Find real vulnerabilities. Prove them. Fix them.
A hybrid application-security scanner that reads your source with AI, then confirms every finding against your running application with hard evidence — so your team spends time on real risks, not on triaging false positives.
Two short technology demos — a full scan from source to live-proven finding, and a deep dive into one of the toughest classes to detect: client-side request desynchronisation.
Most scanners flood you with pattern matches. Cortex reads the code like an analyst, proves what is exploitable against the live app, and scores it honestly.
It follows data from input to sink and recognises framework protections — global output-encoding, token-based CSRF, whitelist validation — so it flags what is genuinely exploitable, not every string that looks dangerous. A call-graph reachability pass then drops sinks no entry point can actually reach.
Every dynamic finding is confirmed with tangible evidence: out-of-band callbacks, response reflections with byte offsets, timing signals, command output — even reading a real value out of the database to prove a blind SQL injection. If it can't be proven, it is clearly labelled as such.
An admin-only, unconfirmed issue is not reported at the same level as a proven, internet-facing one. Confirmed desync ranks above a likely parser anomaly — evidence drives the score.
Executive summary, attack graph, 5×5 risk matrix, per-finding proof-of-concept, remediation plan with SLAs and compliance mapping — output your clients and auditors can read without a security degree.
High-end techniques normally reserved for manual penetration testing — automated, evidence-graded, and safe to run.
Real output. Genuine front-end/back-end desyncs are proven with a multi-second timing hang and reported as Critical; weaker parser anomalies drop to a "Likely / verify" tier at a lower score. A per-scan negative-control set proves the engine isn't crying wolf.
A raw-socket module that emits the ambiguous framing normal clients can't — CL.TE, TE.CL, TE.TE and CL.0 / 0.CL, including the 2025 Expect: 100-continue–triggered variant — each confirmed by a timing-differential signal. The HTTP/1.1 foundation the HTTP/2 downgrade family (below) builds on.
The 2025 class of browser-weaponizable HTTP desync — a CRLF injected from the request path into the upstream request (the nginx $uri footgun). Cortex grades it on an honest evidence ladder: header injection → smuggled 2nd request → response-queue poisoning. It only claims the top severity once a victim request is actually served an attacker-controlled response — reproduced in a real headless browser — and a race-free dangling-byte variant makes exploitation deterministic.
The stateful cousin of request smuggling — no malformed framing required. Cortex proves first-request validation bypass (a front-end that access-controls only the first request on a keep-alive connection, then forwards the rest unchecked to the back-end) and connection-locked routing (a bogus / internal Host reaching the back-end the first request pinned) with a crisp fresh-vs-reused differential that reproduces 2/2 — and stays silent on a compliant server (CWE-444, PortSwigger Browser-Powered Desync).
Safe, passive exposure check for the modern HTTP/2 resource-exhaustion classes — Rapid Reset (CVE-2023-44487) and CONTINUATION flood (CVE-2024-27316). Cortex negotiates HTTP/2 (h2c or h2-over-TLS) and reads the server’s SETTINGS frame: an unbounded MAX_CONCURRENT_STREAMS or an unadvertised MAX_HEADER_LIST_SIZE is surfaced as the exposure surface — without ever flooding the target (the DoS is volume-based and unsafe to prove), so it is scored an honest Low and confirmed by version→CVE.
A generate → replay → learn loop mutates thousands of raw framing variants — obfuscated Transfer-Encoding, duplicate Content-Length, Content-Length & chunk-size value tricks (leading zeros, hex, sign, whitespace), chunk extensions, exotic line endings, dangling bodies — replays them over a raw socket, and feeds the ones that break the parser back into itself, surfacing novel parser-differentials no static payload list contains.
Last-byte-synchronised single-packet delivery lands concurrent requests inside a ~1 ms window to surface sub-millisecond race conditions that burst-based tools miss.
A built-in collaborator proves blind SSRF, XXE and object-injection by capturing the callback the target makes back to us — or, when no callback returns (egress-filtered), a redirect-loop confirms the blind request from its in-band symptom alone. A confirmed SSRF is then walked into cloud metadata (AWS IMDS) to demonstrate live credential theft.
The 2025 class modern query builders (Prisma, ActiveRecord, Sequelize, Django) expose: a user-controlled filter object reaches the ORM where clause, so columns that are never returned — passwords, tokens, PII — become a boolean oracle. Cortex confirms the operator injection against a matched control, then extracts the hidden value character-by-character (CWE-943) — now also across related models (relationship traversal) and filters delivered in the query string, a JSON body or GraphQL where-args — a data-exfiltration class general-purpose scanners don't test for.
