Amnify Pentesting

Amnify Pentesting runs automated penetration tests against a running web application the user owns. A team of agents attacks the target within a user-defined scope and reports only findings that were exploited. How it works: - The user declares the target application and endpoints, and can add API documentation, a credential or source code. - Domain ownership is verified before any testing runs. - The user picks an engagement type (black, gray or white box) and a package (quick or deep). - An agent maps routes, roles and technologies, then agents test in parallel. - A finding is only recorded after a separate agent reproduces it with a working proof of concept. - In white-box runs, an agent fixes the root cause, re-runs the proof of concept and opens a pull request. Coverage: - Injection and execution (SQLi, RCE, template injection, XXE, insecure deserialization) - Access control (IDOR, CSRF, mass assignment, authentication and token handling) - Server side (SSRF, path traversal, request smuggling, open redirect, subdomain takeover) - Client and content (XSS, file upload and download handling) - Business logic, race conditions and chained attack paths - Prompt injection against AI features, and known vulnerable components Reporting: Findings appear in the Amnify platform alongside code and cloud findings. Deep runs also produce a PDF report with finding class, endpoint, CVSS 3.1 and 4.0 scores, CWE, OWASP ASVS references, proof of concept and evidence, intended for audits such as ISO/IEC 27001.