xalgorixA verified pentest report
in minutes — from $1.
Xalgorix runs reconnaissance, injection, IDOR, SSRF, RCE, and 18 other offensive phases against your target — then ships a verified, evidence-backed report.
credit packs from $1 · never expire
proof · not a demo
What it found on a real target
We pointed Xalgorix at pentest-ground.com:9000 — a public, deliberately-vulnerable target. In 43 minutes it returned 6 findings and reproduced every exploit before reporting it.
Remote Code Execution
Arbitrary commands as root via the /eval endpoint (uid=0 confirmed).
SQL Injection auth bypass
Logged in as any user on /tokens and dumped the database schema.
IDOR — password exposure
/user/{id} returned every account's password by incrementing the id.
features
Everything you need for autonomous security testing.
From live scan telemetry to branded PDF reports — Xalgorix handles the full engagement lifecycle, hosted on our infrastructure.
Hosted Web Dashboard
No installs, no Go toolchain, no LLM keys. Sign in and launch your first scan in 60 seconds.
Live Scan Telemetry
WebSocket event stream: tool calls, agent messages, HTTP activity, phase progress — all in real time.
22-Phase Methodology
Run the full sweep or focus on recon, injection, auth, API, upload, cloud, or WebSocket phases.
Verified Findings
Every finding is exploit-verified before it lands in your report. Less noise, more signal.
Branded PDF Reports
Executive summary, severity breakdown, PoC, remediation steps — with your company logo.
Scan Modes
Single target or wildcard / multi-target. Credit-based, no surprise bills.
Schedules & Automation
Recurring scans on cron-style schedules. Continuous coverage of your attack surface.
Team & Sharing
Share findings and reports with stakeholders via signed links. No login needed for read-only views.
REST API
Programmatic scan creation, status, and report retrieval. Wire Xalgorix into your CI/CD.
Rate Limits & Safety
Configurable request rates, circuit breakers, and blocked destructive commands protect your infra.
Scan Persistence
Resume interrupted scans. Multi-target queues process sequentially with full state recovery.
Multi-LLM Backend
We run on top frontier models — GPT-5, Claude, Gemini. You don't manage providers or keys.
Your data stays yours.
Security testing means trusting us with sensitive targets and findings. We treat that data as private by design — isolated per customer, encrypted in transit, and never sold or used to train models.
Isolated by default
Every scan, finding, and report is scoped to your account with database row-level security. No other customer — or team — can read your data.
Encrypted in transit
All traffic runs over TLS. Reports are shared only through signed, expiring links that you create and can revoke at any time.
You stay in control
Export or delete your scans and reports whenever you want. We never sell your data, and we never train models on your targets or findings.
Authorized & logged
Scans run only against targets you confirm you're allowed to test, and every scan is tied to your account for a clear audit trail.
methodology
22 phases. Every engagement.
Pick the full sweep or focus on a single phase. Every finding is exploit-verified before it lands in your report.
workflow
From signup to report in 7 steps.
Zero to scanning in under 60 seconds. We handle the infrastructure, methodology execution, and report generation.
Sign up
Create an account in seconds, then add credits from $1.
Add target
Paste a URL, hostname, or wildcard. We validate scope on submit.
Pick mode
Single or wildcard. Choose all 22 phases or a focused subset.
Launch
Scan kicks off instantly on our infrastructure. No queue, no waiting.
Monitor live
Watch tool calls, agent messages, and phase progress stream in real time.
Review findings
Verified findings with severity, evidence, CVSS, and remediation guidance.
Share report
Download a branded PDF or share a signed link with your team.
scan modes
Two ways to engage.
Single target
One URL or host. Fastest path to actionable findings.
Best for: known URLs, quick assessments
Wildcard / multi
Enumerate attack surface, then scan everything discovered.
Best for: bug bounty, surface discovery
More tools from Xalgorix.
A growing family of offensive-security products. Built by the same team, sharing the same methodology.
BountyLabs
liveHands-on labs and CTF-style environments to sharpen your bug-bounty edge.
HuntFlow
coming soonWorkflow automation for bug-bounty hunters — recon, triage, and reporting in one pipeline.
BugReportly
coming soonBeautiful, structured bug reports that program managers actually want to read.
live observability
Watch every scan in real time.
WebSocket-powered event stream surfaces tool invocations, agent reasoning, findings, HTTP activity, LLM token usage, and phase transitions — the second they happen.
- 147
- Tool Calls
- 12
- Findings
- 48.2k
- LLM Tokens
- 2,341
- HTTP Requests
findings & reports
From scan output to report-ready findings.
Centralized findings with severity filters, CVSS details, evidence, and branded PDF report generation.
SQL Injection in Search Parameter
https://target.com/api/search
Unauthenticated SQL injection via the 'q' parameter allows arbitrary database queries.
IDOR on User Profile Endpoint
https://target.com/api/users/{id}
Authenticated users can access any user profile by modifying the ID parameter.
Missing Rate Limiting on Login
https://target.com/login
No rate limiting on authentication endpoint allows brute-force attempts.
pricing
Simple. Credit-based.
why xalgorix
How we compare.
The depth of a real pentest, the speed and price of a scanner — without the false positives of legacy DAST or the wait of an agency.
Comparison reflects typical offerings in each category; exact capabilities vary by vendor and tool.
hosted vs self-hosted
Two ways to run Xalgorix.
The engine is open source. This site is the hosted version — same methodology, zero setup. Or grab the CLI and run it on your own infrastructure.
Prefer self-hosted? Get the open-source CLI on GitHub →
faq