Autonomous Whitebox Pentester

It reads your source, attacks the running application, and reports only the vulnerabilities it can validate with a working exploit.

Schedule a technical demo Run it yourself

Five attack domains

Injection

SQLi, command, template

Traces user input from source to dangerous sink using the code graph, then fires structured payloads against each confirmed vector.

XSS

Reflected, stored, DOM-based

Finds sanitization gaps and context-escape bugs in render paths, then validates with real browser payloads executed via Playwright.

SSRF

Cloud metadata, internal services

Identifies server-side fetchers and URL parsers in code, then probes cloud metadata APIs, internal endpoints, and private services.

Auth

Broken auth, session handling

Reads session, token, and login logic directly from source, then tests bypass paths, fixation, and credential edge cases at runtime.

Authz

IDOR, privilege escalation

Maps object-ownership and role checks across controllers, then attempts horizontal and vertical access as real authenticated users.

How the pipeline works.

The Whitebox Pentester doesn't pattern-match. It forms vulnerability hypotheses, reasons about attack paths, and resolves each hypothesis by attempting a working proof-of-concept exploit. The pipeline runs specialized agents across 5 phases that follow the arc of a penetration test. It is the same engine as Shannon, Keygraph's open-source pentester, hardened for continuous runs on the platform.

Phase 1 · Pre-Recon

Code Analyst

Maps the codebase end-to-end: entry points, auth flows, database access, and security sinks. Static reasoning only. No browser yet.

Phase 3 · Vulnerability Analysis

Five analysts in parallel

Five specialists work in parallel. Their candidates, together with any from agentic code analysis, are merged and deduplicated into an exploitation queue for each domain.

Injection AnalystReviews how untrusted input flows into queries and shells.
XSS AnalystAudits how user input is rendered back into the DOM.
Auth AnalystReviews login, session, and password handling logic.
SSRF AnalystTraces user-controlled URLs reaching outbound HTTP clients.
Authz AnalystInspects how access decisions are enforced across resources.

Phase 4 · Exploitation

Paired exploiters

Each analyst hands off to a paired exploiter, and a sixth exploit agent takes demonstrable issues outside the five classes. Skipped if the queue is empty.

Injection ExploiterCrafts payloads, runs them live, confirms data leak or shell exec.
XSS ExploiterBuilds working payloads and validates execution in a real browser.
Auth ExploiterTries session takeover, MFA bypass, credential reuse against the app.
SSRF ExploiterProbes cloud metadata, internal ports, and URL filter bypasses live.
Authz ExploiterTests IDOR, vertical and horizontal escalation, broken access live.
Misc ExploiterAttempts exploits for issues outside the five standard classes.

Where it fits in the platform

The Whitebox Pentester is one of the Keygraph platform's testing modules. The others cover what it doesn't, and every finding any of them validates goes to one place, where it is deduplicated, fixed, and reported.

See it prove what's exploitable

Watch the pipeline run end-to-end against a real codebase, on a call with our engineering team, or clone the engine and run it yourself tonight.

Schedule a technical demo Run it yourself with Shannon