ScanexAI

Web Crawler

Guzzle HTTP client visits up to 25 pages within the target hostname. Maps page types, forms, query parameters, links, and headers. Subdomains are automatically enumerated.

Vulnerability Scanner

40+ rule-based detectors run across every crawled page, plus SSL inspection, API endpoint discovery, and domain-level checks (ports, DNS, reputation, default credentials).

Attack Graph Builder

Vulnerability combinations are matched against 14 chain templates. Matched chains produce Entry → Pivot → Impact → Crown Jewel node graphs with colour-coded steps.

Risk Scoring

A weighted composite score (0–100) is calculated from vulnerability density, attack chain severity, and critical exposure bonus.

AI Narrative

Optionally, Llama 3 via Groq writes an executive breach narrative explaining attack paths in plain English with remediation priorities.

PDF Report

DomPDF renders an executive-ready PDF with risk scores, attack chains, vulnerability table, and remediation steps.

Scan Comparison

Diff any two completed scans for the same domain: new issues, resolved findings, and unchanged vulnerabilities shown side-by-side.

Vulnerability Notes

Annotate findings with analyst status tags (Accepted Risk, False Positive, In Progress, Fixed) and free-text comments directly on the scan report.

Full Account Takeover

1. Brute-force login credentials

2. Authenticate as victim

3. Exploit IDOR to access other accounts

Data Exfiltration via API

1. Discover unauthenticated API endpoint

2. Enumerate via IDOR parameter

3. Extract sensitive data at scale

XSS → Session Hijack

1. Inject stored XSS payload

2. Payload fires on victim visit

3. Session token stolen

Admin Panel Takeover

1. Discover exposed admin panel

2. Brute-force credentials

3. Full admin access + RCE risk

Phishing via Open Redirect

1. Craft phishing URL via open redirect

2. Victim clicks trusted-looking link

3. Credentials harvested

Clickjacking + XSS

1. Embed site in iframe (no X-Frame-Options)

2. Overlay fake UI

3. Trigger XSS, steal session

Secrets Exfiltration

1. Source scan reveals hardcoded API key

2. Attacker calls third-party API

3. Data or billing abuse at scale

CORS Data Theft

1. Identify CORS wildcard origin

2. Craft cross-origin request from attacker page

3. Exfiltrate authenticated response data

Cookie Theft

1. Identify missing HttpOnly flag

2. Inject XSS payload

3. Read and exfiltrate session cookie

Directory Traversal + Secrets

1. Probe exposed /backup or /.env path

2. Download config file with DB credentials

3. Access production database directly

Insecure Cache Replay

1. Identify cached authenticated response

2. Replay cache from shared network or CDN

3. Access victim session data without auth

Subdomain Hijack

1. Find dangling CNAME to unclaimed service

2. Register attacker account on that service

3. Serve malicious content on legitimate subdomain

Default Credentials Takeover

1. Locate admin login panel

2. Submit default credential pairs

3. Full privileged access to application

AI Prompt Injection Chain

1. Inject adversarial prompt via user input field

2. Override system prompt instructions

3. Exfiltrate internal context or PII from AI response

REQUEST BODY

{ "url": "https://example.com" }

RESPONSE

{ "scanId": "uuid", "status": "running" }

RESPONSE

{ "id": "...", "status": "completed", "overall_risk": 74 }

RESPONSE

Array of vulnerability objects ordered by CVSS

RESPONSE

{ "graph": { nodes, edges }, "paths": [...] }

REQUEST BODY

{ "scanId": "uuid" }

RESPONSE

{ "narrative": "...", "source": "ai" }

RESPONSE

application/pdf binary