Find real vulnerabilities. Prove them. Fix them.
A hybrid application-security scanner that reads your source with AI, then confirms every finding against your running application with hard evidence — so your team spends time on real risks, not on triaging false positives.
Most scanners flood you with pattern matches. Cortex reads the code like an analyst, proves what is exploitable against the live app, and scores it honestly.
It follows data from input to sink and recognises framework protections — global output-encoding, token-based CSRF, whitelist validation — so it flags what is genuinely exploitable, not every string that looks dangerous.
Every dynamic finding is confirmed with tangible evidence: out-of-band callbacks, response reflections with byte offsets, timing signals, command output — even reading a real value out of the database to prove a blind SQL injection. If it can't be proven, it is clearly labelled as such.
An admin-only, unconfirmed issue is not reported at the same level as a proven, internet-facing one. Confirmed desync ranks above a likely parser anomaly — evidence drives the score.
Executive summary, attack graph, 5×5 risk matrix, per-finding proof-of-concept, remediation plan with SLAs and compliance mapping — output your clients and auditors can read without a security degree.
High-end techniques normally reserved for manual penetration testing — automated, evidence-graded, and safe to run.
Real output. Genuine front-end/back-end desyncs are proven with a multi-second timing hang and reported as Critical; weaker parser anomalies drop to a "Likely / verify" tier at a lower score. A per-scan negative-control set proves the engine isn't crying wolf.
A raw-socket module that emits the ambiguous framing normal clients can't — CL.TE, TE.CL, TE.TE, CL.0/0.CL, plus HTTP/2 H2.CL / H2.TE downgrade desync (real HTTP/2 frames + HPACK) — confirmed by timing-differential signals.
The 2025 class of browser-weaponizable HTTP desync — a CRLF injected from the request path into the upstream request (the nginx $uri footgun). Cortex grades it on an honest evidence ladder: header injection → smuggled 2nd request → response-queue poisoning. It only claims the top severity once a victim request is actually served an attacker-controlled response — reproduced in a real headless browser — and a race-free dangling-byte variant makes exploitation deterministic.
A generate → replay → learn loop mutates thousands of raw framing variants — obfuscated Transfer-Encoding, duplicate Content-Length, Content-Length & chunk-size value tricks (leading zeros, hex, sign, whitespace), chunk extensions, exotic line endings, dangling bodies — replays them over a raw socket, and feeds the ones that break the parser back into itself, surfacing novel parser-differentials no static payload list contains.
Last-byte-synchronised single-packet delivery lands concurrent requests inside a ~1 ms window to surface sub-millisecond race conditions that burst-based tools miss.
A built-in collaborator proves blind SSRF, XXE and object-injection by capturing the callback the target makes back to us — or, when no callback returns (egress-filtered), a redirect-loop confirms the blind request from its in-band symptom alone. A confirmed SSRF is then walked into cloud metadata (AWS IMDS) to demonstrate live credential theft.
The 2025 class modern query builders (Prisma, ActiveRecord, Sequelize, Django) expose: a user-controlled filter object reaches the ORM where clause, so columns that are never returned — passwords, tokens, PII — become a boolean oracle. Cortex confirms the operator injection against a matched control, then extracts the hidden value character-by-character (CWE-943) — a data-exfiltration class general-purpose scanners don't test for.
Stored/second-order XSS and SSTI (store → render), plus an attack graph that chains individual findings into realistic end-to-end paths an attacker would actually walk.
The source-reading AI is defended against instructions hidden inside the code it analyses — so a malicious comment can't steer the scanner. Security tooling that is itself secure.
Tests the AI features in your application: Cortex proves indirect prompt injection and excessive agency when an agent follows instructions hidden in fetched content and invokes a privileged tool the user never asked for — the OWASP LLM Top-10 risk classic scanners can't see.
Real-time CVE feeds and exploit-prediction scoring push what attackers are most likely to weaponise to the top of the queue — beyond a static vulnerability database.
Beyond injection: Cortex mutates price, quantity and discount inputs (negative amounts, >100% discounts, integer overflow) and checks a server-side invariant — a total that can never go below zero. When the maths breaks it is proven financial fraud with no payload at all — the class that costs real money.
From classic injection to modern desync, business-logic abuse and supply-chain risk — SAST reads the code, DAST proves it on the running application.
Marshal/YAML gadget chains (CWE-502)where-clause → boolean-oracle exfiltration of hidden columns (CWE-943)Professional HTML & PDF in one normalized document — even across several targets/ports: executive summary, Methodology & Limitations, assessment scope, visual attack graph, 5×5 risk matrix, a Client Action Summary (P0/P1/P2) above a prioritised remediation plan (with SLAs), and per finding a reproducible proof-of-concept, evidence excerpt, an honest confidence tier (Confirmed / Primitive / Likely / Potential — no overclaiming), plain-language description and MITRE ATT&CK mapping. Advisory before/after fix diffs — your files are never modified.
Every finding maps to OWASP Top 10, PCI-DSS v4.0, ISO/IEC 27001:2022 and GDPR — ready for audit and client deliverables straight out of the scan.
SARIF 2.1.0 (GitHub Security tab), JUnit XML (Jenkins/GitLab), native DefectDojo import. Pipeline gate fails a build on chosen severity; baseline mode fails only on new issues; scan-to-scan diff tracks regressions. A zero-cost source gate — including secret scanning — runs in CI with no live target and no AI key.
Six ways in: session cookies, form login, HTTP Basic, header / bearer / API-key tokens, OAuth 2.0 client-credentials and mutual-TLS client certificates — with automatic CSRF-token & nonce handling. Define named identities (admin, customer, anonymous) and let Cortex replay findings across them to surface broken access control.
Rate-limiting — with adaptive back-off when the target pushes back (429/503) — plus host scoping and exclusions keep testing in-scope and gentle on production. Intrusive modules are opt-in and never run in a default preset.
Drive testing from an OpenAPI spec — or replay a Burp / OWASP-ZAP proxy capture straight into the engine; replay a previous plan for fast, free iteration. Efficient AI usage keeps large-codebase scans cost-controlled.
Native application — scans source directories or single files, and probes live web apps over HTTP/S. For internal AppSec teams, penetration testers and MSSPs producing client-ready reports.
Request a demo or a pilot scan and get a client-ready report — proof, severity you can trust, and a prioritised fix plan.
For authorised security testing only. Always scan systems you own or have explicit permission to assess. · GG Advanced IT Security — ggsec.de