Verify vulnerabilities against the real application.
Farion uses routes, parameters, sinks, and data flows from static analysis to generate targeted exploit tests for authorized applications. Each test starts with a concrete finding and returns reproducible evidence.
Active Verification is enabled only after target ownership or explicit authorization has been verified.
Test a concrete security hypothesis.
Generic black-box scans begin with a URL and a catalogue of payloads. Farion begins with an identified route, a candidate vulnerability, the affected parameter, the relevant sink, and the data flow connecting them.
1. Verify and configure the target
Confirm domain ownership or testing authorization, configure the target URL, add authentication and secrets, and define the environment against which tests may run.
2. Discover the reachable application surface
Farion spiders the authorized application and combines the observed surface with routes and parameters identified by static analysis.
3. Generate targeted exploit tests
Farion agents create test suites in real time for findings produced by more than 1,000 SAST rules. Tests are generated for the affected route and vulnerability context instead of replaying a generic scan profile.
4. Review results and evidence
Each execution returns its payloads, requests, responses, observations, result, and associated application evidence. The result remains connected to the original finding and exploitability verdict.
| Name | Exploitability | CVEs | CWEs | ||
|---|---|---|---|---|---|
POST /auth/login | 5/5 | 7 | 7 | ||
No rate limiting on authentication endpointMEDIUM POST /api/auth/loginStack traces exposed in error responsesLOW POST /api/auth/loginA07:2021 – No rate limiting on authentication endpointCWE-307•DAST•MEDIUM The /api/auth/login endpoint does not implement rate limiting or account lockout. An attacker can perform unlimited login attempts for credential brute-forcing. Target EndpointPOST https://shop.example.com/api/auth/loginParameter email, password Attack DetailsPayload 100 sequential POST requests with different password values Evidence All 100 requests returned HTTP 401 in ~0.8s avg response time with no rate limiting headers (X-RateLimit-*). No CAPTCHA or account lockout triggered. References CWE-307: Unknown Weakness A07:2021 | |||||
GET /users/api | 4/5 | 7 | 7 | ||
PUT /users/:id | 4/5 | 5 | 3 | ||
DELETE /users/:id | 4/5 | 4 | 3 | ||
GET /restaurants/:id/menu | 3/5 | 5 | 5 | ||
GET /restaurants/feed | 3/5 | 5 | 2 | ||
POST /payments/checkout | 3/5 | 3 | 2 | ||
POST /auth/reset-password | 3/5 | 3 | 2 | ||
GET /users/:id/profile | 2/5 | 2 | 1 | ||
GET /admin/dashboard | 2/5 | 2 | 1 | ||
POST /orders | 1/5 | 1 | 1 | ||
PUT /orders/:id/status | 1/5 | 1 | 1 | ||
GET /restaurants/:id | - | 1 | — | ||
GET /orders/:id/track | - | 1 | — | ||
GET /search/export | - | 1 | — | ||
GET /orders | - | 1 | — | ||
GET /health | - | — | — | ||
GET /config/features | - | 1 | — | ||
Test the paths that anonymous scanners cannot reach.
Configure authentication and application secrets for the authorized target. Farion can verify findings behind authenticated routes while keeping credentials inside the controlled test workflow.
Powerful testing requires explicit authorization.
Farion does not provide unrestricted testing of arbitrary targets. Active Verification runs only against URLs configured by the customer after ownership or authorization has been confirmed.
Frequently asked questions
Yes. Authentication and secrets can be configured for an authorized target so findings behind protected application paths can be tested.
No. Target ownership or explicit testing authorization must be verified before Active Verification is enabled.
See how Farion works on your application.
Request a guided evaluation or walk through the relevant workflow with our technical team.