Sample assessment
This is a sanitized excerpt of a full Phase 2 report, rendered in our DRM-protected viewer.
Across 412 hours of automated AI-driven testing covering 1,184 URLs and 142 API endpoints, PentrAX AI identified 60 findings spanning 6 attack surfaces. Three findings are rated Critical and require immediate remediation.
F-001 · API Security · CWE-89
The `q` query parameter is concatenated directly into a SQL statement without parameterisation, enabling a UNION-based extraction of arbitrary tables, including `users` and `account_balances`.
F-002 · Authentication · CWE-347
The token verification routine accepts `alg: none`, allowing an attacker to forge tokens for any user including administrators.
F-003 · Web Application · CWE-79
User-controlled `note` field is rendered without sanitisation on the order detail page accessible to internal staff.
F-004 · Cryptography · CWE-326
Legacy TLS protocol versions remain enabled, exposing the endpoint to BEAST and POODLE-style attacks.
Including detailed evidence, exploitation steps, remediation playbooks, full compliance gap analysis, and MITRE ATT&CK chain visualisation.
Sensitive data exposure in /api/v1/users/me response
Endpoint returns `password_hash`, `mfa_seed`, and `internal_notes` fields to any authenticated user requesting their own profile.
Missing rate limiting on /auth/login
No throttling or lockout observed after 1,000 failed login attempts from a single IP.
Verbose error messages disclose stack trace
500 responses include full Python traceback with file paths and library versions.
S3 bucket 'northvale-statements' world-readable
Public read ACL on bucket containing 412k monthly statement PDFs (PII + account numbers).
PentrAX AI is in private beta. Request access and we'll run the first assessment with you.