External pentest
Test an application from the Internet: prove control of the domain, write the Guidance, prepare and launch the pentest, understand what happens during the test, follow its activity up to the report.
The external pentest tests an application reachable from the Internet. The scope is the list of authorised HTTPS URLs under the verified domain, each tested as an exact URL over IPv4: nothing is added by discovery, neither subdomain, nor port, nor IP address.
Five pages cover the journey: domain ownership proof, the Guidance, the launch, what happens during the test and the follow-up. Results are described in the Results section.
In this section
- 01Verify the domainProve that you control an application's domain through an HTTPS file or a DNS TXT record, understand the time limits and resolve verification failures.
- 02Write the GuidanceGive the agents the context of an application: attack surface, priorities, strategy and prohibited techniques, evidence requirements and stop conditions, OpenAPI or Postman documents and test accounts.
- 03Launch a pentestPrepare a pentest on a verified target: choose and order the authorised URLs, provide test accounts, set the guardrails, accept the five attestations, launch, and understand what is deducted.
- 04During the testWhat happens on your application during a SpectrAI pentest: real traffic, test data, alerts, firewalls and CDNs, the recommended environment, prohibited techniques and what the guardrails do or do not guarantee.
- 05Follow the activityRead the page of a running pentest: the four phases, the duration and latest end time, the test plan, the surfaces tested, the last activity, cancelling and resuming.