The exploitation phase is phase four of the scan. Agents try to prove each suspected issue against the live target with real requests and a browser, and keep the evidence. It is on by default. Untick Run exploitation phase for code-only analysis.
The short version
Think of this phase as the step that turns a suspicion into proof. Without it, a scan reads code and reports what it finds there. With it, the scan also tests the running app and records what actually happened.
How it works in Cyberlop
A scan has five phases: pre-recon, recon, vulnerability analysis, exploitation and reporting. Before that, specialist agents write hypotheses, each with an exact file and line and a claim you can test. Then an exploitation agent takes each hypothesis and tries to demonstrate it against the live target.
It uses real HTTP requests and a real browser. It captures the request, the response, the payload and, where it helps, a screenshot. Each finding then gets a grade of confirmed, likely or unconfirmed, based on how strongly the agent proved it.
On the profile form, you find Run exploitation phase in the Scope section, ticked by default. The tooltip says that leaving it on performs a DAST scan, where agents actively test and prove vulnerabilities against the live target. Leaving it unticked gives SAST only: static source-code analysis with no live testing.
| Setting | Result |
|---|---|
| Ticked (default) | Live testing, with request, response and screenshot evidence |
| Unticked | Static analysis of the code only |
What to do next
Keep it on when you want evidence that a developer can follow step by step, because the request, response and screenshot show exactly what happened. Turn it off for a code-only pass. Do the same where live testing is not allowed. Test only systems you have permission to test. Use Rules of engagement in the Reporting section to write limits down, such as avoiding destructive payloads in production.
The step-by-step guide is how to turn off the exploitation phase, and the tutorial is the exploitation phase. For findings that were not proven, see confirmed, likely and unconfirmed.
Related questions
- How do I turn off the exploitation phase?
- What's the difference between Confirmed, Likely and Unconfirmed?
- What are the five phases of a Cyberlop scan?
- How do I keep testing safe on a production app?
- How do I add rules of engagement, such as no destructive payloads in production?
The exploitation phase: on or off, and safe in production
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.