Cyberlop is a white-box AI penetration-testing platform. It reads an application's source code from a Git repository and tests the running app at its URL, to find vulnerabilities and, where possible, prove them. It also supports black-box targets that need only a URL.
The short version
Cyberlop finds vulnerabilities in web applications and their APIs, then tries to prove each one. Autonomous AI agents do the work. A scan has two inputs: your code, read from a Git repository, and your running app, reached at its URL. Where a finding can be proven, the report carries the evidence.
How it works in Cyberlop
You register a target, then build a scan profile that says what to test. A scan then runs through five phases, from reading the code to writing the report.
The specialist agents look at eight areas:
- Injection, including SQL, NoSQL, command and template injection
- Cross-site scripting
- Authentication and sessions
- Access control, such as one account reaching another's data
- Server-side request forgery
- Cryptography
- Configuration, such as headers, CORS and cookies
- Business logic, such as pricing and quota bypass
In a profile you can choose from ten vulnerability classes. Dependency and Secrets are in that list too.
White-box scans need a repository. Black-box scans need only the URL, plus proof that you own it. Each finding carries a severity, a confidence level and a location: a file and line for white-box, or an endpoint for black-box. Confirmed findings include the HTTP request and response, and a screenshot where one helps.
Your data stays in your own workspace. Each organisation has its own private database schema.
What to do next
- Follow the first scan guide.
- Learn the words in target, profile and scan.
- Read the white-box testing and black-box testing pages.
It helps to see the product as a loop. You scan, read the evidence, fix the code, and then re-scan so that the same issue is marked Fixed or flagged as a Regression if it returns.
Only test applications you own or have written permission to test. Questions? Contact us.
Related questions
- What are the five phases of a Cyberlop scan?
- Does Cyberlop use a real browser when it tests my app?
- What's the difference between a target, a scan profile and a scan?
- What's the difference between a white-box and a black-box target?
- How do I go from a fresh sign-in to my first finished report?
Getting started with Cyberlop: from sign-in to your first finding
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.