On this page0
Unfamiliar word? See Glossary: words used in these docs. Looking for the tasks in order? Begin at Start Here.
Reference
Included in: Advanced. Which Plan Includes What
Vulnerability Probes
Zonitix probes your instance for common classes of security issue on demand, or on a schedule you enable (scheduled scanning is opt-in and off by default). These are automated checks, not a substitute for a penetration test by a qualified human tester.
What The Probes Test
BOLA (Broken Object Level Authorization)
Tests whether one user can read another user's object. Against your own app it uses two real identities you supply: the owner and an attacker who must be refused.
IDOR (Insecure Direct Object Reference)
Checks if sensitive system objects (like database backups) are exposed via predictable paths.
SQL Injection
Runs custom payloads against your input fields to ensure your database layer is properly sanitized.
Prompt Injection (AI)
Sends adversarial prompts to your own AI endpoints to check they can't be steered into ignoring their instructions or leaking their system prompt.
PII Extraction (AI)
Probes your AI endpoints to confirm they won't reveal personal data from their context.
Email Authentication
Checks your domain's SPF, DMARC, and DKIM records so mail spoofed in your name is rejected.
Scheduled Security Checks
Penetration tests are run once or twice a year, leaving gaps between them where new security holes can be introduced by weekly updates. The Security Lab helps cover those gaps by running automated probes against your internal APIs and web pages on a schedule you set (or on demand). It looks for common issues like inputs that accept unsanitized text, services that return data without checking who is asking, or user accounts able to reach other users' profiles. It complements a real pen test rather than replacing one.
Automated Regression Checking
Compliance Proof
The six probes at the top of this page are highlights, not the whole suite — the Security Lab ships a registry of forty discrete probes: injection (SQLi, XSS), authorization (BOLA, IDOR), SSRF and CSRF, JWT and MFA-bypass checks, security-header and email posture (SPF/DMARC/DKIM), supply-chain and code scanning (Trivy, Nuclei, gitleaks, Semgrep, dependency audit), TLS/cipher posture, and resilience probes (ReDoS, Slowloris). The OSS-backed scanners return an inconclusive result rather than a false pass when their tool or target isn’t reachable. Not every probe runs in every scan: Semgrep, nmap CVE correlation, UDP/IPv6 exposure and container-image scanning are long-running and run only in the aggressive profile, and scheduled scans always use the standard profile.
If something here is not working as you expect, start with When something goes wrong.
The plain explanation is above. This part is for IT and developers: the exact settings, permission names, API addresses and data fields behind it. Closed: select the heading above to open it. While it is closed, your browser’s find-on-page (Ctrl+F or Cmd+F) does not search this part.
Threat Simulation Engine
The scanning microservice (`security-lab-service`) launches test payloads simulating malicious client requests. The module evaluates HTTP statuses and response headers to classify vulnerabilities.
| Test Class | Verification Logic | Pass Criterion |
|---|---|---|
| BOLA / privilege escalation | Sends PUT /user-management/users/1 with a { role: 'admin' } payload and inspects the status. | No clean pass today. The probe sends no credential, so 401 / 403 / 404 is reported Inconclusive. Any other answer that is not a 2xx (a rate limit, a redirect, a server error) is Inconclusive too. Only a 2xx, meaning the role change was accepted, is a High finding. Internal scans only. |
| SQL Injection | Shells out to sqlmap against the user-search endpoint (--batch --level=1 --risk=1). | SQLMap reports no exploitable injection point |
| IDOR Check | Internal: requests a known out-of-scope object id (GET /user-management/reports/9999) unauthenticated. Remote, when the scope declares a BOLA resource URL and both credentials: fetches the resource as its owner, then as the attacker (GET only). | Internal: 401 / 403. A 404 is Inconclusive (route absent, control not exercised). Two-identity: attacker gets 401 / 403 / 404. A High finding only when the attacker receives a byte-identical copy of the owner’s object; anything else is Inconclusive. |
The BOLA Probe, As Implemented
// security-lab-service/src/services/attacks/probes/authz.js (abridged)
bola: async ({ targetBase, correlationId }) => {
const res = await axios.put(
`${targetBase}/user-management/users/1`,
{ role: 'admin' }, // privilege-escalation payload
{ headers: { 'x-correlation-id': correlationId }, validateStatus: () => true }
);
// The probe sends NO credential, so a 401/403/404 is the auth layer refusing an
// anonymous caller. That does not prove the role-escalation guard fired, so it
// is reported Inconclusive, never as a pass.
if (res.status === 401 || res.status === 403 || res.status === 404) {
return inconclusiveResult({ reason: `BOLA probe sent no credential, so HTTP ${res.status} is an authN rejection ...` });
}
// Only a 2xx means the role change was ACCEPTED. A 429, 5xx, 400 or 3xx is not an
// escalation, so it is Inconclusive rather than a finding.
if (!(res.status >= 200 && res.status < 300)) {
return inconclusiveResult({ reason: `BOLA probe got HTTP ${res.status} ...` });
}
return { severity: 'High', score: 20, findings: ['API accepted unauthorized role modification!'] };
}
// Findings are persisted as SecurityFinding rows against the parent SecurityScan.
// New or regressed Critical/High findings can also POST to an out-of-band alert
// webhook (Slack/Teams/generic). That webhook is an instance-level setting Zonitix
// configures on your server on request; without it the outcome is logged and you
// read results in Security Lab. Ticketing and emailed reports are set in-app under
// Configure.