Consulting services
A penetration test your client can read and understand: web applications, APIs, mobile apps, cloud and infrastructure, with a person validating every finding.
home / products
our products
A security proof your client can check for themselves.
ExploitFinder combines penetration tests run by people with AI-assisted analysis. Every finding comes with the steps to reproduce it, every test starts from an authorised scope, and nothing leaves without human review.
the products
What you can use today, and what we are building.
Comparison pilot
Don't take our word for it, measure it. We take one application, verify it and compare it with the scanner you already use: you see what it adds, or what it confirms.
OWASP Assessment Compliace
Several engines working in one sequence of reconnaissance, scanning, tests and reporting. Passive or full profile, your choice: fewer tools to run by hand, more efficient results.
AI-Assisted Penetration Testing
A modular framework that reasons like a tester: it plans the checks, coordinates the tools and leaves the final decision to a person. We tell you how it really is, not how we would like it to be.
CVE and exploit archive
When a vulnerability is published, you know quickly whether it affects you. Search across ExploitDB, CVE and GitHub signals, with the context to decide what to fix first.
how the scanner works
Five phases, in this order.
Reconnaissance
The verified domain is mapped: HTTP headers, SSL, technologies and subdomains, passively. In the full profile, ports and services are added with Nmap.
Content discovery
A state-graph crawler maps pages, forms and flows. In single-page applications a real browser looks for hidden endpoints and DOM XSS. FFUF looks for directories and files.
Scanning
OWASP ZAP analyses the web application and Nuclei applies its templates: misconfigurations, exposures and vulnerabilities with known CVEs.
Targeted tests
In the full profile, SQLMap, XSStrike, Commix and SSRFmap check the most dangerous vulnerability classes. Access-control checks (IDOR/BOLA) compare the responses of several test accounts.
Report
One list of findings, with severity, evidence and the steps to reproduce them. Export to PDF or HTML, with references to ISO 27001, SOC 2, GDPR, NIST, HIPAA and OWASP Top 10.
engines
The tools inside the scanner, and what they do.
| Tool | What it does in the scanner |
|---|---|
| Nmap | Open ports, services and exposed versions (full profile) |
| OWASP ZAP | Dynamic analysis of the web application (DAST) |
| Nuclei | Templates for misconfigurations, exposures and known CVEs |
| FFUF | Search for hidden directories and files |
| SQLMap | SQL injection checks (full profile) |
| XSStrike | XSS checks (full profile) |
| Commix | Command injection checks (full profile) |
| SSRFmap | SSRF checks (full profile) |
Numbers. There are no published benchmark results yet. Until then we do not quote coverage or accuracy percentages.
the AI assistant
It reasons about the application, where a scanner stops at signatures.
IDOR and BOLA
Compares the responses of several test accounts, at least two, and establishes the owner of each object. It accepts sessions with cookies, tokens or form logins.
Business logic
Maps the states, roles and flows of the application. Each rule, meaning who can do what and in which order, becomes a written hypothesis, then it is tested.
New vulnerabilities (0-day)
Looks for flaws not yet known in the code and binaries the client provides, with coordinated disclosure. It does not work on third-party systems.
Priority by impact
Ranks every finding by business impact and exploitability. Serious findings pass through a person before the report.
How we measure it. We will compare the assistant with scanners and manual tests on the public benchmark. Until the results are published, we do not say it is faster or more accurate than a scanner or a person.
the value
Four things your client notices straight away.
A proof that reproduces
Every vulnerability comes with the steps to repeat it. If it does not reproduce, it does not enter the report as confirmed: no alarms that do not hold up.
Priority, not an endless list
Findings are ordered by technical risk, exploitability and impact. Unverified hypotheses stay separate, so the team knows where to start.
Never outside the scope
The domain is verified before every check. A hypothesis outside the scope is discarded and logged, never run. No surprises for your client.
A report written for two audiences
An executive summary for decision-makers, with risk and priority, and technical detail for the engineers who fix it, with the remediation plan.
our word
We only promise what we do.
What we guarantee
- Testing only domains the client owns or with written authorisation
- Domain verification before every check
- Human review before every report
- Reports with the steps to reproduce every finding
What we don't do
- Test third-party systems without permission
- Sell a scan as a penetration test
- Guarantee the absence of vulnerabilities
- Publish benchmark results before they are measured
transparency
What is ready, and what we are building.
| Part | Status |
|---|---|
| Penetration testing with human review | available |
| AI assistant on IDOR, BOLA and business logic | in development |
| New vulnerabilities in the client's code | on quote |
| Action log with chain of custody | prototype |
| Scope control and domain verification | prototype |
| Emergency stop for the whole scope | to complete before the first service |
| Public benchmark on test applications | in preparation |
| Client portal to follow the tests | roadmap |
objections
The most common objections, answered directly.
Can I have a site tested that is not mine?
No, and we say it first. It requires the written authorisation of the system owner: the test starts only after domain verification and signing of the statement.
Does AI replace the penetration tester?
No, it makes the work more efficient. AI organises the checks and the repetitive work; a person approves the scope, validates the findings and writes the report.
I already have a scanner. Why change?
You don't have to. The scanner stays in the workflow, but it is no longer the result: it finds what it knows, while the test reasons about roles, flows and business logic. The pilot shows you the difference on your own application.
Where do I start?
With a written request. The scope is defined and signed before any check, and the written quote arrives within 24 working hours.
Your next client will ask for proof. Prepare it now.
Request a written quote within 24 working hours. No domain is touched before verification and signing.