Real reports from GGSec Cortex against deliberately-vulnerable test applications. Same layout you get on your own scan — executive summary, evidence-graded findings, reproducible proof-of-concept, risk matrix, remediation plan and compliance mapping.
Each report is the unmodified output of a real Cortex run — open the HTML to explore it interactively, or download the PDF.
The complete engine on a broad attack surface: SQL injection, reflected & stored XSS, JWT attacks, IDOR, XXE, PHP object injection — plus the native HTTP request-smuggling / desync module, known-CVE / dependency scanning and hard-coded-secret detection. Shows the evidence-tiered scoring end to end.
A single PHP application, examined in depth: reflected & stored XSS, SQL injection, LDAP injection, server-side template injection, path traversal, file-upload → RCE and prototype pollution — each finding backed by a reproducible proof-of-concept and mapped to MITRE ATT&CK.
A focused look at the kind of flaw pattern-only scanners miss: Server-Side Template Injection (second-order, store → render) and NoSQL injection. The AI follows the data flow; the dynamic engine proves execution — cleanly scored, low noise.
Vulnerabilities with zero visible response, proven anyway. The built-in collaborator captures the callback the target makes back to us: blind SSRF and a blind PHP object-injection → RCE gadget (deserialize → __destruct → outbound request) — each confirmed by an out-of-band HTTP callback, not guesswork.
These reports are from deliberately-vulnerable test applications. Point GGSec Cortex at your own environment and get the same client-ready output — evidence-graded findings, a prioritised fix plan and compliance mapping.
Reports were generated against intentionally-vulnerable test applications. For authorised security testing only. · GG Advanced IT Security — ggsec.de
