Pentestas / help

Documentation

Pentestas is an AI-driven penetration testing platform: it scans your web apps, APIs, networks, and cloud estate; synthesises multi-step attack chains with Claude; and ships verified, exploit-grounded findings instead of generic scanner noise. These docs cover every layer — from your first scan to running agents inside a corporate LAN.

→ Quick start
Sign up, verify your first domain, and kick off a scan in under five minutes.
⚡ Running scans
Web apps, APIs, networks, S3 / Azure / GCS buckets, Google Workspace, subdomain enumeration.
⚒ Security tools
Subdomain finder, port scanner, SSL/TLS, DNS audits, JWT, GraphQL, cloud recon — one tool at a time.
⌘ Agents
Scan on-prem services, intranet apps, and browser sessions from a tenant-scoped local agent.
◎ Findings
Severity, validation, attack chains, and Exploit-DB matches — understand what you're looking at.
∞ AI features
Scan modes, shared workbench tools, operator hints, attack chains, and false-positive filtering.
⟨⟩ API reference
Programmatic access: JWT, API keys, scans, findings, webhooks.
  • Security tools — single-purpose recon tools (subdomain finder, ports, SSL, DNS, JWT, …) with screenshots.
  • Your first scan — pick a target, choose scan types, start scanning.
  • Scan modes — Internal Engine vs + AI assist (hybrid) vs autonomous.
  • AI workbench — Claude uses the same History / Forge / Volley / OAST tools you do.
  • Operator hints — mid-scan control plane (focus / skip / retest / workbench).
  • Proof status — verified vs exploit-confirmed vs version-only.
  • Manual testing tools — Forge / Volley / OAST and the hands-on tabs on every scan.
  • Multi-surface pivot — web → Entra/Azure recon or AWS when keys exist.
  • Understanding severity — what CRITICAL means, how it differs from HIGH, and how CVSS fits in.
  • Attack chains — how Pentestas links multiple findings into a single compromise path.
  • Authentication — JWT, API keys, OAuth, and agent keys explained.

New here?

Start with Quick start. If you've never run a vulnerability scanner before, skim the glossary first — Pentestas assumes working familiarity with OWASP, CVSS, and the difference between a CVE and a CWE.

Need to talk to a human?