Permissioned attack simulation
TrojanStrike runs a real, permissioned intrusion against your own website — rate-limited, non-destructive, every request logged — and shows you exactly how far an attacker would get, with the evidence and the fix. Recon is always free — your first strike is too.
How it works
One operation, continuously adapting from first signal to final judgment. Scroll — watch it unfold.
Your target assembles out of raw signal — every route, header, and asset catalogued, ownership verified, before a single probe is sent.
The crawler turns the site into an attack map — pages, forms, API endpoints — and marks where pressure can be applied.
Thousands of permissioned probes fire at the lattice. Almost everything deflects. What pierces is captured as evidence — read-only, non-destructive, every request logged.
Everything the strike learned converges into a single verdict — the evidence behind it, and the fix.
From click to verdict
This is the entire engagement — what you do, what TrojanStrike does, and exactly what lands in your hands at the end.
A finding, exactly as reported
Not a mock-up. Every finding in your report carries the verdict, the proving request, the impact, and the fix — like this one.
Open a full sample report →GET /api/orders/1042 → 200
authenticated as user A, response contains user B's order record
Customer data exposed across account boundaries.
Enforce object-level authorization on every record fetch (CWE-639).
“I found something suspicious.”
A maybe. A severity score. A ticket you learn to ignore.
“I tried it, and here's the evidence.”
A proof. A request log. A fix you can act on today.
Verdicts
No scores, no hedging. A single verdict that tells you exactly where you stand — backed by the evidence that produced it.
Breached, and data walked out the door.
Confirmed data extraction, read-only.
The attacker got in.
A critical or high finding holds up.
The attacker reached the door. It didn't open.
Medium-severity issues confirmed.
Your defenses held the line.
No exploitable condition proven within the strike.
Engine room
Each capability below runs against your stack and reports only what it can prove — payload, response, differential, nothing less.
Discovers the injection context, then proves it with a bounded, read-only data pull.
Substitutes operator objects into JSON bodies and measures the record-set differential.
Plants a unique callback address; a hit from your server is the only admissible proof.
Replays alg=none and RS256/HS256 confusion forgeries against your own session oracle.
Re-requests objects across ownership boundaries and flags foreign data in the response.
Retries extension-filtered reads with double-encoded null bytes to expose filter bypasses.
Drives a headless browser with an inert markup canary and confirms it lands as live DOM.
Probes common autoindex directories and classifies any sensitive entries it finds.
Reads your shipped bundles for hardcoded credentials and known key formats — redacted, always.
Detects edge mitigation and suppresses findings whose evidence a block page could have faked.
The strike adapts
Mid-scan, TrojanStrike fingerprints your stack and re-orders the attack surface to fit it, promotes the checks the evidence supports, forms hypotheses as it learns — credentials it harvests, sessions it earns, routes it infers — and turns confirmed findings into attack paths with a goal. The list above is what it can do; this is how it decides what to do next.
See the planning brain →// observable planner decisions, streamed live
fingerprint django 4.2 · session-cookie auth · 14 endpoints
promote ssti — template markers in 3 responses
hypothesis default credentials advertised in HTML comment
confirm session armed — /admin unlocked (was 403)
path idor → cross-user read → data exfiltration
Rules of engagement
A scan cannot start until domain ownership is attested and re-verified live. There is no bypass and no exception.
Proof-of-extraction stops at the minimum that demonstrates impact — SELECT-only SQLi, an allowlist of identity commands, nothing destructive, ever.
Abort any scan mid-flight. Every request we send is logged for your review, and you can purge the data at any time.
Permissioned by design
Prove it's yours — 60 seconds. Then the recon fires itself. The legal gate is the product: it's how you know the attack is real, and how the world knows it's welcome.
Drop a meta tag or a DNS record on your domain. One method, about a minute, done once.
The moment verification lands, a passive RECON scan launches automatically — no button to find.
Your surface map streams into a live report. The first verdict is already on its way.
Pricing
Pay for verdicts, not vibrations. Every price in AUD — no seats, no tiers of tiers.
The surface map, on the house.
The full active assault, once.
The assault, behind your login.
The watch that never stands down.
Need volume? 5 strikes A$1,795 · 10 A$3,390 — for consultants and teams.
What you run between penetration tests — not a replacement for one.