Skip to main content
AQIRA
Book a demo
AQIRA

Menu

Book a demo

Solutions / Web and API

Web application and API penetration testing, from the outside in

From one domain, ORION maps the subdomains, hosts, services and APIs reachable from the internet, VEGA tests input handling, sessions and headers, and NOVA proves what is exploitable with benign proof.

Book a demoHow an assessment runs
You provide
A domain
Intensity
Reconnaissance, Standard, Deep
Scored against
OWASP Top 10, NIST CSF 2.0, NIST SP 800-53, NIST SP 800-171, COBIT
Plans
On every plan: Standard is priced per domain, Premium includes 5 domains and Enterprise 20. Compare the plans
AQIRA consoleNew assessmentProduct UI, demo data
AQIRA's New assessment dialog with Domain selected: a hostname field, the three intensities from passive reconnaissance to deep, and the authorisation checkbox.AQIRA's New assessment dialog with Domain selected: a hostname field, the three intensities from passive reconnaissance to deep, and the authorisation checkbox.
The New assessment step for a domain: the hostname, the three intensities and the authorisation checkbox.View full size: the New assessment screenView full size: the New assessment screen

What you hand AQIRA

On a domain, the New assessment step asks for the following.

You provide
A domain. The agents work outward to the subdomains, hosts, services and APIs an attacker could reach.
Access
Nothing to grant. The operator confirms authorisation for the target before anything active runs.
Authorisation
Standard and Deep start only once the operator confirms: I am authorized to run active security testing against this target.
Intensity
  • Reconnaissance. Maps the attack surface without exploitation. No authorisation needed.
  • Standard. Active testing with safe, non-destructive proofs of concept.
  • Deep. Chained, in-depth exploitation to prove impact. Still non-destructive.

What each input's access allows, and how AQIRA keeps it to the least it needs, is on the security page.

ORION, VEGA, ATLAS, NOVA, POLARIS, SCRIBE

What each agent does on this input

The same six agents, in the same order; on a domain this is the work.

  1. 01ORIONReconnaissance

    Maps the public attack surface.

    • Open-source intel
    • DNS intelligence
    • Vulnerability correlation
    • Source-code review

  2. 02VEGAWeb and API Security

    Probes web and API input handling, sessions and headers.

    • Source-code review
    • Dependency risk
    • Integration scanning

  3. 03ATLASInfrastructure and Configuration

    Assesses cloud, transport and the internal segment.

    • Cloud posture
    • DNS intelligence
    • Dependency risk
    • Vulnerability correlation

  4. 04NOVAExploitability Validation

    Validates exploitability to benign proof.

    • Offensive toolchain
    • Vulnerability correlation
    • Browser attack paths
    • Breach exposure
    • Hidden-data inspection
    • Remote-asset exposure

  5. 05POLARISReview and Reporting

    Consolidates what the others found. Scores the findings against OWASP Top 10 and the NIST and COBIT controls they touch.

  6. 06SCRIBEReport

    Writes the client-deliverable report from the same evidence the console shows.

AQIRA consoleLive consoleProduct UI, demo data
The AQIRA live console for a domain assessment of globex.example: five phases, each marked done by its agent, above the agent fleet.The AQIRA live console for a domain assessment of globex.example: five phases, each marked done by its agent, above the agent fleet.
A finished domain assessment: each phase marked done, and the fleet with the capabilities each agent used.View full size: the Live console screenView full size: the Live console screen

The findings it raises

Examples of what AQIRA reports on a domain, each with evidence, steps to reproduce, remediation in priority order and its ATT&CK technique.

  • SQL injection in a search parameter
  • Server-side request forgery in a URL preview
  • Source control metadata exposed (.git directory)
  • Administrative interface exposed to the internet
  • Dangling DNS record that allows subdomain takeover
  • Publicly listable cloud storage bucket
  • Outdated TLS protocol versions accepted
  • Known framework flaws such as Log4Shell and Spring4Shell, with the version confirmed

Examples only. What an assessment finds depends on your target; the capture shows a demo assessment.

AQIRA consoleFindingsProduct UI, demo data
The findings table of an AQIRA assessment of globex.example: eight findings, from Spring Framework remote code execution to missing security headers, with severity, status, confidence, asset and ATT&CK technique.The findings table of an AQIRA assessment of globex.example: eight findings, from Spring Framework remote code execution to missing security headers, with severity, status, confidence, asset and ATT&CK technique.
The same assessment's findings, each with severity, confidence, affected asset and ATT&CK technique.View full size: the Findings screenView full size: the Findings screen

What it maps, and where results land

Each finding opens on its evidence: the request sent and the response that proves the weakness, with steps to reproduce and remediation in priority order.

Domains and DNS
The domain, its DNS records and every subdomain found through certificate transparency and passive DNS.
Hosts and services
The hosts behind them, their services, and the web and API endpoints those services expose.
Cloud resources
Storage buckets reachable from the domain, filed with the cloud resources.
AQIRA consoleFindingProduct UI, demo data
An AQIRA finding for SQL injection, on Evidence and PoC: CVSS 9.8, the request carrying a benign marker and the error response that echoes it.An AQIRA finding for SQL injection, on Evidence and PoC: CVSS 9.8, the request carrying a benign marker and the error response that echoes it.
Evidence and PoC for an acme.example demo finding: a benign marker in the request, echoed in the response.View full size: the Finding screenView full size: the Finding screen

Mapped to what your auditors read

POLARIS maps every finding to the controls it touches, in every framework that applies.

Scored against

  • OWASP Top 10
  • NIST CSF 2.0
  • NIST SP 800-53
  • NIST SP 800-171
  • COBIT

Every finding is also mapped to

ATT&CK, OWASP, NIST CSF, NIST SP 800-53, NIST SP 800-171 and COBIT.

Control status, owner and evidence are in compliance mapping; what reaches the client is in the reports.

Where this assessment stops

A clean result covers only what AQIRA tests on a domain.

  1. Reachable from the internet, without signing in

    A web and API assessment does not test behind a web login.

  2. Reconnaissance sends no attacks

    Reconnaissance maps the attack surface and sends nothing active; Standard and Deep need confirmed authorisation for the target.

  3. Business logic needs a person

    Flaws in what an application is for, such as a changeable basket price, need a person who knows the business.

Limits common to every input, and how proof stays benign, are in the methodology.

The other five inputs

Next step

A demo assessment of a domain

A demo runs one assessment in the console, with demo data: the agents at work, the evidence behind each finding, and the report.

Book a demoExplore the platform