Skip to content
AmbitSecurity
Menu
Get started

How it works

Scope it. We attack it. You get proof.

A real penetration test of your web app or API, in three steps. Every engagement is led by OSCP/OSWE/OSEE-certified testers, and each report is reviewed and signed by one. The screenshots are the product, with sample data.

STEP 01

Scope it.

Tell us what to test: your web app or API, a test user per role, and when. A staging copy is safest.

Prove you own the domain with a DNS record or a file, and sign the authorization. The scope is locked from then on.

The Scope step in Ambit, with sample data: the starting addresses and two domains marked Verified.
Domains in a sample workspace, each marked Verified by a DNS TXT record.

STEP 02

We attack it.

Our AI agent, led by OSCP/OSWE/OSEE-certified testers, maps your app and tests it the way a real attacker would, as each of your test users, across all 114 OWASP WSTG test cases.

Watch progress live and answer its questions in one place. When something blocks it, it asks you instead of working around it.

WSTG coverage of a sample engagement: each test case marked tested, not applicable, blocked or not yet.
The chat of a sample engagement: the agent reports its first crawl, a test user that needs a code, and a first serious result it has passed to Ambit's pentester to review.
Questions from the agent in a sample engagement: whether booking tests may run during office hours, and a one-time code it needs.

STEP 03

Get proof and a signed report.

Validated vulnerabilities with evidence and fixes, an audit-ready report and attestation letter, and a free retest within 90 days.

Each report is reviewed and signed by the certified tester who led the engagement, with a reference anyone can verify.

A finding in a sample engagement: affected route, description, business impact, remediation, steps and evidence.
Signed reports of a sample engagement, each with its SHA-256 and a reference anyone can verify (signer name blurred).

Safe by design

Every request goes through Ambit's proxy.

The agent runs in an isolated container with one way out. The proxy checks each request against your verified scope, paces it to your rate, marks it as Ambit and logs it before anything reaches your app.

Isolated container

Ambit agent

No route out except the proxy. Signs in only as your test users.

Every request

Ambit proxy

  • Scope Verified hosts only. Excluded paths refused.
  • Rate Paced to the rate you set.
  • Identity Marked as Ambit in every request.
  • Log One line per request, out of the agent's reach.

In scope

Your app and API

Only the hosts you proved you control. Nothing else is reachable.

The agent runs in an isolated container whose only route out is Ambit's proxy. The proxy enforces the verified scope and the request rate, marks every request as Ambit and logs it, then forwards it to your in-scope hosts.

What your logs see

GET /v1/records/rec_b_88 HTTP/1.1
Host: api.northwind-health.test
User-Agent: ... AmbitPentest/1.0
Ambit-Pentest: <your engagement reference>
  • Every request names Ambit and your engagement, so your team can tell our traffic from an attacker's in your own logs.
  • Requests outside the verified scope are refused before they leave, and the refusal is logged.
  • Limits are checked with a handful of requests, never by flooding your app. You can pause or stop a run at any time.

Coverage

What the agent tests.

Ambit covers the OWASP Top 10, the OWASP API Security Top 10 and the OWASP Web Security Testing Guide, with testing mapped to OWASP ASVS. Every engagement runs all 114 WSTG test cases below, as each of your test users.

  • OWASP Top 10
  • OWASP API Security Top 10
  • OWASP WSTG, 114 test cases
  • Mapped to OWASP ASVS

OWASP Top 10 (2021)

  • A01 Broken Access Control Replays each test user's requests as every other role and tenant to find IDOR, privilege escalation and cross-tenant access.
  • A02 Cryptographic Failures Checks TLS and HSTS, cookie flags, certificates, JWT signing and padding oracles, and finds sensitive data sent in the clear.
  • A03 Injection Tests every input for SQL, NoSQL, command, template, LDAP and XPath injection, and for reflected, stored and DOM-based XSS.
  • A04 Insecure Design Abuses business workflows: skipped steps, usage limits, race conditions, payment and pricing logic, and file uploads.
  • A05 Security Misconfiguration Reviews headers, CSP, CORS, HTTP methods, error handling, admin interfaces, backup files and exposed cloud storage.
  • A06 Vulnerable and Outdated Components Identifies outdated frameworks, libraries and servers and checks them for known vulnerabilities.
  • A07 Identification and Authentication Failures Tests sign-in, lockout, password reset, MFA, remember-me, session fixation, timeout and logout.
  • A08 Software and Data Integrity Failures Tests mass assignment, prototype pollution, insecure deserialization and data the client can tamper with.
  • A09 Security Logging and Monitoring Failures Checks whether the application detects and responds to repeated misuse of its functions.
  • A10 Server-Side Request Forgery Tests every URL the server fetches, such as webhooks, imports, previews and renderers, for access to internal hosts.

