Every system in the platform.
Verified against the live codebase. Each system below is a working surface — described at the implementation level, not inflated beyond what exists.
Every injection class, with working payloads and multiple detection strategies
SQL injection across major database engines with error-based, time-based blind, boolean blind, UNION, stacked queries, authentication bypass, WAF bypass, and out-of-band techniques. Cross-site scripting with reflected, DOM-based, attribute breakout, encoded, MIME, stored, and universal vectors. Local file inclusion and path traversal targeting Unix, Windows, PHP wrappers, and application configuration files. Server-side request forgery probing cloud metadata across AWS, GCP and Alibaba, localhost services, protocol handlers, and IP encoding bypasses. Remote code execution via command injection, time delays, language interpreters, and out-of-band callbacks.
Authentication checks covering JWT attacks such as none-algorithm, KID traversal, and JWK injection, plus CSRF, OAuth redirect manipulation, session fixation, MFA bypass, and token replay. Cloud infrastructure testing for bucket ACLs, cloud configuration exposure, container escape paths, serverless endpoints, and cloud provider login panels. GraphQL introspection, alias-based batching, recursive fragment denial of service, and injection across all families. Modern web attacks including server-side template injection, XXE, prototype pollution, deserialization across PHP, Python, Java and Jackson, and WebSocket probing. DNS zone transfers, subdomain brute force, DNSSEC NSEC walking, and record enumeration. Security header auditing with cookie flags and CSP bypasses. Open redirect probing across protocol handlers. Information disclosure covering credential patterns, tokens, stack traces, and private keys. Compliance checks mapped to PCI DSS, HIPAA, GDPR, SOC2, and ISO.
Scan profiles, configurable crawling, and third-party engine integration
The DAST orchestrator runs multiple scan profiles, from a shallow quick pass to a full run that pairs the deepest crawl with every check family and OWASP ZAP integration. The pipeline handles access control checks, automatic login form detection, web crawling with configurable depth and concurrency, check execution against per-page contexts, ZAP spider and active scan integration, deduplication by check name and evidence, and persistence into the investigation findings engine.
Breadth-first crawling, DNS intelligence, port scanning, and technology fingerprinting
The crawler performs breadth-first crawling with configurable depth and concurrency, extracting forms, scripts, parameters, and links. Technology fingerprinting detects platforms and frameworks including WordPress, React, Next.js, Django, Laravel, Express, Vue.js, Angular, GraphQL, Cloudflare, Nginx and Apache. A dedicated special-path probe list covers configuration exposure — dotenv files, git directories, admin panels, API endpoints, debug paths, backup files, version control leaks, and log files. The surface enumerator reads from the investigation database and tool outputs to produce prioritised targets using a scoring algorithm based on port count, endpoint density, API endpoints, and finding severity.
Fingerprint, evade, circuit break, and generate defense rules
A dedicated WAF engine with fingerprinting to identify the WAF in front of a target, evasion payload generation via encoding, case mutation, and parser-aware variants, circuit breaker monitoring that detects when the WAF starts blocking, and automated WAF rule generation from scan findings. The engine accepts an engagement scope and target URL, and ships with a control surface showing the start gate, circuit breaker feed, and rule-hit display.
Blind vulnerability detection through configurable callback listeners
Nyxeara operates configurable OAST callback listeners for detecting blind vulnerabilities. The system supports starting a listener, polling for callbacks, and stopping. Captured interactions display source IP, method, path, and protocol. Detects blind SSRF, blind XXE, out-of-band RCE verification, and other deferred vulnerability types where the attacker must wait for a callback.
Cookie, JWT, OAuth, Basic Auth, and session replay
The authentication scanner supports cookie-based, token-based (JWT/Bearer), and HTTP Basic Auth strategies. Login forms are automatically detected from HTML, auth configuration can be auto-detected from the target URL, and extracted sessions are replayed through the crawl and scan pipeline. Captured sessions are then injected automatically into every subsequent probe. The backend provides WebAuthn MFA with graceful degradation, Argon2id password hashing, and rate-limited login.
