject private/internal IP ranges and enforce HTTPS-only.

proxy-handler.ts:23-29Copy

23	23	const targetUrl = req.query.url;
24		const resp = await fetch(targetUrl);
	24	const parsed = new URL(targetUrl);
	25	if (!ALLOWED_HOSTS.has(parsed.hostname)) {
	26	throw new ForbiddenError("blocked");
	27	}
	28	const resp = await fetch(parsed.href);
25	29	return res.json(await resp.json());

✓Fix verified — vulnerability no longer exploitable

→PR #247 fix/ssrf-proxy-handler ready to merge

Auto-Fix

Generates a fix, retests to confirm the vulnerability is gone, and delivers a merge-ready PR. Review, merge, done.

Frequently asked questions

Common questions about web application pentesting.

Web application penetration testing is an authorized, simulated attack on a running web app that probes authentication, access control, injection points, client-side flaws, and business logic to find and prove exploitable vulnerabilities before real attackers do.