Beyond alg=none: Cortex forges tokens with an attacker key smuggled in the header itself — jwk (embedded key) and jku (a key set hosted on our collaborator) — plus RS256→HS256 confusion and kid path-traversal. On the OAuth 2.0 / OIDC flow it drives the real authorize→token exchange to prove redirect_uri validation bypass (the authorization code is redirected to attacker infrastructure), PKCE downgrade, authorization-code replay, scope-upgrade, missing-state / CSRF and mix-up (iss) confusion (RFC 9207) — the account-takeover primitives auditors ask about (CWE-347 / 601 / 269 / 352 / 346).
The federation attacks that take the whole tenant, not one account. SAML signature-wrapping (XSW) — the IdP signs a user assertion but the SP consumes a forged admin one wrapped beside it; SAML XXE via the SAMLResponse (file read / blind OOB); OIDC audience-confusion — a validly-signed token minted for a different client is accepted; and SCIM anonymous provisioning that mints an admin with an unauthenticated POST /scim/v2/Users. Each is proven with a differential oracle — the forged identity is accepted and a broken-signature control is rejected — so a compliant IdP stays at zero findings (CWE-347 / 611 / 287 / 306).
The complete request-smuggling surface — matching what the leading specialist smuggling scanners test, and going past them. New in 1.4: the whole HTTP/2 downgrade family — pseudo-header injection (:method / :path / :scheme / :authority), fake & duplicate pseudo-headers, and H2.TE / H2.CL tunnelling — real ALPN-h2 frames + HPACK, not a library shortcut — plus a header-removal parser-discrepancy scan. Each is proven differentially: a benign follow-up on the same connection is served the smuggled response. On top of the classes those tools don't have (client-side desync, connection-state, the HttpOnly worm), it's the deepest smuggling engine in a single tool (CWE-444).
A value reflected from an unkeyed input — a forwarding header (X-Forwarded-Host and ten more), a cloaked query parameter the cache omits from its key, or a fat-GET request body — is primed into a shared cache entry, then served to every later visitor. Cortex confirms it end-to-end: poison, re-fetch the same key with a clean request, and prove the marker survives as a cache HIT (CWE-349).
Stored/second-order XSS and SSTI (store → render), plus an attack graph that chains individual findings into realistic end-to-end paths an attacker would actually walk.
The source-reading AI is defended against instructions hidden inside the code it analyses — so a malicious comment can't steer the scanner. Security tooling that is itself secure.
Tests the AI features in your application: Cortex proves excessive agency when an agent follows instructions hidden in fetched content and invokes a privileged tool the user never asked for — the OWASP LLM Top-10 risk classic scanners can't see.
The RAG risk: attacker content stored in a note, document or profile is later pulled into another user's model prompt. Cortex plants a poisoned record, triggers the summary, and confirms it out-of-band — the injected instruction makes the model fetch an attacker URL, landing a real callback on our collaborator (data exfiltration / SSRF-via-LLM), not merely a reflected flag (OWASP LLM01 / CWE-1427).
Real-time CVE feeds and exploit-prediction scoring push what attackers are most likely to weaponise to the top of the queue — beyond a static vulnerability database.
Beyond injection: Cortex mutates price, quantity and discount inputs (negative amounts, >100% discounts, integer overflow) and checks a server-side invariant — a total that can never go below zero. When the maths breaks it is proven financial fraud with no payload at all — the class that costs real money.
Where it matters, Cortex confirms a finding in an actual browser: DOM-based XSS is fired and observed in headless Chrome/Edge, and a client-side desync worm is reproduced end-to-end — HttpOnly session-cookie theft the JavaScript console itself can't read — so the proof is the exploit, not a heuristic.
Classic DAST sees only input and output. IAST (Interactive AST) is an optional grey-box sensor that runs on your server and, during a Cortex scan, confirms a finding with the exact file:line and the real query that reached the sink — so your source never leaves your infrastructure.
One line to install (auto_prepend_file), off by default, active only for HMAC-signed scan requests — the sensor never sees real user traffic. A DAST Likely becomes Confirmed at a precise file:line, and a blind sink the sensor observes tainted-reach is promoted to Confirmed — without the client uploading any source.
file:line, not guessworkA dynamic Likely becomes Confirmed at admin.php:42, with the exact argument that reached the query. Triage drops from hours to seconds.
The sensor runs on your host; only sink events return to the operator — never code, never user data. Confidentiality and compliance stay entirely on your side.
A single auto_prepend_file entry. Active only for requests carrying a valid per-scan HMAC signature; sink events ride back inline on the same response — no second request, no temp files. Clean uninstall: remove the line.
An event is marked tainted only when the payload bytes actually reach the sink, so promoting a blind case to Confirmed takes hard server-side proof — not a heuristic. Sink families are matched, so SQLi proof never attaches to a file-read finding.
