> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.pensar.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pensar.dev/_mcp/server.

# Hybrid Testing Methodology

> Hybrid pentesting combining source analysis with live exploitation for maximum coverage and precision

## Overview

Pensar uses a **hybrid testing methodology** that combines source code analysis with live exploitation against your running applications. Rather than choosing between blackbox or whitebox testing, Pensar's AI agents leverage *every available source of information* — source code, live domains, authentication credentials, API schemas — to deliver the highest-precision pentest findings.

> **Success**
>
> **We strongly encourage providing both source code access and live domain
> credentials.** The more context the agent has, the more thorough and accurate
> the results. With Pensar's hybrid approach, this isn't a matter of cost or
> time — the agent can use all these sources simultaneously for maximum
> coverage.

## Why Hybrid Testing?

Traditional pentesting forces a choice: test from the outside (blackbox) or analyze the code (whitebox). Each approach alone has blind spots:

* **Code analysis alone** finds potential vulnerabilities but can't confirm exploitability against a live system
* **Live testing alone** misses vulnerabilities hidden in code paths that are hard to discover externally

Pensar eliminates this tradeoff. The AI agent uses source code to understand your application's internals, then validates findings against your live environment with real exploitation — producing confirmed, high-confidence results with full proof-of-concepts.

#### Source Code Analysis

Understand all routes, data flows, authentication logic, and business rules
from your codebase.

#### Live Exploitation

Validate vulnerabilities against running applications with real
proof-of-concept exploits.

#### Credential-Aware Testing

Test authenticated endpoints, authorization logic, and privilege boundaries
using your provided credentials.

## How It Works

#### Provide Your Sources

Connect your source code (via VCS integration or zip upload) and add the
domains where your application is deployed. Provide [authentication credentials](/console/features/authentication) for testing protected areas.

#### Source Code Analysis

AI agents analyze your codebase to understand:

* Application architecture and data flows
* All routes, endpoints, and entry points
* Authentication and authorization logic
* Database schemas and queries
* Third-party dependencies and integrations

#### Attack Surface Generation

Using source code insights combined with live domain reconnaissance, Pensar
generates a [comprehensive attack surface map](/console/features/attack-surface) with detailed understanding of
each endpoint's internal behavior.

#### Hybrid Exploitation

The AI agent executes pentest objectives with full knowledge of the
application internals, testing against your live environment — with and
without authentication — for maximum precision.

#### Results & Reporting

Findings include precise code locations, proof-of-concept exploits validated
against the live system, and actionable remediation guidance. Reports are
generated automatically in compliance-ready formats.

## What You Should Provide

The agent can work with whatever you give it, but providing all three sources unlocks the full power of hybrid testing:

#### Source Code (Strongly Recommended)

Source code access enables the agent to understand your application from the inside out:

* **VCS Integration**: Connect GitHub, GitLab, or Bitbucket for automatic repository analysis
* **Zip Upload**: Upload source code directly for one-time assessments
* **Benefits**: Complete code path coverage, precise vulnerability localization, [auto-remediation](/console/features/auto-remediation) with AI-generated patches

> **Info**
>
> Source code access transforms the quality of findings. The agent maps every vulnerability to specific files, functions, and line numbers — and can generate verified fixes automatically.

#### Live Domains (Strongly Recommended)

Live domain access lets the agent validate findings with real exploitation:

* **Domain Verification**: [Add and verify](/console/domains/adding-domains) your domains via DNS TXT records
* **API Schemas**: Upload OpenAPI/Swagger specs to enhance endpoint discovery
* **Sitemaps**: Provide sitemaps to help discover pages and routes
* **Benefits**: Confirmed exploitability, real proof-of-concepts, external attack surface discovery

> **Info**
>
> Even with full source code access, providing live domains is critical. The agent discovers runtime behaviors, environment-specific configurations, and validates that code-level findings are actually exploitable.

