[WHITEBOX PENTEST]
A pentest that follows real attack paths through your code, identity and cloud, and proves which ones work.
START PENTEST
NO CC REQUIRED
[Beyond payload scanning]
The dangerous bugs
look like valid requests.
A request can be perfectly formed—and completely unauthorized. We test the identity, the action and the outcome.
START PENTEST
NO CC REQUIRED
Every identity, replayed against every record. We take a valid session and walk it through the records it should never reach, then keep the ones that answered.
Records Alex can open
APSShare
All recordsASigned in as Alex, Acme
| Record | Belongs to | What came back |
|---|---|---|
| INV-1041 | AAcme | |
| INV-2084 | Northstar | |
| RCP-3092 | Northstar | |
| USR-0417 | Globex | |
| EXP-7720 | Globex | |
| INV-1052 | AAcme |
Finding
Alex can open Northstar's invoice
Alex works at Acme. The invoice belongs to another customer, and the server sent all of it.
Signed in asAAlex, Acme
OwnerNorthstar
Should get403 BlockedGot200 OK
{
"invoice": "INV-2084",
"company": "Northstar",
"total": "$2,400.00"
}
Create ticketRe-testCopy
Traced to the line.
We trace the request to the query that skipped the owner check.
Route
Controller
Service
Query
invoice.service.ts
38async getInvoice(user, id) {
39 return invoices.findOne({
40 id,Only checks the ID
+ companyId: user.companyId,
41 });
42}
Every company. Every record.
Each account is tested against data from every other account, not a sample.
AAcme
Northstar
1 leak
Globex
5 roles
1,284 records
A hidden button isn't a permission. Apps hide admin controls from regular users but often leave the API behind them open. We send the request anyway.
AAcme workspaceSigned in as AAlex
MemberAdmin
Members
All 4Admins 1
NameRole
AAlex LeeMemberAdminChange roleOnly admins can change roles
PPriya ShahAdmin
JJordan DiazManager
SSam OrtizMember
CodeAnt testas Alex, Member
The request the locked button would send
Send request
Server answeredshould be 403200 OK
Checked at the API, not the screen.
Every admin action is called with the lowest role that exists.
SSam, Member
POST/invites
Invite a teammateBlocked
AAlex, Member
PATCH/members/alex/role
Make yourself adminAllowed
JJordan, Manager
DELETE/api-keys/prod
Delete a production keyBlocked
SSam, Member
PUT/billing/plan
Change the planBlocked
JJordan, Manager
GET/v1/audit-log
Read the audit logAllowed
Findings your team can act on.
Each one comes with who can do it, how to repeat it, and the fix.
Finding 1 of 4PJ
Members can make themselves admin High
Any member can call the role endpoint directly. The server never checks the caller's role.
Copy reproCreate ticketRe-test
Finding 2 of 4SP
Managers can read the audit log Medium
The audit log is meant for admins, but the old v1 route returns it to managers.
Copy reproCreate ticketRe-test
Finding 3 of 4JA
Invites accept any role High
An invite link can be edited to join the workspace as an admin instead of a member.
Copy reproCreate ticketRe-test
Finding 4 of 4PS
Deleted users keep API access Medium
Removing someone from the team leaves their personal API keys working for 30 days.
Copy reproCreate ticketRe-test
Every way into an account gets tried. Login is one door. Reset links, magic links, tokens and SSO are the others, and each one has to lock properly.
Ways into Alex's account6 tested
Password loginWrong passwords, lockout, timing
Password reset linkReuse, expiry, other accounts
Magic sign-in linkReuse, expiry
Refresh tokenUse after signing out
SSO callbackEdited or replayed responses
Two-factor codeSkipping the step, guessing
Finding
A used reset link still works
Anyone who gets the old email can take over the account again.
10:02
Reset link emailed/reset?token=7f3a…
Sent10:03
Alex sets a new passwordThe link should stop working now
Used10:09
Same link opened againPassword changed a second time
Still worksSigned out means signed out.
We sign out everywhere, then try the old session again.
ASession sess_8f2Active
Alex Lee signs in
Chrome on macOS
Step 1 of 4
ASession sess_8f2Signed out
Signs out everywhere
All sessions revoked
Step 2 of 4
ASession sess_8f2Replayed
Old cookie sent again
GET /account/profile
Step 3 of 4
ASession sess_8f2Still signed in
Server: “Welcome back, Alex”
A revoked session was trusted
Step 4 of 4
Tokens, edited on purpose.
We change the role inside a token and strip its signature. The server should refuse it.
Session tokenOriginal
SignedHS256
Useralex
Rolemember
ServerNot sent yet
Pay $0.01 for a $320 order. Prices, totals and limits that come from the browser can be changed. We edit them on the way out and check what the server accepts.
AAcme StoreCheckout
Pro plan, annual
Billed once
Extra seats
2 × $10.00
Total$320.00
Pay $320.00
CodeAnt testrequest on Pay
Edited before it reaches the server
POST /api/checkout
{
"plan": "pro",
"seats": 2,
"total": 320.00
}
Order confirmed
Charged
$0.01
Order#4471
PlanPro, annual
StatusPaid
Server trusted the browser's price
Rewards that pay out forever.
We invite ourselves again and again to see if the referral credit keeps coming.
Alex's referral credit$0
Aalex+1@acme.cojoined+$10
Aalex+2@acme.cojoined+$10
Aalex+3@acme.cojoined+$10
Aalex+4@acme.cojoined+$10
Same person, paid four times
Limits pushed past the edge.
Values the screen never lets you type still reach the server.
Testing checkout rules
Rules the server didn't enforce
- Quantity −3. Accepted, and a $90 refund was issued for items never bought.
- Discount 120%. The order total became −$24.
- Transfer over the daily limit. Split into five smaller calls, all approved.
[CUSTOMER STORIES]
Teams trust CodeAnt
to prevent breaches
[HOW IT WORKS]
Your software changes.
Your threat model should too.
01 / WRITE
Developer
Flag risky code and secrets while the change is being written.
02 / REVIEW
Pull request
See what the change ships and which trust boundaries it touches.
03 / BUILD
CI/CD
Connect dependencies, components and infrastructure definitions.
04 / DEPLOY
Deployment
Tie the shipped app back to cloud settings, routes and runtime tests.
[CLOUD & INFRASTRUCTURE]
What can a compromised
service reach next?
[What your team receives]
A report you can share.
Evidence engineers can use.
SOC 2 Type II
Gartner Cool Vendor 2026
HIPAA Compliant
[FAQ]
Frequently Asked
Questions
What access does white-box testing need?
Can you test without disrupting production?
How is this different from a code scanner?
Is it AI-driven or human-led?
[GET STARTED]
START PENTEST
NO CC REQUIRED
