PenStrikeAI
Capabilities

Every class it can prove.

PenStrike carries a dedicated exploitation prover for each vulnerability class. A finding is never reported on a scanner signal — it is exploited, reproduced and revalidated first. Here is the full coverage.

17classes with a dedicated prover
18exploitation provers in total
4proof gates before publishing
BOLA & IDOR — PenStrike exploitation prover

BOLA & IDOR

critical

CWE-639

Autonomous cross-object enumeration seeds a unique sentinel in the victim's state, then proves one identity can read another's. Similarity alone is refused as evidence.

SQL injection — PenStrike exploitation prover

SQL injection

critical

CWE-89

Differential boolean oracle, authentication bypass and time-based confirmation — validated non-destructively, never a raw scanner match.

Server-side request forgery — PenStrike exploitation prover

Server-side request forgery

high

CWE-918

A unique out-of-band callback is injected and awaited on the in-house collaborator; a timing oracle backs it up when responses stay blind.

Cross-site scripting — PenStrike exploitation prover

Cross-site scripting

high

CWE-79

Reflected, stored and DOM — proven by executing a real nonce in a headless Chromium, not by detecting that input was reflected.

Authentication & JWT — PenStrike exploitation prover

Authentication & JWT

critical

CWE-287

Forged alg=none tokens and weak HMAC secrets are minted and replayed against the target to demonstrate a real authenticated action.

Business logic abuse — PenStrike exploitation prover

Business logic abuse

high

CWE-840

Price tampering, privilege escalation, mass-assignment and token reuse — the injected field must persist on an independent re-read to count.

SSTI & remote code execution — PenStrike exploitation prover

SSTI & remote code execution

critical

CWE-1336 · CWE-77

An arithmetic oracle the template engine must actually evaluate, plus OOB and timing proofs for command execution. Never a destructive command.

Broken access control — PenStrike exploitation prover

Broken access control

critical

CWE-639

Function-level checks (BFLA) are probed with PUT/DELETE and anonymous access, mapping exactly which actions cross a privilege boundary.

API security — PenStrike exploitation prover

API security

high

CWE-863

OpenAPI import, hidden-route mining from JS bundles and GraphQL introspection expand the real authenticated surface where API flaws live.

OWASP Top 10 — PenStrike exploitation prover

OWASP Top 10

coverage

A01–A10

Seventeen classes with a dedicated exploitation prover map across the OWASP Top 10 — access control, injection, SSRF, auth and more.

Proven, not flagged

Four gates before a finding is real.

Any scanner signal is treated as unsorted noise until an exploitation prover confirms impact. Nothing is published unless all four gates pass.

  1. 01

    Impact demonstrated

    The exploit produces a concrete, observable effect — not a signature match.

  2. 02

    Clean negative control

    A benign twin request does NOT trigger the effect, ruling out false positives.

  3. 03

    Independent reproduction

    The exploit replays with fresh, independent sessions — at least three times.

  4. 04

    Final live revalidation

    One last independent proof is fired via real requests immediately before publishing.

Every verdict is three-state: proven, refuted, or inconclusive — reproduced at least three times.

Full coverage

Seventeen provers, one bar for proof.

ClassProof techniqueCWESeverity
SQL injection (SQLi)Boolean/UNION/time-based oracle, auth bypassCWE-89Critical
Cross-site scripting (XSS)Reflected, stored, DOM — real nonce executionCWE-79High
Access control (BOLA/IDOR/BFLA)Cross-object enumeration + anonymous accessCWE-639Critical
Authentication (JWT)alg=none forge, weak HMAC acceptedCWE-287Critical
Open redirectRedirect to sentinel originCWE-601Medium
Server-side request forgeryUnique out-of-band callbackCWE-918High
Command injection (RCE)OOB curl / timing oracle, non-destructiveCWE-77Critical
XML external entity (XXE)External entity resolved to OOB URLCWE-611High
Server-side template injectionArithmetic expression evaluatedCWE-1336Critical
LFI / path traversalKnown system file disclosed, read-onlyCWE-22High
CORS misconfigurationAttacker origin reflected + credentialsCWE-942Medium
Secret exposureSensitive path read (.git, .env, actuator)CWE-200High
Business logicPrice tampering, mass-assignment, token reuseCWE-840High
Second-order / stored injectionPayload written, evaluated on renderCWE-74High
GraphQL abuseSchema disclosure via introspectionCWE-863High
Race condition / TOCTOUConcurrent burst past a single-use limitCWE-362High
Request smuggling / cache poisonReflected Host-header injectionCWE-444High

Intrusive classes (race condition, request smuggling) are opt-in and run only inside an explicitly authorized scope.

See it prove one on your stack.

Request access and point PenStrike at a target you own or are authorized to test.

Request access