OWASP API Security Top 10 (2023)

  • API1 Broken Object Level Authorization Requests every object as every other user, across each verb, nested route, GraphQL argument and bulk endpoint.
  • API2 Broken Authentication Tests tokens, API keys, sessions, password reset and MFA on every authentication path.
  • API3 Broken Object Property Level Authorization Finds responses that expose too many fields, and writes to fields a client should not control.
  • API4 Unrestricted Resource Consumption Checks rate limits, page sizes and request size limits on expensive operations.
  • API5 Broken Function Level Authorization Calls higher roles' functions from lower roles, sweeps HTTP methods and tests GraphQL mutations.
  • API6 Unrestricted Access to Sensitive Business Flows Tests whether sign-up, invites, purchases and other sensitive flows can be repeated or automated.
  • API7 Server Side Request Forgery Tests URL parameters, callbacks and webhooks for requests the server makes to internal hosts.
  • API8 Security Misconfiguration Checks headers, CORS, HTTP methods, verbose errors and exposed debug and admin endpoints.
  • API9 Improper Inventory Management Finds undocumented endpoints, old API versions and staging hosts across your scope.
  • API10 Unsafe Consumption of APIs Tests the webhooks, callbacks and imports through which your API takes in data from other services.

Every WSTG test case the agent runs

114 test cases in 12 groups

Information gathering INFO 10
  • WSTG-INFO-01 Conduct Search Engine Reconnaissance for Information Leakage
  • WSTG-INFO-02 Fingerprint Web Server
  • WSTG-INFO-03 Review Webserver Metafiles for Information Leakage
  • WSTG-INFO-04 Attack Surface Identification
  • WSTG-INFO-05 Review Web Page Content for Information Leakage
  • WSTG-INFO-06 Identify Application Entry Points
  • WSTG-INFO-07 Map Execution Paths Through Application
  • WSTG-INFO-08 Fingerprint Web Application Framework
  • WSTG-INFO-09 Fingerprint Web Application
  • WSTG-INFO-10 Map Application Architecture
Configuration CONF 14
  • WSTG-CONF-01 Network Infrastructure Configuration
  • WSTG-CONF-02 Application Platform Configuration
  • WSTG-CONF-03 File Extensions Handling for Sensitive Information
  • WSTG-CONF-04 Review Old Backup and Unreferenced Files for Sensitive Information
  • WSTG-CONF-05 Enumerate Infrastructure and Application Admin Interfaces
  • WSTG-CONF-06 HTTP Methods
  • WSTG-CONF-07 HTTP Strict Transport Security
  • WSTG-CONF-09 File Permissions
  • WSTG-CONF-10 Subdomain Takeover
  • WSTG-CONF-11 Cloud Storage
  • WSTG-CONF-12 Content Security Policy
  • WSTG-CONF-13 Path Confusion
  • WSTG-CONF-14 Other HTTP Security Header Misconfigurations
  • WSTG-CONF-15 Feature Flag Security Bypass
Identity IDNT 5
  • WSTG-IDNT-01 Role Definitions
  • WSTG-IDNT-02 User Registration Process
  • WSTG-IDNT-03 Account Provisioning Process
  • WSTG-IDNT-04 Account Enumeration and Guessable User Account
  • WSTG-IDNT-05 Weak or Unenforced Username Policy
Authentication ATHN 11
  • WSTG-ATHN-01 Credentials Transported over an Encrypted Channel
  • WSTG-ATHN-02 Default Credentials
  • WSTG-ATHN-03 Weak Lock Out Mechanism
  • WSTG-ATHN-04 Bypassing Authentication Schema
  • WSTG-ATHN-05 Vulnerable Remember Password
  • WSTG-ATHN-06 Browser Cache Weaknesses
  • WSTG-ATHN-07 Weak Authentication Methods
  • WSTG-ATHN-08 Weak Security Question Answer
  • WSTG-ATHN-09 Weak Password Change or Reset Functionalities
