Skip to content

Supported Targets

Escape discovers and tests the targets below. Discovery support and testing depth vary by product.

APIs

  • REST: OpenAPI 3.x, Swagger 2, Postman collections, or endpoints extracted from crawling and recorded HAR/Burp exports. See REST API DAST.
  • GraphQL: SDL or introspection-based discovery, queries, mutations, and subscriptions. See GraphQL API DAST.
  • gRPC: discovered and classified by ASM service discovery.
  • SOAP: discovered and classified by ASM service discovery. Deep DAST testing is available for REST, GraphQL, and web applications.

Web Applications

  • Single-page apps (SPA): React, Vue, Angular, Svelte, and similar; agentic crawling + browser-driven DAST.
  • Server-rendered apps: Rails, Django, Spring, Next.js (SSR), and similar.
  • Progressive web apps (PWA): browser-accessible pages and APIs. Testing is not generic. AI Pentesting and DAST fingerprint the stack from live responses (headers, error messages, cookies, routing behavior), then craft payloads for what they find.

AI and LLM Surfaces

  • LLM-backed APIs: chat completions, RAG endpoints, function-calling surfaces. OWASP LLM Top 10 coverage. See LLM Security.
  • AI applications: agentic apps that wrap an LLM with tools and state.
  • MCP servers: Model Context Protocol servers exposed over HTTP.

Infrastructure and Discovery

  • Domains and subdomains: owned DNS, inferred from certificates and routing, and monitored for drift.
  • CIDR ranges: IPv4 ranges of /24 or narrower, either public or private through a Private Location. See Network Scanning for wider-range requirements.
  • Ports and services: TCP port scanning with service fingerprinting. See Network Scanning.
  • Cloud accounts: AWS, GCP, Azure inventory through the ASM Integrations.

Client and Infrastructure Scope

  • Native desktop applications: Escape tests their backend services. Testing the desktop client is outside this scope.
  • Kernel and firmware testing: outside Escape's application and API testing scope.

If your stack isn't listed and you think it should be, write to support@escape.tech.