Pentest a web application
Black-box (and optionally source-assisted) penetration testing of a running web app with Strix's autonomous agents. Every reported finding is validated with a working exploit, so there are no signature-based false positives to triage.
Install, LLM setup, all CLI flags, and the managed-cloud alternative are covered in the
penetration-testing-with-strix skill — read it if the target is not a running web app, or if
fails. This skill is the web-app-specific workflow.
1. Confirm authorization and scope
Before running anything, establish:
- The target is the user's (or they are explicitly authorized to test it). Never pentest a third-party site on a hunch.
- Which environment. Prefer staging over production; agents send real exploit payloads and will create/modify data.
- Out-of-scope paths — payment flows, mass-email endpoints, admin destructive actions, third-party SSO providers.
- Credentials. Most real vulnerabilities live behind login. Without a test account, the agents only ever see the marketing surface.
Ask for anything missing rather than guessing.
2. Run the scan
bash
strix -n -t https://staging.example.com --max-budget 20 \
--instruction "Test account: qa@example.com / <password>. In scope: /app/*, /api/*. Do not touch /billing or send email. Focus on access control between the two seeded orgs."
Notes that matter for web apps specifically:
- Give it credentials via (or for anything long), including how to log in if the flow is unusual (magic link, SSO, MFA-exempt test user).
- Two accounts beat one. Multi-tenant IDOR and broken-access-control bugs — consistently the highest-impact class in web apps — can only be proven when the agent can attempt cross-account access.
- Add the repo for white-box depth when you have the source:
-t https://github.com/org/app -t https://staging.example.com
- Localhost works. Point at
http://host.docker.internal:3000
- for a fast dev-loop pass, (~30 min) for a normal review, for pre-release assurance. Always set .
For a hosted run with no Docker/LLM key, or when the user wants a shareable dashboard and an auditor-ready PDF, use the cloud path in managed-pentesting-with-strix instead — same engine, same findings.
3. Review results
Read
strix_runs/<run>/penetration_test_report.md
first, then per-finding files in
. Each contains the PoC — re-run it yourself to confirm before reporting to the user.
Exit codes:
no validated vulns in what was analyzed,
vulnerabilities found,
fatal error. A
is not proof of full coverage — if the budget or turn cap was hit the scan wraps up early, so check
status and cost against
before calling the app clean.
4. Fix and verify
Hand findings to the fix-security-vulnerabilities-with-strix skill: patch the root cause, then re-run Strix against the same target to prove the exploit no longer works. Re-testing is the only reliable confirmation a fix landed.
To keep the app tested on every change rather than once, wire Strix into CI with ci-security-scanning-with-strix.