Scope
Reads the request and the signed scope. Marks what is inside and what is outside.
home / products
product
ExploitFinder: AI-assisted penetration testing platform
An AI-assisted analysis system that runs tests following a fixed method. It stops whenever a human decision is needed.
the six stages
Each stage has one job and does not do the others' jobs.
Recon
Maps the verified domain: pages, endpoints, visible roles.
Plan
Proposes test hypotheses, each with a written reason.
Test executor
Runs only actions from a closed list. Logs every request and response.
Critical review
Tries to break conclusions before they reach a person.
Report writer
Drafts the report with the steps to reproduce each vulnerability.
human control
Three points where a person decides.
Before testing
Scope and hypotheses are approved by a person. A hypothesis outside the scope is not run.
After testing
A vulnerability is confirmed only if the finding is reproducible and a person has assigned the severity.
Before the report
No document reaches the client without review. The reviewer can change the severity or discard the point.
the platform
It starts from the authorised scope.
Every test begins by naming the target, which must fall within an authorised scope. You can set a priority (IDOR/BOLA, SSRF, RCE), add instructions and, if needed, provide authentication.
Screenshot of the ExploitFinder platform.
product status
What is ready and what is not.
This is the architecture planned for the services. What is still a prototype or on the roadmap is stated as such.
| Part | Status |
|---|---|
| Action log with chain of custody | prototype |
| Scope control and domain verification | prototype |
| Human review and verdict for each vulnerability | prototype |
| Analysis connected to a language model | in progress |
| Public benchmark on test applications | in progress |
| Emergency stop for the whole scope | to complete before the first service |
| Client portal to follow tests | roadmap |
Want to see the flow on one of your applications?
It starts from a written proposal, with the scope signed before any test.