How the test works
Two steps: a free light scan anyone can run, and a deep test that runs only after you prove the domain is yours. Here is every check, how we score it, and what we don’t test.
1. The free scan
Type a domain on the front page and the scan runs in about 30 seconds. It only does what any visitor or DNS resolver does: a handful of ordinary requests to your front page, a TLS handshake, DNS lookups, and public data other people publish.
| Area | What we check |
|---|---|
| Encryption in transit | Certificate validity, trust chain, name match and expiry; TLS 1.0, 1.1, 1.2 and 1.3 each tried; HTTP to HTTPS redirect |
| Security headers | HSTS and its length, Content-Security-Policy and unsafe-inline, clickjacking protection, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, software versions in headers, end-of-life software |
| Cookies | Secure, HttpOnly and SameSite on every cookie the front page sets |
| CORS | One request with a foreign Origin: is it trusted, and with credentials? |
| Libraries | Versioned JavaScript libraries in the page, looked up in OSV.dev for published vulnerabilities; third-party scripts without integrity checks; mixed content |
| Error pages | A page that doesn’t exist: does it show a stack trace or a debug screen? |
| Email spoofing | SPF and its lookup count, DMARC and its policy, DKIM on the common selectors |
| DNS | CAA, DNSSEC, name servers; subdomains from certificate transparency logs |
| Disclosure | A security.txt contact (RFC 9116) |
You see a grade, the count of findings by severity, and the first two findings in full with their evidence and fix.
2. Proving the domain is yours
A penetration test without the owner’s permission is an attack, so the deep test runs only on a domain you’ve proved you control. Pick one:
- A DNS TXT record on your domain:
pentrail-verification=<your code>. This covers the domain and its subdomains. - A file at
/.well-known/pentrail-verification.txtcontaining your code. This covers that host only. - A meta tag on your front page:
<meta name="pentrail-verification" content="<your code>">. This covers that host only.
You verify before you pay, so you’re never charged for a test we can’t run. The report’s cover says which way you verified and what that covered.
3. The deep test
After payment the deep test runs in the background, usually in one to five minutes, and you watch each step. On top of everything in the free scan:
| Area | What we check |
|---|---|
| Network | 50 common TCP ports on each address that belongs to you (CDN edge addresses are skipped: they aren’t yours). Open Redis, Elasticsearch, Memcached and Docker APIs are tested for missing authentication; SSH versions are checked against published vulnerabilities |
| Exposed files | 80 paths attackers request: .git and other source-control folders, .env files, cloud and npm credentials, private keys, configuration backups, database dumps and archives, phpinfo, server-status, Spring Boot actuator, pprof, logs, API documentation, GraphQL introspection, directory listings, WordPress XML-RPC and user listing |
| Application | Open redirects on 17 common parameters, HTTP TRACE, JavaScript libraries recognised from the scripts’ own banners |
| TLS | Weak cipher suites (3DES, RC4) |
| Subdomains | Up to 30 (the riskiest names first): takeover on 17 hosting services, CNAMEs to names that no longer exist, broken HTTPS, internal tools reachable from the internet (Jenkins, Grafana, Kibana, GitLab, phpMyAdmin, Jupyter and more) |
| DNS | A zone transfer (AXFR) asked of each name server |
Rules we follow
- Non-destructive: we prove a weakness exists and stop. No exploitation beyond that, no password guessing, no denial of service, no data changed.
- Paced: a few requests at a time, a couple of hundred in total, each identified as
PentrailScanner/1.0. - Secrets we find are redacted in the report: we show enough to prove the file is exposed, never the whole key.
4. Scoring and SOC 2 mapping
Every finding has a CVSS v3.1 base vector, so its score is the standard one (critical 9.0 and up, high 7.0, medium 4.0, low above 0). Each is classified by CWE and the OWASP Top 10 (2021) and mapped to the AICPA Trust Services Criteria it touches: CC2.3, CC4.1, CC6.1, CC6.6, CC6.7, CC6.8, CC7.1 and CC8.1. The grade starts at 100 and loses points per finding; any critical caps it at F and any high at C.
5. The report
A web report and a PDF with a cover, an executive summary and the order to fix things in, scope and method, the SOC 2 control map, every finding with its evidence and fix, and an attack-surface appendix. Claude (Anthropic) writes the summary from the test’s findings and states no fact the test didn’t find. A one-page letter of attestation comes with it, with a public link anyone can use to check that it’s genuine. Fix what we found and press Retest: three retests are included within 30 days.
What we don’t test
Anything behind your login, business logic, internal networks, social engineering, physical security and source code. An automated external test can’t replace a manual test of those. If your auditor or a customer requires one, our report gives the tester a head start.
Where the data comes from
Our own requests to your systems; certificate transparency logs (crt.sh and Cert Spotter); DNS over HTTPS (Cloudflare) for DNSSEC; vulnerability data from OSV.dev, licensed CC-BY 4.0.
See your own grade
Scan your domain and see what an attacker sees.