autonomous offensive security
Most attack surfaces
are never actually
tested.
Impactr investigates your attack surface the way an attacker would - mapping it, chaining its weaknesses, and proving what's actually exploitable.
Enter Impactrdiscovery
A single endpoint becomes a mapped surface.
One public endpoint. Nothing else known yet.
Impactr maps the real surface behind it - the identity provider and backend infrastructure a scanner would never distinguish from noise.
Two weaknesses, each unremarkable on its own: an OTP endpoint with no rate limit, an IAM role with an overbroad trust policy.
attack path
Two weaknesses. Click each to see what they become together.
Neither of these is a finding on its own. Select both to build the chain.
the case file
This is what a finding looks like. Not a PDF of maybes.
Account takeover via IDOR chained through a JWT audience mismatch
POST /api/v2/accounts/{id}/session
A tenant-scoped access token is accepted on a sibling tenant's endpoint because the audience claim is never validated server-side.
Combined with sequential, guessable account IDs - already exposed in the invoice URLs recon surfaced - this isn't a theoretical gap. It's a working path from one account to any account.
Any authenticated user can mint a valid session for an arbitrary account: read their data, act as them, change their billing. No privilege escalation bug required - just two ordinary oversights, chained.
Validate the aud and sub claims against the requested account on every session-issuing route, and reject tokens whose subject doesn't own the target resource.
why impactr
Scanner and manual pentest each give up two of four. Impactr gives up none.
| Dimension | Scanner | Manual | Impactr |
|---|---|---|---|
| Coverage | |||
| Depth & reasoning | |||
| Evidence quality | |||
| Cadence |
control & compliance
Aggressive testing. Enterprise-grade control.
- Read-only by default
- Scoped to your targets
- Fully logged & auditable
- Your data stays yours
Produces evidence for
close the case