One pipeline. Two pentest modes.

Capability · Adaptive test planner

Testing adapts to the application

Instead of a fixed test list, Pentrova adapts the test plan to what your application reveals — concentrating effort where the attack surface is richest and skipping what does not apply. Every decision is logged with its reasoning so the run is fully auditable after the fact.

Capability · Authorization Matrix

Multi-role replay. Real privilege bypasses, not theoretical risks.

Declare as many roles as your app models — owner, admin, member, viewer, external, unauthenticated — and Pentrova establishes a fresh authenticated session per role. Every endpoint is exercised under every role; reference responses are captured per role; then Pentrova replays every request with every other role’s session and compares deterministically. Differences that indicate access (a 200 where a 403 was expected, disclosed identifiers, unexpected write confirmation) are flagged as violations with the full request/response pair attached as evidence.

Capability · DOM XSS taint

Source to sink. Including the framework sinks scanners miss.

Reflected XSS fuzzing cannot catch DOM-only bugs. Pentrova analyses how untrusted values reach dangerous sinks in your actual client bundle — including the framework-specific sinks generic scanners miss in React, Angular, and Vue applications — then confirms exploitation in a real browser. Every finding ships with the source, the sink, and a reproducible URL.

• React

  Coverage for dangerouslySetInnerHTML, the sink generic scanners routinely miss in React bundles.

• Angular

  Coverage for the trusted-HTML and bind-HTML sinks Angular templates expose.

• Vue

  Coverage for the raw-HTML directive Vue templates expose.

• Classic DOM and jQuery

  Coverage for HTML-writing, script-evaluating, URL, and attribute sinks, plus the jQuery HTML helpers.

DOM XSS taint is a browser-side signal and runs only in Web App Pentesting engagements — API Pentesting has no DOM surface.

Capability · Sandbox PoC

Sealed sandbox. Sanitised exploits by default.

For confirmed Critical and High findings, the sandbox renders a sanitised proof-of-concept — RCE, LFI, SSRF, SQLi, XXE, and SSTI classes included. Destructive payloads are swapped for read-only equivalents, egress defaults to deny-all, and customer data is redacted at the boundary. Every finding carries the captured request and response plus a reproducible command your engineers can run against the target themselves.

Capability · Attack chains

One bug becomes a business-impact path

Confirmed findings feed the chain resolver. Pentrova ships a curated catalog of escalation chains and adds dynamic LLM-built chains at scan time when the catalog does not already encode a path between two findings. Both kinds are verified against the live target the same way, so the evidence quality is identical.

• SQLi → FileRead → RCE

  1. A search field accepts injected SQL and the database answers
  2. The same foothold reaches configuration the application never meant to expose
  3. The chain ends with command execution under the application account

  Impact: Full remote code execution on the application host

• SSRF → CloudMeta

  1. A URL-import feature fetches an address the application never validated
  2. The request reaches infrastructure that trusts anything inside the perimeter
  3. Credentials belonging to the instance leave with the response

  Impact: Instance IAM role takeover and downstream cloud access

• XXE → SSRF

  1. An upload parser processes XML that carries more than data
  2. The parser is made to fetch on the attacker's behalf
  3. Internal services answer a request that came from inside

  Impact: Internal network read and cloud credential exposure

Capability · Agent library

Six capability families

Pentrova’s agent library is grouped by remit, not by name. Internal agent counts and the exhaustive inventory live behind the product console; the public surface here is the shape of the coverage so you can map it to your application boundaries before the call.

• Read-only reconnaissance

  Observe traffic, DOM, headers, and responses without sending exploit payloads. Read-only by design, which is what lets Pentrova run safely against live systems.

  • Response-header policy posture (CSP, HSTS, CORS, cookies)
  • DOM-structure capture after framework hydration
  • Client-bundle map and orphaned endpoint discovery
  • Session-lifecycle cookie auditing

• Injection

  Exercise classic injection classes — SQLi, command injection, LFI/RFI, SSTI — with conservative payload budgets and out-of-band confirmation. Every finding is verified before it reaches your queue.

  • SQL injection across common dialects
  • Command metacharacter probing with OOB confirmation
  • Path traversal and local file inclusion
  • Server-side template injection with sandbox-escape detection

• Access control

  Prove privilege bypasses through cross-role and cross-tenant replay. The Authorization Matrix above is the public face of this family.

  • Broken object-level authorization (BOLA / IDOR)
  • Elevated-function access from under-privileged sessions
  • Cross-tenant read and write replay

• Business logic

  Encode application-specific invariants — pricing, workflow order, rate and quota guards. These are findings a generic scanner can never ship because only the application knows what "broken" looks like.

  • Price and currency manipulation
  • Workflow-ordering and state-machine bypass
  • Rate-limit and race-window characterisation

• Protocol & API

  Exercise modern API surfaces — REST, GraphQL, gRPC, SOAP, JSON-RPC, WebSocket — with parser-aware payloads tuned to each transport.

  • GraphQL introspection, persisted queries, subscriptions
  • gRPC reflection exposure, authentication, and metadata checks
  • SOAP / WSDL with WS-Security and custom XSD imports
  • WebSocket and Protobuf message exercising

• Post-exploitation

  Once a beachhead is confirmed, post-exploitation agents pivot deterministically — cloud metadata reads, file exfiltration, lateral movement — under sandbox guardrails.

  • Cloud-metadata role enumeration
  • Confirmed-LFI file exfiltration
  • Sandbox-bound command execution traces