Web and API security testing with AI
Plan authorized Web and API security checks with Hackcat, compare access-control behavior, and collect reproducible evidence for fixes.
Who this is for
For solo pentesters and developers assessing an application they own or are authorized to test. Use Hackcat to investigate authentication, authorization, input handling, and exposed application behavior. Start with a specific question rather than treating a scanner result as a complete assessment.
What to provide
Provide the authorized hosts and endpoints, an API schema or documentation if available, and the accounts and roles allowed in the test. Explain the expected access boundaries and excluded actions. Prefer a staging environment with test data when checks can change state.
Review with Ask mode
Use Ask mode to review an OpenAPI file, inspect a suspicious response, reason about role boundaries, or discuss a code change. It can help build a test matrix and explain observations, but a proposed issue still needs a reproducible check.
Execute with Agent mode
Use Agent mode to inspect the target, choose relevant tools from the Registry, read documentation, and perform permitted checks with terminal and browser tools. Describe expected behavior so the Agent can compare results across roles and preserve useful evidence instead of relying on status codes alone.
Choose an execution environment
Use a cloud sandbox for accessible test endpoints. An internal application, private API, or VPN-only service may require a connected local or desktop environment. Tool support, network access, timeouts, and account permissions determine which checks can run; provide explicit limits for state-changing requests.
Evidence and deliverables
Request a report that separates confirmed issues from observations needing review. Each confirmed issue should include an affected endpoint, preconditions, reproduction steps, evidence, impact, and a proposed fix. After a change, repeat the relevant checks and compare the results before calling the issue resolved.
Limits and responsible testing
No automated assessment proves an application secure. Business logic, multi-step workflows, and production-specific behavior can need manual investigation. Use test accounts and avoid destructive operations, unrestricted load testing, or access to unrelated user data unless those actions are explicitly authorized.