Proxy Agent

1. Review Credential Context
   └── Check auth state (authenticated / unauthenticated)

2. Analyze Architecture
   └── Always calls proxy-analyzer first
       ├── Extracts objects (data entities)
       ├── Extracts roles (user types)
       ├── Extracts functions (endpoint purposes)
       └── Extracts object values (IDs for IDOR testing)

3. Get Session Context
   └── Calls web_get_session_context
       ├── How many credentials are available?
       ├── What objects and fields are known?
       ├── What endpoints have been seen?
       └── Are there pending re-tests?

4. Intelligent Agent Selection
   └── Analyzes request surface + session context
       ├── What inputs does this endpoint accept?
       ├── Are there identifiers in the path or body?
       ├── What does the endpoint do (CRUD, auth, financial)?
       └── What context has been accumulated?

5. Launch Testing Agents in Parallel
   └── Dispatches 3–6 agents per request when relevant

6. Process Re-test Queue
   └── Feeds high-priority re-tests back as new requests

Request:  POST with body (email, password, name)
Session:  No credentials yet

✅ proxy-analyzer         — extract User object
✅ proxy-tester-injection  — test SQLi in email/name, XSS in name
✅ proxy-tester-authn     — test weak password policy, user enumeration
✅ proxy-tester-mass-assignment — test injecting role, is_admin fields
❌ proxy-tester-idor       — no IDs to manipulate
❌ proxy-tester-authz      — no auth required
❌ proxy-tester-ssrf       — no URL parameters
❌ proxy-tester-file-attacks — no file upload
❌ proxy-tester-business-logic — not transactional

Request:  GET with numeric ID in path
Session:  1 credential, Order object known

✅ proxy-analyzer          — extract order details
✅ proxy-tester-idor        — test ID manipulation: 572, 574, 1, 0, -1
✅ proxy-tester-authz       — test without credential, test guest access
❌ proxy-tester-injection   — no input parameters
❌ proxy-tester-mass-assignment — GET request

Request:  POST {"cart_id": 456, "total": 99.99, "payment_method": "credit_card"}
Session:  2 credentials, Order/Payment objects known

✅ proxy-analyzer
✅ proxy-tester-business-logic  — test negative total, zero, overflow, price manipulation
✅ proxy-tester-idor             — test cart_id manipulation
✅ proxy-tester-mass-assignment  — test injecting discount, admin_override fields
✅ proxy-tester-injection        — test SQLi/XSS in payment fields
✅ proxy-tester-authz            — test with different credentials
❌ proxy-tester-authn            — not auth endpoint
❌ proxy-tester-ssrf             — no URL parameters
❌ proxy-tester-file-attacks     — no file operations

Request:  GET with file parameter
Session:  1 credential

✅ proxy-analyzer
✅ proxy-tester-file-attacks  — test path traversal: ../../etc/passwd
✅ proxy-tester-authz          — test accessing other users' files
✅ proxy-tester-injection      — test if filename is reflected
❌ proxy-tester-idor           — file parameter is string, not numeric ID
❌ proxy-tester-ssrf           — file path, not URL

## Credential Context

credential_id: admin-user
label:         admin-user
container_id:  container-2
headers:
  Authorization: Bearer eyJhbGci...
  Cookie: session=abc123
role_id: admin

Endpoint:     POST /api/checkout
Credential:   admin-user (admin role)
Discoveries:  Payment object with fields: total, discount, payment_method
Agents run:   business-logic, idor, mass-assignment, injection, authz

Results:
- business-logic: FINDING — negative total accepted (price manipulation)
- idor: No finding — cart IDs not accessible across users
- mass-assignment: FINDING — discount field injection accepted
- injection: No finding
- authz: FINDING — guest checkout bypasses payment requirement