// how prober works
Our Approach
Three-phase AI-driven methodology combining automated scanning with intelligent analysis
Three-Phase Testing Workflow
Pre-Scan (Automated)
Baseline reconnaissance using industry-standard tools to gather data about your infrastructure.
Host Discovery (naabu)
Port Scanning (65,535 ports)
Service Detection (svcprobe)
Known-CVE Matching (svcprobe)
Web Technology Detection
Web Vulnerabilities (nuclei)
SSL/TLS Analysis (testssl.sh)
Strategic Analysis (AI)
AI analyzes pre-scan results to identify attack surfaces, prioritize targets, and create a strategic testing plan.
Reviews all Phase 1 scan results
Identifies high-value targets and attack surfaces
Cross-references service versions with CVE databases
Generates up to 10 NEXT_STEP recommendations with priority, tool, command, and reasoning
Creates strategic testing roadmap for deep-dive analysis
Deep Testing (AI-Driven)
AI executes targeted tests based on strategic analysis, adapting its approach based on what it finds and iterating until the surface is covered.
Executes commands from NEXT_STEP recommendations
Analyzes results after each command execution
Validates vulnerabilities with follow-up targeted tests
May recommend additional tests based on new discoveries
Progressively builds a full vulnerability report
Saves raw results after each iteration (complete data recovery)
// coverage floor
Every port, path, and service.
A deterministic sweep runs on every test before the AI does, so nothing on your surface goes unchecked.
// full-surface sweep0 / 0 checked
AI-Powered Analysis
What Makes Our AI Different
Most vulnerability scanners just dump raw tool output. Prober runs a roster of specialist AI experts, each chasing the exploit chains a scanner never sees and validating what they find.
Correlates findings across multiple tools
Cross-references with CVE databases and CVSS scores
Prioritizes vulnerabilities by severity and exploitability
Explains business impact for non-technical stakeholders
Provides actionable remediation recommendations
A chain we followed
Not a list of versions. A proven route from an exposed service to root.
1
Exposed service
vsftpd 2.3.4 on :21
2
Known backdoor
CVE-2011-2523
3
Trigger
malformed USER payload
4
Shell
command execution
5
Root
uid=0(root)
Model Selection
Every test runs on Anthropic's Claude, matched to its depth, with automatic fallback:
● Claude Opus (deep tests)
Claude Sonnet (standard)
Claude Haiku (fast paths)
If a model is rate-limited or unavailable, the test falls back to another Claude model, so it never stalls.
Security Toolset (75+)
Network Scanning
- • naabu - High-speed port scanning
- • svcprobe - Service & version detection
- • httpx - HTTP service probing
Web Application Testing
- • nuclei - Template-based vulnerability scanning
- • OWASP ZAP - Web app security scanner
- • katana - Crawling & endpoint discovery
- • ffuf - Content & parameter fuzzing
SSL/TLS Analysis
- • testssl.sh - SSL/TLS configuration testing
- • sslscan - Cipher & protocol analysis
- • tlsx - Certificate & TLS inspection
Exploitation Research
- • Metasploit - Exploit modules & validation
- • sqlmap - SQL injection testing
- • commix - Command injection testing
- • searchsploit - Exploit database search
Progressive Data Tracking
We save raw results after every phase and iteration. Even if a test fails mid-execution, you'll never lose your data.
After Phase 1
Pre-scan results saved
After Phase 2
Strategic plan saved
Each Iteration
Commands & findings saved
Final Report
After deep testing completes, the AI generates a full vulnerability assessment, compliance-ready for your audits.
Report Includes
- ✓ Executive summary with risk rating
- ✓ Detailed findings by severity
- ✓ Business impact analysis
- ✓ Technical evidence and proof
- ✓ CVE references & CVSS scores
- ✓ Remediation recommendations
- ✓ Host and service inventory
- ✓ Complete methodology documentation
Output Formats
report.json
Structured data for APIs
report.html
Professional visual report
raw-results.json
Complete audit trail
// see it in action
Real findings, prioritized. With proof.
A representative slice of one report. Every finding shows how we found it, what it means, and how to fix it, mapped to the frameworks your auditors accept.
84 findings
RISK · CRITICAL6
Critical
12
High
11
Medium
17
Low
38
Info
report // reborp.app10 findings · 4 critical
How foundRaw TCP connection to port 1524 via bash /dev/tcp; the socket immediately returned an interactive root shell prompt. A single non-destructive 'id' command was issued to confirm the shell executes as root, per read-only evidence rules.
ImpactComplete, unauthenticated remote root compromise of the host. Any network-adjacent attacker can obtain a root shell with zero credentials, enabling full data theft, lateral movement, and persistent backdoor installation.
FixRebuild the host from a known-clean image. Audit for the process bound to 1524 (commonly a netcat listener spawned via inetd/xinetd) and remove it. Implement host-based intrusion detection and regular integrity checks…
confirmed· CWE-912· CVSS 10
How foundenum4linux-ng -A performed unauthenticated (null session, username='' password='') SMB/RPC enumeration and retrieved the exact Samba version string from srvinfo and SMB session negotiation.
