> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.pensar.dev/console/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pensar.dev/console/_mcp/server. # Attack Surface > A living map of what an attacker could reach — and the guidance that steers how Pensar tests it ## Overview Your **attack surface** is a living map of everything an attacker could reach in a workspace: the applications you run, the endpoints they expose, and the context that helps agents reason about each one. Pensar builds and maintains this map automatically, then uses it to scope and steer every pentest. > **Warning** > > **The attack surface is guidance, not findings.** The business logic, threat > models, and pentest objectives attached to each endpoint are AI-drafted > context that steers *how* the pentest agent tests — they are **not** confirmed > vulnerabilities. Confirmed, verified findings only appear as **issues** after a > pentest runs. ## How It Works Pensar discovers and maps your attack surface through reconnaissance. The approach depends on whether you've provided source code access: #### With Source Code When you provide source code (via VCS integration or zip upload), Pensar's AI agents perform static analysis to identify: * **Web Routes & Endpoints**: All HTTP endpoints, REST APIs, GraphQL schemas, and WebSocket connections * **Authentication Mechanisms**: Login pages, OAuth flows, API key validation, and session management * **Input Vectors**: Forms, query parameters, request bodies, headers, and file uploads * **External Dependencies**: Third-party APIs, external services, and integrations * **Data Flows**: How data moves through your application and where it's processed or stored > **Success** > > Source code analysis provides the most comprehensive attack surface mapping with detailed understanding of application internals. #### Without Source Code When source code is not provided, Pensar performs advanced reconnaissance on your provided domains: * **Subdomain Discovery**: Identifies all subdomains associated with your domains * **Port Scanning**: Discovers open ports and running services * **Web Crawling**: Maps all accessible pages, forms, and functionality * **API Discovery**: Identifies API endpoints through intelligent probing and pattern recognition * **Technology Detection**: Fingerprints frameworks, libraries, and server technologies > **Info** > > The provided context about your domains helps guide the reconnaissance process for more accurate results. ## What Each Endpoint Holds Open any endpoint in the **Attack Surface** view to see the context Pensar has assembled for it. Recon drafts each section; you can edit any of it inline to sharpen what agents reason about. > **Warning** > > Everything below is **soft guidance for the testing agent** — a starting point > recon inferred about the endpoint, not a statement that the endpoint is > vulnerable. Treat it as the brief you'd hand a human pentester, and refine it > to point testing where it matters most. #### Overview The endpoint's metadata — its type, whether authentication is required, and where it lives in the source. All editable inline. #### Business Logic What the endpoint actually does — its purpose, the actors involved, the data that flows through it, and the invariants and trust boundaries it must uphold. This helps agents understand intended behavior so they can spot deviations from it. #### Threat Model The adversaries worth worrying about, the attack vectors they'd use, and the controls already in place. Refine it to focus testing on the threats that matter most for this endpoint. #### Pentest Objectives Concrete, falsifiable hypotheses an agent will try to prove during a pentest. Objectives are the single biggest lever you have over what gets tested — add, edit, or remove them to focus effort on high-value endpoints. ## Pentest Objectives For each identified endpoint, Pensar automatically generates **pentest objectives** — specific, falsifiable testing goals that guide how that endpoint should be tested. They describe what an agent will *attempt to prove*, not what it has already found. > **Success** > > **OWASP Top 10 and OWASP API Top 10 coverage is applied by default.** Every pentest automatically tests for the full set of OWASP Top 10 and OWASP API Top 10 security risks — no configuration required. Objectives let you *extend* and *focus* testing with additional, targeted goals specific to your application. ### What Are Pentest Objectives? Pentest objectives are AI-generated testing strategies tailored to each unique endpoint based on: * The endpoint's functionality and purpose * Input parameters and their types * Authentication and authorization requirements * Potential security risks specific to that endpoint ### Example Objectives #### User Login Endpoint For a `/api/auth/login` endpoint, objectives might include: * Test for SQL injection in username/password fields * Verify rate limiting on failed login attempts * Check for username enumeration vulnerabilities * Test session token generation for randomness * Verify secure password storage mechanisms * Test for authentication bypass vulnerabilities #### File Upload Endpoint For a `/api/files/upload` endpoint, objectives might include: * Test file type validation and extension filtering * Verify file size limits are enforced * Check for path traversal vulnerabilities * Test for malicious file content detection * Verify uploaded files cannot be executed * Test for unrestricted file upload vulnerabilities #### User Profile API For a `/api/users/:id` endpoint, objectives might include: * Test for Insecure Direct Object Reference (IDOR) * Verify authorization checks for other users' data * Test for SQL injection in ID parameter * Check for sensitive data exposure in responses * Test mass assignment vulnerabilities * Verify input validation on profile updates ## Workspace Objectives While Pensar covers the OWASP Top 10 and OWASP API Top 10 by default, you can define **[workspace objectives](/console/features/workspace-objectives)** to extend pentesting with additional, targeted testing goals. These are useful when your application has domain-specific security concerns that go beyond standard vulnerability categories — compliance requirements, business logic testing, known risk areas, or custom integrations. Navigate to **Settings > Agent Configuration > Context** and open the **Objectives** tab to add custom objectives. They are automatically included when generating attack surfaces for all applications in the workspace, and can be propagated to existing endpoints. > **Info** > > See the [Workspace Objectives](/console/features/workspace-objectives) page > for detailed guidance on writing effective objectives, propagation, and > example objective sets for common application types. ## Continuous Mapping Mapping your attack surface isn't a one-time activity: > **Warning** > > Pensar automatically updates your attack surface map when: > > * New code is pushed to your repository > * New domains are added to your workspace > * Reconnaissance discovers new subdomains or endpoints > * Application routes or APIs are modified This ensures your security testing always covers your current application state, not just a point-in-time snapshot. ## Next Steps With your attack surface mapped, Pensar moves on to penetration testing: * **Hybrid Testing**: Learn about Pensar's [hybrid testing methodology](/console/features/hybrid-testing) combining source analysis with live exploitation * **View Results**: Monitor testing progress and review **confirmed findings** in real-time through the Console dashboard