PENTEST

모든 결과를 입증하는 지속적 모의 침투 테스트

도메인, API, 내부 네트워크 중 어디로든 향하게 하세요. 모의 침투 테스터가 일하는 방식 그대로 움직입니다. 표면을 열거하고, 공격을 시도하고, 통하는 것들을 연결합니다. 스캐너는 시그니처를 대조해 분류할 대기열을 넘겨줍니다. 여우는 실제로 성사시킨 것만 보고하며, 그것을 두 번 성사시킵니다. 한 번은 입증을 위해, 한 번은 수정을 배포한 뒤에.

문서 읽기 나머지 세 에이전트 보기

평가 화면.

하나의 평가가 만들어낸 것이 모두 여기 있습니다. 에이전트가 쓴 요약, 입증한 finding, 그 뒤의 활동. 보고서는 여기서 열고, PDF로 내려받을 수도 있습니다.

JWT tenant isolation and admin surface validation

Completed4 days ago31 minutes

4Risks1 critical2 high1 medium

ExecutionAutomated

Started4 days ago

Duration31 minutes

Risks4

Credits180

Summary

The scope granted a standard workspace token for a non-privileged member of tenant 4821. The goal was to establish whether that token can reach data or operations belonging to another tenant.

It can. The token was accepted on a tenant-scoped query for account 4822 with no error and no audit entry, and the admin GraphQL catalogue enumerated persisted operations that a standard session should not see. Signup was then shown to trust a client-supplied tenant_id, which is how a caller reaches an arbitrary tenant in the first place.

What was refused

SQL injection against the catalogue filter was refused — the query is parameterised. A JWT alg:none downgrade was rejected by the verifier. Both are recorded because a run that lists only what worked is describing a demo rather than a target.

Recommended order

Derive tenancy server-side at signup and reject client-supplied tenant ids.
Scope the token check to the tenant on every read path, not just on writes.
Record cross-tenant reads in the audit log so the next attempt is visible.