Documentation

Introduction to Nautillo Pro attack simulation workflow

Step-by-step guide to launching your first simulation

How to read attack narratives and evidence exports

Manage your profile, subscription, and account

Validate real attacker outcomes like auth bypass and cross-user access

Surface mapping plus goal-driven API exploit paths

Credential stuffing simulation, MFA signals, session and logout checks

Validate whether common injection paths lead to real impact

Exploit JWT token vulnerabilities for authentication bypass

Exploit XML parsers for file disclosure, SSRF, and data exfiltration

Detect file upload forms and flag missing server-side validation signals

Exploit Cross-Origin Resource Sharing misconfigurations

Exploit URL redirect parameters for phishing and token theft

Poison password resets, caches, and virtual host routing

Exploit frontend-backend desync for request hijacking

Exploit WebSocket connections for hijacking and injection

Optional DNS-based domain ownership verification for additional assurance

Login-then-scan, bearer tokens, session cookies, OAuth/SSO testing, and phased simulation

Redirect_uri hijacking, state/nonce/PKCE validation, token-in-URL, logout abuse, SAML RelayState

Single URL runs vs full domain discovery and exploration

Typed approval workflow before running high-impact actions

Automatic alarms and error threshold detection

Download multi-step attack chains and evidence in PDF and JSON

HTTP captures, signed audit logs, and step-by-step trails

Impact rating, reproduction steps, and remediation guidance

View past runs and track security improvements

Plan-based retention periods for simulation data and exports

How we protect your data and ensure compliance

Automated cleanup schedules and manual deletion

View evidence signatures, consent logs, and retention history

Generate business-logic probes and data exposure hypotheses with AI analyst support (Business plan)

AI downloads and analyzes JavaScript bundles to find vulnerabilities (Business plan)

AI generates context-aware attack payloads based on target analysis (Business plan)

Test whether your site's chat or AI endpoints are vulnerable to prompt injection (Business plan, AI-guided Exploration)

Configure rate limits, concurrency, and technique toggles for safe production simulations

Run credential spraying campaigns with built-in dictionaries and throttling