[GRAYBOX PENTEST]
Test how far an authenticated identity can reach—with reproducible proof for every failed boundary.
[Beyond payload scanning]
Your code explains the risk.
A real login proves it.
CodeAnt combines source-level context with authenticated access to prove what each user, role and tenant can reach.
START PENTEST
Every request traced to the guard that should stop it. We map each route's middleware chain and flag handlers that hit a query with no owner or tenant check.
req.body.rolemembers.update()write · privileged
Source to sink
We follow each parameter to its query. An unfiltered id hitting findOne() surfaces on its own.
Guard chain resolved
We read the guards each handler runs. A missing assertTenant is a BOLA candidate before we send a packet.
The same path, replayed as every identity you issue. We drive requests across roles, tenants and claims, then check the response against the policy the code claims.
| Request | Replayed as | Policy expects | Server returned | Result |
|---|---|---|---|---|
GET /workspaces/B/invoices | MMember | 403 | 403 | as policy |
PATCH /members/88/role | VViewer | 403 | 403 | as policy |
DELETE /api-keys/prod | FForged JWT | 401 | 401 | as policy |
GET /exports/7731 | VViewer | 403 | 403 | as policy |
POST /coupons/apply | MMember | 403 | 403 | as policy |
GET /me/billing | RRevoked | 401 | 200 OK | crossed |
Real roles and tenants
Sessions carry the exact tenant_id and role your users hold. Tenant A asking for tenant B is a real test.
Claim and session tampering
We flip role in the token, strip the signature, and replay after logout to see if the server revalidates.
Suspicion in. Executed evidence out. Each candidate fires against the running app. It returns unauthorized data with a captured exchange, or it's dropped.
| Candidate from code | Sent as | Expected | Live response | Verdict |
|---|---|---|---|---|
GET /workspaces/B/invoices | member@acme | 403 | waiting | queued |
GET /exports/7731 | viewer@globex | 403 | waiting | queued |
PATCH /members/88/role | member@acme | 403 | waiting | queued |
GET /me/billing | revoked token | 401 | waiting | queued |
POST /billing/apply-credit | member@acme | 409 | waiting | queued |
Run against the live app
Nothing is a finding until it runs. We send it, capture status, latency and body, and diff the baseline.
No false positives
Paths the server blocks are dropped. You triage confirmed access, not a scanner's guesses.
Exactly what the identity accessed or changed. Every finding ships with the identity, request, response and a one-command repro, mapped to its class.
| Boundary | Crossed with | Proven access | Class |
|---|---|---|---|
| Tenant | Member · tenant A | Tenant B's invoices | BOLA / IDOR |
| Role | Standard member | Admin-only mutation | Privilege escalation |
| Claim | Unsigned JWT | Protected admin API | Access control |
| Workflow | Valid credit request | Balance drained ×3 | Business logic |
| Session | Revoked token | Access after logout | Session control |
| Rate limit | 5 attempts / min | 400 attempts accepted | Abuse control |
member@acme · tenant AGET /workspaces/B/invoices/8812Blast radius, counted
We report records read and writes committed, not a severity label with nothing behind it.
One-command repro
The exact identity, headers and payload ship as curl your team can paste and confirm.
[CUSTOMER STORIES]
Teams trust CodeAnt
to prevent breaches
[HOW IT WORKS]
Your software changes.
Your threat model should too.
01 / SIGN IN
Establish the principal.
Record the identity, role, tenant, claims and permissions.
02 / PROBE
Break authorization
Manipulate identifiers, roles, methods, claims and workflow state.
03 / PROVE
Validate exploitability.
Capture the identity, request, response and failed control.
04 / TRACE
Trace the impact.
Show the data, operations and systems now reachable.
One security graph.
Code to attack surface.
CONTEXT
THREAT MODEL
ATTACK
PROOF
Source, IaC, dependencies, secrets, endpoints, cloud config, commit history read the way an attacker would, resolved into one context graph.
The graph shows where the application breaks: auth boundaries, trust assumptions, data flows, paths from untrusted input to something worth reaching. Ranked before anything runs.
500+ agents run those paths against the running application, chaining recon, injection, access control, and business logic the way a real attacker does.
Nothing reaches you unless it was exploited — with the request, the response that proved it, and steps to reproduce. Review, not investigation.
[WHY GRAYBOX]
Why security teams
choose gray box.
Black box
Unauthenticated external exposure
Starting point
Public URL
Authentication
No
Best for
External exposure
Sees internal roles
Limited
GRAYBOX
Post-authentication exposure
Starting point
Scoped credentials
Authentication
Yes
Best for
Authorization + logic
Sees internal roles
Deeply
White box
Full code-to-runtime exposure
Starting point
Source + application
Authentication
Yes
Best for
Deepest coverage
Sees root cause
Directly
[What your team receives]
A report you can share.
Evidence engineers can use.
SOC 2 Type II
Gartner Cool Vendor 2026
HIPAA Compliant
[FAQ]
Frequently Asked
Questions
What access does gray box testing need?
How is gray box different from black box?
What kinds of issues is gray box best at finding?
Can testing be done safely in production?
[GET STARTED]
START PENTEST
