Xalgorix

About Xalgorix

Xalgorix is an autonomous penetration-testing agent whose distinguishing rule is that it reports nothing it has not exploited. Point it at a running application or a repository and it works through a twenty-two-phase methodology — reconnaissance, CORS and cookie handling, injection, IDOR, and on through to an explicit exploit-verification phase — and every finding that reaches the report has a working proof attached. That constraint is the answer to the failure mode that makes most automated scanners unusable in practice: a wall of maybe-vulnerabilities that a human has to triage before any of it can be acted on. The published example run is against pentest-ground.com, a deliberately vulnerable public target, and returned nine findings including remote code execution as root via an eval endpoint and a full database dump through auth bypass, in about seventeen minutes, with each exploit reproduced before it was written up. The CI story follows from the same rule: a GitHub Action runs an exploit-verified pass on every pull request and fails the build only on findings it actually proved, at a severity threshold you set, so the gate is on real risk rather than scanner noise. There is a public REST API, signed scan.completed webhooks and an open-source CLI, plus branded PDF reports that are dated and evidence-backed for auditors.

Key Features

Tags