Attack Vectors

Attack vectors decide what the agents may attempt against your scope. You pick them in the Attack vectors step of the profile form, and agents plan their attacks within your selection. This page lists every vector, what it does, and what it may disturb.

Safe and Intrusive¶

Every vector carries a safety label:

Safe vectors only observe. They don't sign in and don't change anything on the target.
Intrusive vectors act on the target. They can lock accounts, fill logs, or slow a service down. Select them only with written authorization from the owner of every target in scope.

For a first run on production systems, select only the safe vectors. Add intrusive ones once you've agreed on a test window with the service owners.

Vectors¶

Vector	Safety	What the agent does
Exposed Services	Safe	Finds services listening on the hosts in scope. It doesn't sign in.
Insecure Configuration	Safe	Reads exposed configuration. It doesn't change settings.
TLS Configuration	Safe	Checks certificates and protocol settings. It doesn't alter the service.
Remote Administrator Exposure	Safe	Looks for reachable remote admin interfaces. It doesn't sign in.
Default Credentials	Intrusive	Tries well-known default passwords. This can lock accounts.
Authentication Enumeration	Intrusive	Probes which accounts exist. This can fill logs.
Injections	Intrusive	Sends injection payloads. This can disturb the services in scope.
Rate-limit Weaknesses	Intrusive	Sends repeated requests. This can throttle the service.
Weak Credentials	Intrusive	Guesses or brute-forces credentials of discovered services. This can lock accounts.
Authentication Bypass	Intrusive	Attempts to bypass authentication. It doesn't brute-force credentials.
Unpatched Known Vulnerabilities	Intrusive	Tries to exploit the CVEs that match each service version, using public proofs of concept. This can disturb the services in scope.

With Unpatched Known Vulnerabilities selected, agents look up the CVEs for every fingerprinted service version, search for a public proof of concept, and try to exploit each one. Only exploited CVEs are reported with their proof. Denial-of-service CVEs are reported without being run.

Without it, CVEs matching a service version are reported at Info severity, without testing.

What Agents Look For¶

Within the vectors you allow, agents use checks built for network services:

Exposed services: unauthenticated datastores, JDWP debug ports, Node.js inspector ports, exposed PHP-FPM, SNMP with default read or write communities, and Modbus devices that accept unauthenticated writes.
Credentials: vendor-documented default credentials on services that authenticate, and SSH password testing paced to respect OpenSSH source penalties.
TLS: SSLv3, TLS 1.0 and 1.1, RC4, 3DES (Sweet32), CBC ciphers on TLS 1.0 (BEAST), NULL and anonymous ciphers, small RSA keys, SHA-1 certificate signatures, and expired, self-signed, or name-mismatched certificates.
DNS: zone transfers, open recursive resolvers, unauthenticated dynamic updates, DNS version disclosure, DNSSEC turned off, private IP addresses in public records, and sensitive data in TXT records.
Web surfaces: basic checks on web servers found on open ports, including server configuration disclosure.

Rules Every Agent Follows¶

Whatever vectors you select:

Testing stays non-destructive.
Port scans stay bounded.
Denial-of-service CVEs are reported, never run.
SQL and NoSQL injections are proven with read-only oracles. Agents never modify or delete your data.
Every finding is reproduced by a separate reporter agent, with its own evidence, before it becomes an issue.

Not Tested¶

AI Network Pentesting doesn't cover:

Signed-in application testing: access control, business logic, and authenticated API flows. Use AI Pentesting.
Active Directory.
Phishing and social engineering.
Asset discovery beyond the scope you enter, such as subdomain enumeration.

Guardrails: rate limit, duration, and stopping an assessment
Scope: which targets the vectors apply to
Results: how findings and their proof appear