#### Authentication Credentials (Strongly Recommended)

Credentials let the agent test authenticated surfaces and authorization logic:

* **Username/Password**: For web application login flows
* **Bearer Tokens**: For API authentication
* **Custom Headers**: For proprietary auth mechanisms
* **Multiple Roles**: Provide credentials for different user roles to test privilege boundaries

> **Warning**
>
> Without credentials, the agent can only test unauthenticated endpoints. Providing credentials dramatically increases coverage — the agent tests with *and* without them to find authentication bypass and authorization flaws.

## Testing Approaches

Every run executes inside an isolated, ephemeral sandbox, with the agent testing your live environment from there:

#### Sandboxed Agent Execution

Every Pensar agent runs inside an isolated, ephemeral sandbox:

1. Pensar boots a fresh, isolated sandbox from a pre-warmed base image
2. The agent reads your connected source code for whitebox context
3. The agent runs its security tooling and exploits from inside the sandbox
4. Testing is performed against your live, verified domains and endpoints
5. The sandbox is destroyed when the run completes

Each sandbox is network-isolated — no access to internal Pensar infrastructure or other workspaces' environments — uses ephemeral storage that is destroyed on teardown, has a bounded maximum lifetime, and receives credentials only at startup (encrypted in transit and destroyed with the sandbox).

> **Success**
>
> The sandbox is the agent's execution environment — Pensar does not host or boot your application. The agent tests your live environment from inside the sandbox.

#### Live Environment Testing

Test against your deployed staging or production environment:

1. Provide the live domain URLs where your application is hosted
2. [Verify domain ownership](/console/domains/adding-domains) using DNS TXT records
3. Configure [authentication credentials](/console/features/authentication)
4. Pensar tests against the live environment using source code insights

> **Warning**
>
> Exercise caution when testing production environments. Consider using staging environments or enabling [rate limiting](/console/features/rate-limiting) to prevent service disruption.

## What the Agent Tests

Pensar's hybrid methodology covers vulnerabilities from industry-standard frameworks, enhanced by source-code-aware precision:

#### OWASP Top 10

Complete coverage of the OWASP Top 10 web application security risks including:

* Broken Access Control
* Cryptographic Failures
* Injection
* Insecure Design
* Security Misconfiguration
* Vulnerable and Outdated Components
* Identification and Authentication Failures
* Software and Data Integrity Failures
* Security Logging and Monitoring Failures
* Server-Side Request Forgery (SSRF)

#### OWASP API Top 10

Specialized testing for API endpoints:

* Broken Object Level Authorization (BOLA/IDOR)
* Broken User Authentication
* Excessive Data Exposure
* Lack of Resources & Rate Limiting
* Broken Function Level Authorization
* Mass Assignment
* Security Misconfiguration
* Injection
* Improper Assets Management
* Insufficient Logging & Monitoring

#### Code-Level Vulnerabilities

With source code access, the agent detects vulnerabilities that require internal knowledge:

* Hardcoded credentials and secrets
* Insecure cryptographic implementations
* Race conditions in concurrent code
* Memory safety issues
* Unsafe deserialization
* Path traversal vulnerabilities in file operations

#### Business Logic Flaws

Source code understanding enables detection of complex business logic vulnerabilities:

* Improper authorization checks
* State management issues
* Price manipulation vulnerabilities
* Workflow bypass vulnerabilities
* Time-of-check to time-of-use (TOCTOU) issues

#### Data Flow Vulnerabilities

Trace data flows through your application:

* SQL injection across multiple layers
* XSS vulnerabilities through template rendering
* Command injection in system calls
* Sensitive data exposure in logs
* Insecure data storage

#### Dependency Vulnerabilities

Analyze third-party dependencies:

* Known vulnerable package versions
* Insecure dependency configurations
* Supply chain security risks
* Outdated framework versions

#### Additional Testing

Beyond standard frameworks, testing includes:

* Business logic vulnerabilities
* Race conditions
* CSRF and clickjacking
* Information disclosure
* Session management flaws
* CORS misconfigurations

## Proof-of-Concept Generation

For every vulnerability discovered, Pensar automatically generates a **proof-of-concept (POC)** validated against your live environment:

* Verify the vulnerability exists and is exploitable
* Understand the attack methodology
* Reproduce the issue in your own testing
* Validate that fixes resolve the vulnerability

> **Success**
>
> POCs are provided in multiple formats including curl commands, HTTP requests,
> and scripted exploits when applicable.

