Web Pipeline

The web pipeline runs a full OWASP WSTG assessment against a web application. You give it a URL, and it crawls the target, captures traffic, dispatches specialist agents per WSTG category, tests for vulnerabilities, chains findings together, and delivers verified results — all from a single prompt.

Starting a Web Assessment

Launch the web pipeline from any CyberStrike interface:

• TUI / Web UI / Desktop: type /hackbrowser — a dialog opens where you enter the target URL and options
• CLI: run cyberstrike hackbrowser https://app.example.com directly from your terminal

This starts the crawler and kicks off the entire pipeline. Everything that follows is automatic.

What Happens

1. Crawl & Discovery

HackBrowser opens a browser and navigates through the target. You can let the AI drive autonomously, take over manually while the AI observes, or just let it passively monitor traffic.

While the browser navigates, a discovery engine runs in the background to find endpoints the browser might miss: sitemaps, JavaScript route bundles, HTML links, API schemas (OpenAPI, GraphQL). This is deterministic — it doesn’t depend on the AI.

The scope engine keeps the crawler focused on your target. Third-party services (auth providers, analytics, CDNs) are blocked automatically. If your app makes cross-domain API calls (e.g., api.example.com), the scope expands to include them.

2. Traffic Analysis

Every HTTP request and response captured during the crawl flows through Vortex, which runs independently of the AI:

• Rules match against traffic patterns — security headers, information leaks, interesting parameters, technology fingerprints
• Canary tokens are injected into requests to detect where input values get reflected in responses — and in what context (HTML body, script block, attribute)
• Injection points are identified automatically: parameters, headers, and body fields suitable for testing
• Signals generated by these matches get routed to the correct specialist agent

This layer catches things even if the AI doesn’t notice them.

3. Specialist Testing

Based on the signals from Vortex, specialist agents are dispatched — each focused on one area of the OWASP Web Security Testing Guide:

109 checks across 12 WSTG categories. A single request can trigger multiple specialists when it shows signals from different categories.

You don’t need to invoke any of these agents directly — they’re dispatched automatically based on what Vortex detects in the traffic.

4. Chain Detection & Escalation

After specialists finish testing, the escalation hunter looks across all findings to detect when separate vulnerabilities combine into something worse:

Each chain gets a confidence score. Low-severity findings that chain into critical impact get escalated automatically.

What the Agents Use

The specialists don’t just ask the AI to “test for XSS.” They carry purpose-built security tools designed for each testing area.

Probe Tools

Each probe contains domain-specific attack logic — not generic payloads:

For example, the injection probe doesn’t send the same XSS payload everywhere — it analyzes the reflection context and generates payloads that match the specific output location (HTML body, attribute, script block, JSON response).

Traffic Query Tools

Every specialist can query the traffic corpus captured by Vortex:

• Search for high-signal findings the rule engine flagged
• Deep-inspect any transaction
• Query traffic with a DSL (filter by method, path, status, headers, body)
• View discovered API objects and functions
• Compare responses across user roles (for IDOR/BFLA detection)
• Find where a specific value appears across all traffic
• List endpoints that haven’t been tested yet

The input validation specialist additionally gets tools to discover injection points from traffic and actively probe them through Vortex’s send engine.

Out-of-Band Detection

Agents can generate unique out-of-band tokens and inject them into payloads (SSRF, XXE, blind injection). If the token gets hit by the target server, the agent detects it — confirming vulnerabilities that produce no visible response.

Reviewing Results

During the assessment, findings appear in real time. Use these commands to review them:

The triage agent independently verifies each finding by replaying HTTP evidence before marking it as confirmed.

Authenticated Testing

When launching /hackbrowser, the dialog lets you define user roles for the target application — for example, an admin account and a regular user account. If you define multiple roles, HackBrowser opens a separate browser instance for each one simultaneously, crawling and capturing traffic under each identity in parallel.

This matters because authorization testing requires seeing how the same endpoint responds to different privilege levels. The specialist agents automatically compare responses across roles to detect IDOR, broken access control, and privilege escalation — they don’t just test one account in isolation.

CyberStrike captures the full authentication state (cookies, tokens, headers) during each role’s login and propagates it to all specialist agents throughout the assessment.

What You Control