One pipeline. Two pentest modes.

Capability · Adaptive test planner

Testing adapts to the application

Instead of a fixed test list, Pentrova adapts the test plan to what your application reveals — concentrating effort where the attack surface is richest and skipping what does not apply. Every decision is logged with its reasoning so the run is fully auditable after the fact.

Capability · Authorization Matrix

Multi-role replay. Real privilege bypasses, not theoretical risks.

Declare as many roles as your app models — owner, admin, member, viewer, external, unauthenticated — and Pentrova establishes a fresh authenticated session per role. Every endpoint is exercised under every role; reference responses are captured per role; then Pentrova replays every request with every other role’s session and compares deterministically. Differences that indicate access (a 200 where a 403 was expected, disclosed identifiers, unexpected write confirmation) are flagged as violations with the full request/response pair attached as evidence.

Capability · DOM XSS taint

Source to sink. Including the framework sinks scanners miss.

Reflected XSS fuzzing cannot catch DOM-only bugs. Pentrova analyses how untrusted values reach dangerous sinks in your actual client bundle — including the framework-specific sinks generic scanners miss in React, Angular, and Vue applications — then confirms exploitation in a real browser. Each DOM XSS finding reports the source, the sink, and the URL that triggers it.

• React

  Coverage for dangerouslySetInnerHTML, the sink generic scanners routinely miss in React bundles.

• Angular

  Coverage for the trusted-HTML and bind-HTML sinks Angular templates expose.

• Vue

  Coverage for the raw-HTML directive Vue templates expose.

• Classic DOM and jQuery

  Coverage for HTML-writing, script-evaluating, URL, and attribute sinks, plus the jQuery HTML helpers.

DOM XSS taint is a browser-side signal and runs only in Web App Pentesting engagements — API Pentesting has no DOM surface.

Capability · Sandbox PoC

Isolated sandbox. Safe defaults.

For confirmed Critical and High findings, the sandbox attempts a proof-of-concept check against your target (classes such as RCE, LFI, SSRF, SQLi, XXE and SSTI). It can reach only the hosts you have authorised, with private and internal networks blocked, and destructive payloads are blocked by default. Scan output can contain working credentials and personal data captured from your systems: Pentrova masks the secrets it recognises in exports and the live scan view, but does not remove personal data, so treat reports as sensitive. Where a finding has a captured HTTP exchange, your engineers can copy it as a cURL command and run it against the target themselves.

Capability · Attack chains

One bug becomes a business-impact path

Confirmed findings feed the chain resolver. Pentrova ships a curated catalog of escalation chains and adds dynamic LLM-built chains at scan time when the catalog does not already encode a path between two findings. Both kinds are confirmed the same way as single findings: AI review of the evidence decides, and Pentrova never re-sends a state-changing request to prove a chain.

• SQLi → FileRead → RCE

  1. A search field accepts injected SQL and the database answers
  2. The same foothold reaches configuration the application never meant to expose
  3. The chain ends with command execution under the application account

  Impact: Full remote code execution on the application host

• SSRF → CloudMeta

  1. A URL-import feature fetches an address the application never validated
  2. The request reaches infrastructure that trusts anything inside the perimeter
  3. Credentials belonging to the instance leave with the response

  Impact: Instance IAM role takeover and downstream cloud access

• XXE → SSRF

  1. An upload parser processes XML that carries more than data
  2. The parser is made to fetch on the attacker's behalf
  3. Internal services answer a request that came from inside

  Impact: Internal network read and cloud credential exposure

Capability · Agent library

Six capability families

Pentrova’s agent library is grouped by remit, not by name. Internal agent counts and the exhaustive inventory live behind the product console; the public surface here is the shape of the coverage so you can map it to your application boundaries before the call.

• Read-only reconnaissance

  Observe traffic, DOM, headers, and responses without sending exploit payloads. Reconnaissance is read-only by design; the active families below do send exploit payloads to your target, with destructive payloads and methods blocked by default.

  • Response-header policy posture (CSP, HSTS, CORS, cookies)
  • DOM-structure capture after framework hydration
  • Client-bundle map and orphaned endpoint discovery
  • Session-lifecycle cookie auditing

• Injection

  Exercise classic injection classes — SQLi, command injection, LFI/RFI, SSTI — with conservative payload budgets and out-of-band confirmation. Every finding is confirmed by AI review of captured evidence before it reaches your queue.

  • SQL injection across common dialects
  • Command metacharacter probing with OOB confirmation
  • Path traversal and local file inclusion
  • Server-side template injection with sandbox-escape detection

• Access control

  Prove privilege bypasses through cross-role and cross-tenant replay. The Authorization Matrix above is the public face of this family.

  • Broken object-level authorization (BOLA / IDOR)
  • Elevated-function access from under-privileged sessions
  • Cross-tenant read and write replay

• Business logic

  Encode application-specific invariants — pricing, workflow order, rate and quota guards. These are findings a generic scanner can never ship because only the application knows what "broken" looks like.

  • Price and currency manipulation
  • Workflow-ordering and state-machine bypass
  • Rate-limit and race-window characterisation

• Protocol & API

  Exercise modern API surfaces — REST, GraphQL, gRPC, SOAP, JSON-RPC, WebSocket — with parser-aware payloads tuned to each transport.

  • GraphQL introspection, persisted queries, subscriptions
  • gRPC reflection exposure, authentication, and metadata checks
  • SOAP / WSDL with WS-Security and custom XSD imports
  • WebSocket and Protobuf message exercising

• Escalation

  When a finding is confirmed, escalation runs automatically inside your authorised scope to show its impact. There is no approval step, and Pentrova does not move on to other hosts.

  • Database schema read through a confirmed SQL injection
  • Cloud metadata requested through a confirmed SSRF
  • File reads through a confirmed path traversal (LFI)