Operator · Agentic Pentest

From your spec to proof.

Point Operator at your API. It tests every operation, chains a real exploit, and hands you a working proof — live.

139Proven-exploitable
1,730Findings
5Live targets
Operator, api.example.com +
operator.planckdefense.com/scans

api.example.com

EXPLOITING FULL_VALIDATE RUNNING

API agent, 32 operations

›_operator console · 0 events
Working
Ask the operatorlive · steering

01 The proof

Open one. There’s the data.

Every finding ships a working PoC — CVSS, the exact request, and the other user’s account it returned.

operator.planckdefense.com / findings / bola-users
CRITICALA01NEWBroken Object Level Authorization (BOLA): any user can read and modify any other account via /api/v2/users/{id}

Confirmed by the AI exploitation agent with a working proof-of-concept.

CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Confidence
✓ AI-validated
Frameworks
API1:2023CWE-639
Remediation

Enforce object-level authorization on every request. Verify that the authenticated principal owns or is entitled to the requested object id server-side, and never trust a client-supplied id. Use unguessable identifiers as defense in depth, but do not rely on them in place of an ownership check.

RequestGETCOPY
GET /api/v2/users/1042 HTTP/1.1 Host: api.example.com Authorization: Bearer <user 1042 own JWT> --- next request --- GET /api/v2/users/1043 HTTP/1.1 Host: api.example.com Authorization: Bearer <same user 1042 JWT>
Response200COPY
{ "id": 1042, "email": "[email protected]" } --- next response --- HTTP/1.1 200 · server: nginx/1.24.0 content-type: application/json { "id": 1043, "email": "[email protected]", "phone": "+1 415 555 0164", "role": "admin" }
References
owasp.org/API-Security/…/API1-BOLAcwe.mitre.org/data/definitions/639.htmlCWE-284: Improper Access ControlPortSwigger: IDOR
↻ Re-test→ ReplaySTATUS open ▾
Ask AI about this finding

Ask anything about this finding — impact, exploitation, remediation, how to verify a fix.

e.g. how do I fix this? is it exploitable?Ask

02 The impact

One chain. Login to every account.

The exact path an attacker walks from a forged token to every user’s data — mapped to MITRE ATT&CK.

operator.planckdefense.com / attack-path
Proven chain → business impact
1
TA0006 · CREDENTIAL
Forge any user’s JWT via md5(server timestamp)
2
TA0001 · ACCESS
BOLA: read any account via /users/{id}
3
TA0004 · PRIV-ESC
Mass-assign role=admin on another account
4
TA0040 · LOGIC
webhooks/restore forges a paid subscription
5
TA0040 · IMPACT
Any user’s data · unauthorized premium
Credential AccessBroken AuthorizationPrivilege EscalationBusiness Logic

03 Command center

Your exposure, as it builds.

A live risk score, the severity split, OWASP/MITRE coverage and verification confidence, the whole picture assembling itself as you scroll.

Security Overview
Attack surface intelligence
live

04 Deliver

Proof, where you already work.

Straight to Jira, GitHub and Slack — deduped by fingerprint. Export CSV, JSON, SARIF, PDF.

operator.planckdefense.com / integrations
Push findings to your stack
JiraNOT SET

One issue per new finding, deduped.

Connect
GitHubNOT SET

Issue per finding, by severity.

Connect
SlackNOT SET

Scan summary when a scan finishes.

Connect
WebhookNOT SET

POST findings JSON to SIEM / SOAR.

Connect

Ready when you are

Know what’s exploitable
before they do.

Point Operator at your API. Get proof — not a to-do list.