Home / Help centre / Getting started
Getting started
Does Cyberlop use a real browser when it tests my app?
Yes. In the exploitation phase, agents interact with the live target through a real browser to prove issues, capturing the request, response, payload and sometimes a screenshot. Other phases read the code or map the app. You can switch exploitation off in the scan profile.
The short version
The agents use a real browser for one job: proving that a suspected issue is real. Reading code and mapping the app happen in earlier phases.
How it works in Cyberlop
- Pre-recon reads the cloned repository. No browser comes into play.
- Recon maps the live app into a sitemap of endpoints, methods and parameters.
- Vulnerability analysis works on the code and builds a list of testable claims, each with a file and line.
- Exploitation is where the browser comes in. For each claim, an agent tries to show the issue safely against the live target. It records the request, the response, the payload and sometimes a screenshot.
- Reporting writes up the confirmed findings.
Each result gets a grade of Confirmed, Likely or Unconfirmed, based on how strongly the agent proved it. Open a finding and use the Evidence tab to see the request, the response, the reproduction steps and the screenshot.
In the profile's Scope section, Run exploitation phase starts on by default. Untick it and the scan only analyses the code, with no live proof. Findings from such a scan have no browser evidence.
For a black-box target there is no source code, so the work is done against the live URL. That needs proof of ownership first.
What to do next
- Read the five phases for the full flow.
- Test only apps you own or have written permission to test. Use staging where you can.
- Learn about proof of exploit.
The browser matters because many problems only show up when a page really runs. You can watch a script execute, a redirect fire or a screen render wrongly in a browser, and a screenshot makes that easy for a person to confirm.
Questions about what the browser does on your app? Contact us.
Related questions
- What are the five phases of a Cyberlop scan?
- What is Cyberlop and what does it test?
- What's the difference between a target, a scan profile and a scan?
- What's the difference between a white-box and a black-box target?
- How do I go from a fresh sign-in to my first finished report?
The exploitation phase: on or off, and safe in production
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.