### Example POC

For an SQL injection vulnerability, a POC might include:

```bash
curl -X POST https://example.com/api/login \
  -H "Content-Type: application/json" \
  -d '{
    "username": "admin'\'' OR 1=1--",
    "password": "anything"
  }'

# Expected behavior: Authentication bypass due to SQL injection
# Affected code: src/auth/login.ts:45 (parameterized query missing)
```

## Code-to-Vulnerability Mapping

With source code access, every vulnerability is mapped to precise locations in your codebase:

* **Affected Files**: Exact file paths where the vulnerability exists
* **Line Numbers**: Specific lines of code containing the vulnerability
* **Code Context**: Surrounding code for understanding the issue
* **Data Flow**: How user input reaches the vulnerable code
* **Proof-of-Concept**: Working exploit validated against the live system
* **Fix Recommendation**: Specific code changes to remediate the issue

> **Success**
>
> This precise mapping is what enables
> [auto-remediation](/console/features/auto-remediation) — AI-generated patches
> verified against your codebase and live environment.

## Penetration Test Reports

When testing completes, a comprehensive report is generated including:

#### Executive Summary

High-level overview of findings, risk assessment, and business impact for
stakeholders.

#### Technical Details

In-depth vulnerability descriptions, affected endpoints, code locations, and
technical analysis.

#### Proof-of-Concepts

Reproducible exploits validated against the live system for each finding.

#### Remediation Guidance

Specific recommendations and code examples for fixing each vulnerability.

Reports are available for download in multiple formats for compliance, audit, and documentation purposes. Learn more about [pentest reports](/console/features/pentest-reports).

## Continuous Testing

Integrate hybrid testing into your development workflow:

#### Pull Request Scanning

Automatically test changes in pull requests:

* Tests run on every PR
* Focus on changed files and affected code paths
* Results posted as PR comments
* Block merging if critical vulnerabilities are found

#### Commit-Based Scanning

Test on every commit to specific branches:

* Continuous security validation
* Rapid feedback on new code
* Prevent vulnerabilities from reaching production

#### On-Demand & Scheduled

Run comprehensive tests whenever needed:

* Launch tests manually at any time
* Set up recurring tests (daily, weekly, monthly)
* Monitor for new attack surfaces with automatic testing

## Best Practices

#### Provide Everything You Can

The hybrid methodology shines when the agent has maximum context:

* Connect your source code via VCS integration
* Add and verify all relevant domains
* Provide authentication credentials for every user role
* Upload API schemas and sitemaps
* Include context about your application's purpose and architecture

More context means higher precision and fewer false positives.

#### Provide Multiple Credential Sets

Supply credentials for different user roles to test authorization boundaries:

* Regular user account
* Admin or power user account
* API tokens with different permission levels

The agent tests with each credential set and also without credentials to find authentication bypass and privilege escalation vulnerabilities.

#### Start with Staging

Test staging environments before production:

* Lower risk of service disruption
* Safe environment for aggressive testing
* Same codebase, safer environment
* Validate findings before production tests

#### Enable Auto-Remediation

Take advantage of [automatic fixes](/console/features/auto-remediation):

* Configure PR creation for approved fixes
* Set severity thresholds for auto-remediation
* Review and merge fixes promptly

#### Monitor Testing Progress

Stay informed about testing activities:

* Review real-time testing progress in the console
* Address findings as they're discovered
* Track remediation progress

## Next Steps

#### [Getting Started](/console/getting-started)

Set up your workspace, connect source code, and run your first hybrid
pentest.

#### [Adding Domains](/console/domains/adding-domains)

Add and verify domains for live exploitation testing.

#### [Authentication](/console/features/authentication)

Configure authentication credentials for comprehensive coverage.

#### [Auto-Remediation](/console/features/auto-remediation)

Automatically fix vulnerabilities with AI-generated patches.

#### [Attack Surface](/console/features/attack-surface)

Understand how Pensar discovers and maps your attack surface.

#### [Authentication](/console/features/authentication)

Set up credentials so the agent can test protected application areas.