Skip to content

What NodeZero Tests

The following sections describe the vulnerability classes that the WebApp pentest currently covers, and the major areas outside current coverage.

Covered Attack Classes

Current coverage includes:

  • Reflected and stored XSS (cross-site scripting).
  • SQLi (Structured Query Language injection), including error-based, timed, stack-based, and UNION (SQL UNION-based) techniques.
  • SSRF (server-side request forgery).
  • Broken access control, including IDOR (Insecure Direct Object Reference), BOLA (Broken Object Level Authorization), and sensitive information disclosure.
  • SQLi-based and JWT (JSON Web Token)–related authentication bypass.
  • Global LFI (local file inclusion).
  • OS command injection.
  • Reflected and stored SSTI (server-side template injection).
  • Open redirects.
  • XXE (XML external entity).

These capabilities are assessed through autonomous, black-box runtime testing. NodeZero reports proof-based findings for the routes, methods, parameters, and authentication states it can reach and validate. This list describes current attack coverage; it should not be interpreted as complete coverage of every OWASP (Open Worldwide Application Security Project) category or vulnerability subtype.

Broken-Access-Control Testing

Broken-access-control testing uses discovered routes plus multiple credentialed roles to exercise authorization behavior. When more than one credential set is configured, NodeZero attempts cross-role access, manipulates object identifiers and parameters, and records real request and response evidence for confirmed authorization failures.

This coverage maps primarily to A01:2025 Broken Access Control, and includes IDOR- and BOLA-style testing.

Injection Testing

Injection coverage includes SQLi, XSS, OS command injection, SSTI, and XXE.

SQLi testing covers error-based, timed, stack-based, and UNION variants, while XSS coverage includes reflected and stored execution paths.

NodeZero validates exploitable behavior at runtime, and includes request, response, payload, and other available proof artifacts with confirmed findings.

This coverage maps primarily to A05:2025 Injection.

SSRF Testing

SSRF testing evaluates server-side URL-fetching behavior exposed through discovered routes and parameters. SSRF is not included in the OWASP Top 10:2025.

Current Coverage Exclusions

Current exclusions include:

  • DOM-based XSS.
  • Restricted LFI.
  • Race conditions.
  • TOCTOU (Time-of-Check to Time-of-Use).
  • CSTI (Client-Side Template Injection).
  • GraphQL-specific depth and batching issues.
  • Business-logic flaws in general.

Coverage in Development

The WebApp pentest's coverage is actively expanding. Current development is focused on four areas:

  • Surface discovery – Broader enumeration of routes and parameters that aren't directly linked or easily discoverable through crawling alone.
  • Authentication and authorization – Deeper coverage of token-based weaknesses, RBAC (role-based access control), and common implementation flaws in modern auth flows.
  • Injection and client-side attacks – Additional runtime coverage for injection and client-side manipulation classes not yet part of default testing.
  • Complex and high-impact classes – Extending into higher-complexity areas such as file processing, deserialization, cache behavior, and emerging attack surfaces.

NodeZero tests applications from the outside, at runtime, without ingesting source code. The exception is exploitation itself: a confirmed LFI finding might expose source files as proof of access – but that is attack confirmation, not static analysis. Vulnerability categories that require code-level visibility, dependency inspection, build-pipeline access, or continuous operational monitoring fall outside what any black-box runtime engine can assess:

  • A03:2025 Software Supply Chain Failures – requires dependency and build-artifact analysis.
  • A04:2025 Cryptographic Failures – full assessment requires inspecting key management code and configuration outside the HTTP layer.
  • A06:2025 Insecure Design – requires access to architectural design documents and threat models.
  • A08:2025 Software or Data Integrity Failures – requires build-pipeline and integrity-verification visibility.
  • A09:2025 Security Logging and Alerting Failures – requires operational access to logging infrastructure.
  • A10:2025 Mishandling of Exceptional Conditions – requires code-path and error-handling analysis.

NodeZero's full platform covers significant ground across these categories – internal and external pentests identify unpatched services, exposed administrative interfaces, and exploitable misconfigurations that contribute real findings to A03, A06, A09, and A10. Full OWASP coverage of all six categories also requires source-code, dependency, or operational analysis; that constraint is inherent to the analysis type, not specific to NodeZero.

GraphQL Coverage

GraphQL endpoints might be discovered and tested with the standard injection and authentication-bypass checks used elsewhere in the WebApp test. GraphQL-specific issues such as introspection misuse, batching abuse, query-depth abuse, and other schema-specific weaknesses are not currently covered.

File Upload, Deserialization, and Business-Logic Coverage

Image upload exploits and general deserialization coverage are under active development. XXE (XML external entity) is covered as an injection-related parsing weakness; its coverage should not be interpreted as general deserialization coverage. General business-logic flaw coverage is not currently included.