  • WSTG-ATHN-10 Weaker Authentication in Alternative Channel
  • WSTG-ATHN-11 Multi-Factor Authentication (MFA)
Authorization ATHZ 5
  • WSTG-ATHZ-01 Directory Traversal File Include
  • WSTG-ATHZ-02 Bypassing Authorization Schema
  • WSTG-ATHZ-03 Privilege Escalation
  • WSTG-ATHZ-04 Insecure Direct Object References
  • WSTG-ATHZ-05 OAuth Weaknesses
Session SESS 11
  • WSTG-SESS-01 Session Management Schema
  • WSTG-SESS-02 Cookies Attributes
  • WSTG-SESS-03 Session Fixation
  • WSTG-SESS-04 Exposed Session Variables
  • WSTG-SESS-05 Cross Site Request Forgery
  • WSTG-SESS-06 Logout Functionality
  • WSTG-SESS-07 Session Timeout
  • WSTG-SESS-08 Session Puzzling
  • WSTG-SESS-09 Session Hijacking
  • WSTG-SESS-10 JSON Web Tokens
  • WSTG-SESS-11 Concurrent Sessions
Input validation INJT 23
  • WSTG-INJT-01 Reflected Cross Site Scripting
  • WSTG-INJT-02 Stored Cross Site Scripting
  • WSTG-INJT-03 HTTP Verb Tampering
  • WSTG-INJT-04 HTTP Parameter Pollution
  • WSTG-INJT-05 SQL Injection
  • WSTG-INJT-06 LDAP Injection
  • WSTG-INJT-07 XML Injection
  • WSTG-INJT-08 SSI Injection
  • WSTG-INJT-09 XPath Injection
  • WSTG-INJT-10 IMAP SMTP Injection
  • WSTG-INJT-11 Code Injection
  • WSTG-INJT-12 Command Injection
  • WSTG-INJT-13 Format String Injection
  • WSTG-INJT-14 Incubated Vulnerability
  • WSTG-INJT-15 HTTP Response Splitting
  • WSTG-INJT-16 HTTP Request Smuggling
  • WSTG-INJT-17 Host Header Injection
  • WSTG-INJT-18 Server-side Template Injection
  • WSTG-INJT-19 Server-Side Request Forgery
  • WSTG-INJT-20 Mass Assignment
  • WSTG-INJT-21 CSV Injection
  • WSTG-INJT-22 Prototype Pollution
  • WSTG-INJT-23 Insecure Deserialization
Error handling ERRH 2
  • WSTG-ERRH-01 Improper Error Handling
  • WSTG-ERRH-02 Stack Traces
Cryptography CRYP 4
  • WSTG-CRYP-01 Weak Transport Layer Security
  • WSTG-CRYP-02 Padding Oracle
  • WSTG-CRYP-03 Sensitive Information Sent via Unencrypted Channels
  • WSTG-CRYP-04 Weak Cryptographic Primitives
Business logic BUSL 10
  • WSTG-BUSL-01 Business Logic Data Validation
  • WSTG-BUSL-02 Ability to Forge Requests
  • WSTG-BUSL-03 Integrity Checks
  • WSTG-BUSL-04 Process Timing
  • WSTG-BUSL-05 Number of Times a Function Can Be Used Limits
  • WSTG-BUSL-06 Circumvention of Work Flows
  • WSTG-BUSL-07 Defenses Against Application Misuse
  • WSTG-BUSL-08 Upload of Unexpected File Types
  • WSTG-BUSL-09 Upload of Malicious Files
  • WSTG-BUSL-10 Payment Functionality
Client-side CLNT 14
  • WSTG-CLNT-01 DOM-Based Cross Site Scripting
  • WSTG-CLNT-02 JavaScript Execution
  • WSTG-CLNT-03 HTML Injection
  • WSTG-CLNT-04 Client-side URL Redirect
  • WSTG-CLNT-05 CSS Injection
  • WSTG-CLNT-06 Client-side Resource Manipulation
  • WSTG-CLNT-07 Cross Origin Resource Sharing
  • WSTG-CLNT-09 Clickjacking
  • WSTG-CLNT-10 WebSockets
  • WSTG-CLNT-11 Web Messaging
  • WSTG-CLNT-12 Browser Storage
  • WSTG-CLNT-13 Cross Site Script Inclusion
  • WSTG-CLNT-14 Reverse Tabnabbing
  • WSTG-CLNT-15 Client-side Template Injection
API APIT 5
  • WSTG-APIT-01 API Reconnaissance
  • WSTG-APIT-02 API Broken Object Level Authorization
  • WSTG-APIT-03 Excessive Data Exposure
  • WSTG-APIT-04 API Broken Function Level Authorization
  • WSTG-APIT-99 GraphQL

Get started

See it on your own app.

Scope a test, watch the agent work, and get a report a certified tester signed.

Get a pentest See a sample report

Fixed price. Results in days. Retest included.