Verify vulnerabilities against the real application.
Farion uses routes, parameters, sinks, and data flows from static analysis to generate targeted exploit tests for authorized applications. Each test starts with a concrete finding and returns reproducible evidence.
Active Verification is enabled only after target ownership or explicit authorization has been verified.
Test a concrete security hypothesis.
Generic black-box scans begin with a URL and a catalogue of payloads. Farion begins with an identified route, a candidate vulnerability, the affected parameter, the relevant sink, and the data flow connecting them.
1. Verify and configure the target
Confirm domain ownership or testing authorization, configure the target URL, add authentication and secrets, and define the environment against which tests may run.
2. Discover the reachable application surface
Farion spiders the authorized application and combines the observed surface with routes and parameters identified by static analysis.
3. Generate targeted exploit tests
Farion agents create test suites in real time for findings produced by more than 1,000 SAST rules. Tests are generated for the affected route and vulnerability context instead of replaying a generic scan profile.
4. Review results and evidence
Each execution returns its payloads, requests, responses, observations, result, and associated application evidence. The result remains connected to the original finding and exploitability verdict.
| Name | Exploitability | CVEs | CWEs | ||
|---|---|---|---|---|---|
POST /auth/login | 5/5 | 7 | 7 | ||
A07:2021 – No rate limiting on authentication endpointCWE-307: Improper Restriction of Excessive Authentication Attempts DAST medium The /api/auth/login endpoint does not implement rate limiting or account lockout. An attacker can perform unlimited login attempts for credential brute-forcing. Target EndpointPOST https://shop.example.com/api/auth/login Attack DetailsPayloadEvidenceAll 100 requests returned HTTP 401 in ~0.8s avg response time with no rate limiting headers (X-RateLimit-*). No CAPTCHA or account lockout triggered. | |||||
GET /users/api | 4/5 | 7 | 7 | ||
PUT /users/:id | 4/5 | 5 | 3 | ||
DELETE /users/:id | 4/5 | 4 | 3 | ||
GET /restaurants/:id/menu | 3/5 | 5 | 5 | ||
GET /restaurants/feed | 3/5 | 5 | 2 | ||
POST /payments/checkout | 3/5 | 3 | 2 | ||
POST /auth/reset-password | 3/5 | 3 | 2 | ||
GET /users/:id/profile | 2/5 | 2 | 1 | ||
GET /admin/dashboard | 2/5 | 2 | 1 | ||
POST /orders | 1/5 | 1 | 1 | ||
PUT /orders/:id/status | 1/5 | 1 | 1 | ||
GET /restaurants/:id | - | 1 | — | ||
GET /orders/:id/track | - | 1 | — | ||
GET /search/export | - | 1 | — | ||
GET /orders | - | 1 | — | ||
GET /health | - | — | — | ||
GET /config/features | - | 1 | — | ||
Test the paths that anonymous scanners cannot reach.
Configure authentication and application secrets for the authorized target. Farion can verify findings behind authenticated routes while keeping credentials inside the controlled test workflow.
Frequently asked questions
Yes. Authentication and secrets can be configured for an authorized target so findings behind protected application paths can be tested.
No. Target ownership or explicit testing authorization must be verified before Active Verification is enabled.
See how Farion works on your application.
Request a guided evaluation or walk through the relevant workflow with our technical team.