Capabilities
What a NexusVoid VAPT tests, the toolchain behind it, how findings are validated, and the three reports you receive.
A NexusVoid VAPT is a real penetration test, not a surface scan. Here is exactly what we test, how we test it, and what you get back.
What We Test
Every scan exercises the OWASP Web and API Top 10 and the vulnerability classes that matter for modern web apps and APIs:
- Injection & input validation, covering SQL/NoSQL operators, command injection, and malformed input reaching the data layer.
- Authentication & sessions, covering brute-force and rate-limiting, credential stuffing, and MFA/CAPTCHA gaps.
- Access control (BOLA/IDOR), covering cross-tenant access on objects, endpoints, and API keys.
- Session & JWT handling, covering algorithm confusion (
alg:none), signature tampering, weak secrets, and missing org/tenant binding. - Sensitive data exposure, covering tokens, PII, and internal fields leaking in responses.
- Security misconfiguration, covering server-tech disclosure, CSRF surface, and missing hardening headers.
- TLS & cryptography, covering cipher and certificate analysis.
- Infrastructure & exposure, covering open ports, exposed services, and subdomain enumeration.
Under the Hood
We orchestrate 150+ attacking agents built on the same open-source tools professional pentesters use, tuned automatically to your detected tech stack:
| Tool | Role |
|---|---|
| Nuclei | CVE templates, custom probes, zero-day patterns |
| OWASP ZAP | Web application scanning (passive + active) |
| SQLMap | SQL injection detection |
| Nmap | Port scanning and service detection |
| SSLyze | TLS/SSL cipher analysis |
| Subfinder | Subdomain enumeration |
Assessments follow recognized methodology, namely OWASP WSTG v4.2, PTES, and NIST SP 800-115, with findings scored on CVSS v3.1.
Proven Findings, Not Scanner Noise
The difference between a NexusVoid VAPT and a raw scanner dump is validation. Every finding that reaches your report is:
- Confirmed by reproducing it against your target, with the HTTP request/response evidence included.
- Scored with a CVSS v3.1 vector and severity.
- Mapped to OWASP Web/API, CWE, and MITRE ATT&CK.
- Fixable with step-by-step remediation, plus a copy-paste prompt you can hand to an AI coding assistant.
This keeps your engineers fixing real issues instead of chasing false positives.
One Scan, Three Reports
Most tools give you one raw finding dump. We deliver three purpose-built documents.
Full VAPT Report, for engineers
Every finding with severity, CVSS, proof-of-concept evidence, affected endpoint, and step-by-step remediation. Includes a remediation priority matrix and a "what went well" section covering controls that resisted attack.
Compliance Report, for auditors
A clean control-mapping view: every finding mapped to SOC 2, ISO 27001, PCI DSS, GDPR, and HIPAA, with a status column so accepted risks are clearly distinguished from open findings. Ready to hand to your auditor. Pair it with Aegis to automate the rest of your audit program.
Business Report, for CXOs
A one-page executive brief: overall risk posture, business impact of the top findings, and a prioritized remediation roadmap, with no jargon.
Re-scans & Finding Lifecycle
Security is a moving target, so findings have a lifecycle:
- Open means it needs remediation and counts against your posture.
- Resolved means you fixed it and a re-scan verified the fix, so it no longer counts.
- Accepted risk (by design) means an intentional behaviour your team formally accepts; it is documented separately and does not block a clean result.
Re-scan any verified domain whenever you ship changes to keep your report, and your attestation, current.