Encrypted secret storage, TOTP handling, and a destructive-action authorization gate
An encrypted vault stores investigation credentials at rest behind a passphrase-derived cipher, with per-investigation listing, read, and deletion. TOTP generation and verification are built in for multi-factor targets. A session manager tracks captured sessions and reports their health. The authorization gate classifies each requested action as read-only or destructive and refuses out-of-scope destructive work before it executes, rather than after.
An auth profile builder detects CSRF token fields, whether they rotate per request, the session cookie name, and the post-login check URL, then drives automated login through it.
Decoy infrastructure that detects, investigates, and hardens your own deployment
Sentinel seeds the edge with decoy paths — exposed version control, dotenv files, admin and internal API routes, cloud credential endpoints, database dumps, actuator and debug consoles. Requests that reach them are absorbed with a decoy response that conceals the mechanism, ingested, and correlated against the actor's history. A deterministic incident state machine governs every transition from detection through containment, AI investigation, root cause identification, hardening, validation, release approval, and unblocking — no operator or model can skip a step.
Hardening is executed, not just proposed: the hardening module writes rate-limit and endpoint-restrict rules into the live web server configuration and can validate them. Knowledge and skill patterns discovered during one investigation are stored and reused by the next. Post-incident review entries, auto-generated reports, and optional issue filing complete the lifecycle.
An observation-to-verification loop that runs without a human driving each step
The engine models an operation as a closed loop. Observations carry a graded confidence level and are mapped to vulnerability classes. Each observation can spawn hypotheses, which move through their own validated state machine. A test planner turns the current belief state into prioritised test candidates under an explicit budget, and a coordinator executes the cycle, dispatching the right tools, recording results, and re-planning against what actually came back.
Security roles — recon, web tester, auth tester, API tester, browser tester, verifier, analyst, reporter, scope and constraints — decide which capabilities a given operation may execute and what evidence each must produce. An AI policy layer validates every model-proposed action against those constraints before it is allowed to run.
People, social, email, phone, domain, code, credentials, cloud, corporate, and dark web intelligence
A first-class OSINT subsystem organises capabilities across domains including people and identity, social platforms, email and contact, phone, domain and DNS, web intelligence, technology, infrastructure, source code, credentials, documents, images, video, audio, geospatial, satellite, threat intelligence, dark web, corporate registries, cloud, organisations, relationship graphs, environment, transport, forensics, and search.
Each capability declares its input and output entity types, its expected information gain, and a cost profile covering CPU, memory, disk, timeout, concurrency limits, and API cost. A planner uses those to choose the next action — including pivots when a new entity type appears — and records each execution so later planning is informed by what already ran. An agent layer handles persona construction, attribution, cross-source correlation, and target guarding.
Integrated security tooling with schema-driven adapters and health verification
Nyxeara ships with integrated tooling spanning network scanning, web enumeration, DNS enumeration, web application testing, cryptography, runtime, and system utilities — including nmap, masscan, naabu, gobuster, ffuf, dirb, httpx, nikto, nuclei, whatweb, subfinder, amass, dnsrecon, whois, sqlmap, wpscan, dalfox, arjun, openssl, python3, tcpdump, strace, and more. Each tool has a full integration adapter with schema-driven argument validation, output parsing, and a health check that determines whether it is verified and ready or merely health-checked and available.
The onboarding pipeline is itself a product surface: definitions are versioned, validated against a taxonomy of capabilities and categories, given a lifecycle state, checked for environment compatibility, exercised against fixtures, and recorded in an audit trail. Any new tool can be brought through the same pipeline.
SHA-256 integrity, an explicit lifecycle, confidence attribution, and a redaction pipeline
Every finding carries a complete evidence chain: the finding itself, linked evidence, tool execution records, verification state, confidence basis with attribution — whether detector-recorded, investigator-recorded, or defaulted — a SHA-256 integrity digest, a timeline of events, and relationships. The verdict is derived from stored lifecycle signals and evidence, never from a scanner firing alone. The redaction pipeline covers sensitive headers, token patterns, PEM key blocks, inline secrets, and ANSI escape sequences.
Verification is a first-class operation with dedicated playbooks per vulnerability class, a proof-bundle API for exporting the whole chain, and differential analysis that compares a probe response against a captured baseline rather than trusting a single signature.