ImpactSamba 3.0.20 with default 'username map script' smb.conf setting allows an attacker to inject shell metacharacters into the username field during SMB session setup, achieving unauthenticated remote command execution as…
FixUpgrade Samba to a patched, supported version (>=3.0.25 or current LTS) and remove/replace unsafe 'username map script' configuration.
confirmed· CVE-2007-2447· CWE-78· CVSS 10
How foundConnected using the mysql CLI client specifying user 'root' with no password argument supplied; connection succeeded and read-only queries executed without any authentication challenge, confirming a blank password. Root user is also configured to accept…
ImpactComplete compromise of database confidentiality and integrity is possible: an attacker can read/modify/delete all data in every schema, create new users, read arbitrary local files via LOAD_FILE (if FILE privilege…
FixEnforce strong unique passwords for all MySQL accounts, remove the wildcard-host root account, apply principle of least privilege for application accounts, and disable remote root login. Upgrade MySQL from the long-EOL…
confirmed· CWE-521· CVSS 9.8
How foundRaw TCP banner grab on port 6667 returned IRC server NOTICE/AUTH lines identifying the host as 'irc.Metasploitable.LAN', consistent with the known backdoored Metasploitable2 UnrealIRCd service.
ImpactIf this is the trojanized UnrealIRCd build, any remote attacker can execute arbitrary OS commands as the service user by sending a crafted message containing a semicolon-prefixed shell command, resulting in full remote…
FixReplace the UnrealIRCd binary with an official, verified release; validate package checksums/signatures against the vendor to rule out trojanized source.
potentialroe-forbidden· CVE-2010-2075· CWE-912· CVSS 9.8
How foundcurl retrieval of the Apache-generated directory index for /dav/ (DAV/2 enabled, Apache 2.2.8) revealed uploaded test artifacts; direct GET requests to individual files confirmed their content matches known automated PUT-based vulnerability-scanner payloads.
ImpactAny unauthenticated attacker can upload arbitrary files (including web shells) to the server via HTTP PUT and immediately retrieve them, and — depending on server-side script handler configuration — potentially achieve…
FixReconfigure Apache's mod_dav to require authentication and restrict allowed HTTP methods to GET/POST/HEAD only for public-facing paths; disable directory indexing globally.
confirmed· CWE-434· CVSS 7.5
How foundAttempted authenticated connection with well-known default credential pair postgres/postgres using the psql CLI client; successful login and query execution confirms valid authentication (read-only SELECT version() executed, no data modified).
ImpactSuperuser-level access to the PostgreSQL instance allows an attacker to read/exfiltrate all data in all databases, and on unpatched PostgreSQL 8.3.1 could potentially be leveraged for further privilege escalation to…
FixEnforce strong unique passwords for all PostgreSQL roles, set pg_hba.conf authentication method to scram-sha-256, disable remote superuser login where not required, and upgrade PostgreSQL to a supported, patched…
confirmed· CWE-798· CVSS 8.2
How foundcurl request to /phpinfo.php returned HTTP 200 with a full phpinfo() output page (a common leftover debug file); content grepped for sensitive configuration directives.
ImpactExposes internal server paths, PHP build configuration, loaded extensions, environment variables, and confirms no dangerous functions are disabled — significantly aiding an attacker in crafting a working RCE payload if…
FixDelete debug/informational files such as phpinfo.php from production web roots, set expose_php=Off in php.ini, and configure disable_functions to restrict exec/system/passthru/shell_exec/popen where not required by the…
confirmed· CWE-200· CVSS 7.5
How foundManual TCP connect probes (/dev/tcp) against standard TLS ports and curl against port 80 confirming HTTP-only service with no corresponding HTTPS listener.
ImpactAny network-position attacker (MITM, ARP spoofing, shared LAN) can passively capture session cookies (PHPSESSID, phpMyAdmin session), DVWA login credentials, and phpMyAdmin/database credentials in cleartext, and can…
FixEnable mod_ssl on Apache with a valid certificate, redirect all HTTP to HTTPS, and enforce HSTS. Apply equivalent TLS wrapping (stunnel or native TLS support) for FTP, database and other cleartext services where…
confirmed· CWE-319· CVSS 5.9
How foundcurl requests to standard phpMyAdmin documentation paths (/phpMyAdmin/Documentation.html, /phpMyAdmin/ChangeLog) returned HTTP 200 with the exact version embedded in the page title and changelog header.
ImpactPrecise version fingerprinting allows an attacker to look up and target known CVEs specific to phpMyAdmin 3.1.1 (multiple XSS and SQL injection issues in that release series), accelerating exploitation.
FixUpgrade phpMyAdmin to the latest supported release and ensure installer/documentation artifacts are excluded from production deployments.
confirmed· CWE-200· CVSS 5.3
How foundcurl -I sent to root, DVWA login page and phpMyAdmin; response headers manually inspected for absence of standard security headers.
ImpactAbsence of X-Frame-Options/CSP frame-ancestors allows the site to be embedded in an iframe on an attacker-controlled page enabling clickjacking. Absence of X-Content-Type-Options allows MIME-sniffing attacks. Absence…
FixConfigure Apache (via mod_headers) to add: Header always set X-Frame-Options "SAMEORIGIN"; Header always set X-Content-Type-Options "nosniff"; Header always set Content-Security-Policy "default-src 'self'"; Header…
confirmed· CWE-693· CVSS 4.3
// a representative report slice · click any finding to open it