# External pentest

> Test an application from the Internet: prove control of the domain, write the Guidance, prepare and launch the pentest, understand what happens during the test, follow its activity up to the report.

The external pentest tests an application reachable from the Internet. The scope is the list of authorised HTTPS URLs under the verified domain, each tested as an exact URL over IPv4: nothing is added by discovery, neither subdomain, nor port, nor IP address.

Five pages cover the journey: domain ownership proof, the Guidance, the launch, what happens during the test and the follow-up. Results are described in the [Results](https://docs.spectr-ai.eu/en/resultats) section.

> [!NOTE]
> The platform enforces network confinement in addition to the agents' instructions: a destination outside the scope is refused before being contacted. The exclusions you write (paths, hosts) are test instructions; they are not yet a network block for external scans.

---

https://docs.spectr-ai.eu/en/pentest-externe