Entity resolution, a full finding lifecycle, correlation, conflict detection, and access control
The investigation platform supports entity normalization across domain, host, IP, port, service, URL, endpoint, path, technology, software, certificate, DNS record, cloud asset, repository, organisation, email, username, file, vulnerability, and finding types, with deduplication. Finding lifecycle management distinguishes a scanner hypothesis from a verified result, and carries explicit failure states for tests that were blocked, rate limited, or inconclusive. Deterministic correlation from shared values — same IP, host and port, domain, service, technology, certificate, or credential — connects related findings automatically, while a tool-disagreement correlation type surfaces contradictory claims side by side. Access control is owner-only by default, with read, write, and admin sharing.
Typed nodes, directed relationships, and multi-hop paths that explain connections
Findings and entities are not stored in isolation. The knowledge graph models hosts, contains, resolves-to, serves, runs-on, exploits, delivers, uses, targets, certifies, identifies-as and related-to relationships as directed edges, and can be traversed in either direction. Correlation paths are materialised so the platform can explain why two findings are connected rather than merely asserting that they are.
A relationship explainer generates a readable justification for any edge, and asset intelligence layers history and a timeline on top of each entity so a change in your estate is visible between scans.
Resolution is not the end — resolved findings are re-probed and diffed
Marking a finding resolved does not close the case. The retest engine re-executes the verification playbook against the target and diffs the fresh evidence against the original proof bundle. If the vulnerability is found again, the finding is flagged as regressed with its history intact rather than being silently reopened or quietly dropped. Retest history is retained per finding so you can see whether a fix held.
Composable chains built from findings, entities, technologies, and CVEs
A rule engine watches for combinations that are individually low-severity and collectively serious — an exposed debug endpoint that yields credentials which then work against production, a directory listing that leads to a sensitive file that enables code execution. Conditions can match on tool, finding type, severity, result type, tag, entity type, URL substring, or parameter set, and each chain step records the finding or saved result that justifies it.
A separate attack-path engine grades discovered paths as possible, probable, validated, or broken, and records edge provenance so a chain can be audited rather than taken on faith.
Privilege-escalation paths in your directory, and CVEs attached to the asset
Directory graph analysis ingests BloodHound-style JSON exports, parses the node and edge model, and computes the controlled closure for a given principal — so the set of principals that principal can reach is explicit and testable rather than inferred. Edges are filtered to those that are actually actionable.
CVE correlation works the other way: detected technologies are matched against a CVE corpus, correlated against the entities they were found on, and attached to the asset with full lifecycle management, so a vulnerable product in your estate is a finding on a real host rather than a line in a scanner log.
External threat intel, DNS intelligence, WHOIS and RDAP, and asset tracking
An intelligence provider module supports external threat intelligence integration with provider adapters for DNS, certificate, WHOIS, reputation, vulnerability, threat intel, passive DNS, URL intel, malware, and code repository sources. Asset intelligence tracks asset entities with history and field-level changes. DNS intelligence is gathered through the integrated DNS tooling. The intelligence pipeline collects attack surface data, prioritises targets, builds context, and executes scans against what it chose.
Declarative node types, human approvals, checkpoints, and a typed data pipeline
A full workflow automation engine with declarative node types organised into input sources, data transformation (filter, map, extract, deduplicate, merge, split, sort, group, limit, normalize), logic (condition, switch, compare), investigation actions (save evidence, create finding, add entity, create relationship, add note, update), and control flow (approval gates, delays, checkpoints, end). Data passes between nodes as typed values, not untyped blobs.
Workflow lifecycle runs draft, published, and archived. Execution is a persistent scheduler with wave-by-wave scheduling and bounded concurrency, human approval gates, checkpoint-and-resume for long-running workflows, and configurable failure strategies of stop, continue, retry, or skip. Secrets are injected at execution time and expressions are evaluated safely.