Request smuggling (HTTP desync, CWE-444) is where a front-end and a back-end disagree on where one request ends, so an attacker prepends bytes to the next visitor's request. 1.4 completes the surface — the full HTTP/2 pseudo-header family and a header-removal discrepancy scan — and adds a Visual Debugger view that draws the parser disagreement, so the finding is explainable in one glance, not a wall of raw bytes.
The same tab takes a hand-pasted raw request and sends it verbatim over a raw socket (no normalisation) — a raw-request Repeater for desync — while the split diagram makes the impact obvious to a non-specialist audience.
The full HTTP/2 smuggling set, in pure managed code: pseudo-header injection (:method / :path / :scheme / :authority), fake & duplicate pseudo-headers, and H2.TE / H2.CL tunnelling — over a real ALPN-h2 TLS connection against a naive H2→HTTP/1.1 downgrade.
Removes each framing header (Transfer-Encoding / Content-Length / Connection / Host) in turn and diffs the raw response against a baseline. A reproducible change means the two hops parse framing differently — a smuggling precursor, flagged before it's weaponised.
The Visual Debugger “Smuggler” tab renders one wire as two conflicting framings — front-end sees one request, back-end sees two — with the smuggled request highlighted. The kind of proof a client signs off on.
Parser-discrepancy, CL.0, client-side / pause-based / connection-state / chunk-size, the HTTP/2 family and header removal — the complete request-smuggling surface the specialist scanners cover. Plus classes they lack: the client-side-desync worm, OOB routing-confusion and an autonomous desync-discovery loop.
The frontier: the pseudo-header family carried one protocol up, over a real ALPN-h3 QUIC connection with hand-crafted QPACK — :method / :path / :scheme / :authority injection, plus raw-QPACK anomalies a byte inspector can't see: a CR/LF hidden inside a Huffman-encoded :path, or smuggled through a dynamic-table insert on the QPACK encoder stream. A QPACK-tolerance probe additionally flags a decoder that accepts malformed field sections a compliant one must reject (QPACK_DECOMPRESSION_FAILED) — the precondition for an H3→HTTP/1.1 downgrade desync. Proven differentially against a controlled H3 front-end and single-steppable in the Visual Debugger (CWE-444).
From classic injection to modern desync, business-logic abuse and supply-chain risk — SAST reads the code, DAST proves it on the running application.
Marshal/YAML, Java (URLDNS gadget, out-of-band DNS-confirmed) & .NET (BinaryFormatter / ViewState) gadget chains — passive magic-byte detection plus active proof with a benign canary (CWE-502)where-clause → boolean-oracle exfiltration of hidden columns, incl. relationship traversal and JSON / GraphQL filters (CWE-943)Professional HTML & PDF in one normalized document — even across several targets/ports: executive summary, Methodology & Limitations, assessment scope, visual attack graph, 5×5 risk matrix, a Client Action Summary (P0/P1/P2) above a prioritised remediation plan (with SLAs), and per finding a reproducible proof-of-concept, evidence excerpt, an honest confidence tier (Confirmed / Primitive / Likely / Potential — no overclaiming), plain-language description and MITRE ATT&CK mapping. Advisory before/after fix diffs — your files are never modified. A unified engagement report can also merge several separate scans — SAST, DAST, desync — into a single client deliverable with a combined findings table and severity breakdown.
Every finding maps to OWASP Top 10, PCI-DSS v4.0, ISO/IEC 27001:2022 and GDPR — ready for audit and client deliverables straight out of the scan.
SARIF 2.1.0 (GitHub Security tab), JUnit XML (Jenkins/GitLab), native DefectDojo import. Pipeline gate fails a build on chosen severity; baseline mode fails only on new issues; scan-to-scan diff tracks regressions. A zero-cost source gate — including secret scanning — runs in CI with no live target and no AI key.
Six ways in: session cookies, form login, HTTP Basic, header / bearer / API-key tokens, OAuth 2.0 client-credentials and mutual-TLS client certificates — with automatic CSRF-token & nonce handling. Define named identities (admin, customer, anonymous) and let Cortex replay findings across them to surface broken access control.
Rate-limiting — with adaptive back-off when the target pushes back (429/503) — plus host scoping and exclusions keep testing in-scope and gentle on production. Intrusive modules are opt-in and never run in a default preset.
Drive testing from an OpenAPI spec — or replay a proxy capture (XML / HAR export) straight into the engine; replay a previous plan for fast, free iteration. Efficient AI usage keeps large-codebase scans cost-controlled.
Native application — scans source directories or single files, and probes live web apps over HTTP/S — or a whole list of hosts in one fleet run with a combined report. For internal AppSec teams, penetration testers and MSSPs producing client-ready reports.
Request a demo or a pilot scan and get a client-ready report — proof, severity you can trust, and a prioritised fix plan.
For authorised security testing only. Always scan systems you own or have explicit permission to assess. · GG Advanced IT Security — ggsec.de