Evidence-grounded analysis, an AI agent, and a hypothesis system
The AI analysis engine produces evidence-grounded observations where every factual claim carries evidence references. Recommendations reference only real integrated tools — no invented tools. The AI agent supports recon, discovery, vulnerability, and full scan types, with agent tools for DNS lookup, HTTP fetch, SSL check, port scanning, WHOIS lookup, and technology detection. An AI copilot adds hypothesis generation, evidence categorisation, action proposals, and analysis persistence.
Advisory functions pair a deterministic heuristic with a model-assisted path for endpoint ranking, payload synthesis, near-miss follow-up generation, IDOR candidate flagging, and response anomaly analysis — so the model refines a signal the platform already detected rather than inventing one.
Install your own checks through a validated, trust-graded manifest
The extension registry validates a manifest before anything is installed, rejecting malformed or unsafe definitions and returning the specific errors. Extensions carry a trust level and an operational status, and every install, status change, and trust change is written to an event log attributed to the acting user — so extension behaviour is auditable like any other actor on the platform.
Device authorisation, binary integrity, and a full API surface
The CLI provides a device authorisation flow — code generation, confirmation, and token exchange — alongside token login and logout, session health checks, identity lookup, device listing and revocation, finding CRUD with state transitions, investigation CRUD, evidence listing, tool execution and listing, tool registry search, and workflow CRUD. Security features include binary integrity checking via SHA-256 hash verification and device fingerprint binding, with rate-limited login. Device sessions, login attempts, known fingerprints, and the command log are all recorded server-side.
The platform is driven entirely through a versioned HTTP API, and the same operations are reachable from the web console, so automation never depends on scraping the UI.
SARIF export, severity gates, baseline diff, and GitHub Code Scanning
SARIF export with full schema including tool driver, rule ID, level mapping, and physical location. Available in the findings view, the report renderer, the CLI, and the API. Severity-gated exit codes so pipelines can fail on critical findings. Baseline comparison for regression detection across scan runs. GitHub Code Scanning integration via SARIF upload. Signed webhooks for pipeline notifications.
PDF, HTML, JSON, and CSV with templates, sections, and branding
The report builder supports templates covering executive summary, scope, methodology, targets, assets, findings, evidence, timeline, recommendations, and appendix sections, with customisable branding and export to PDF, HTML, JSON, and CSV. Data export produces a bundle across findings, entities, evidence, and timeline with automatic secret pattern redaction, and CSV serialisation is available for the tabular views. SARIF export is available from multiple contexts, and automatic redaction is applied to all exported data.
Signed event delivery with tracking, retry, and in-app notification
The webhook engine emits finding, evidence, workflow, execution, worker, investigation, report, and task events. Every payload is signed with HMAC-SHA256 for integrity verification. Delivery is tracked with automatic retry on failure, and the delivery log is queryable. An in-app notification system carries read tracking and unread counts, and notification acknowledgements are recorded separately. Webhooks are available for CI/CD pipeline notifications and platform events.
Role-based permissions, a tamper-evident audit trail, retention, and archiving
Access control is role-based, with distinct built-in roles for super administration, administration, operations, auditing, and security, each granted a specific permission set rather than an all-or-nothing flag. A separate role model governs security operations. Investigation-level sharing is owner-only by default with read, write, and admin grants, and username-to-identity resolution is performed server-side. An activity log and audit trail track user actions with timestamps, and the audit log is Merkle-chained so tampering is detectable. Data retention policies are configurable per data class, retention cleanup is logged, investigation archiving manages the full lifecycle, and backups are taken on a schedule.
Job queues, worker agents, scheduling, autoscaling, and distributed tracing
The deployment infrastructure includes deployment versioning with worker and API compatibility gating, an in-process job queue with explicit states and dead letter handling, a capability-aware scheduler that selects a compatible worker for each job, artifact storage for large outputs, worker agent management with heartbeat monitoring and load reporting, autoscaling driven by queue depth and worker utilisation, resource policy enforcement across execution, storage, and rate limits, and an observability pipeline with counters, gauges, and span-based distributed tracing. The backend provides real scan execution, server-sent-event streaming of scan results, report generation, JWT authentication, rate limiting, and security headers.
Run a scan against your stack.
Create a free account and take the platform to a real target. Every check is live.
Start scanning