methodology
The 22-phase
engagement.
Every Xalgorix run executes these phases in order. Output from each phase becomes input to the next — so a subdomain found in phase 1 gets fingerprinted in phase 2, fuzzed in phase 3, and exploited in phase 20.
Six logical stages
The 22 phases collapse into six stages — useful when you're explaining results to stakeholders.
Recon & surface mapping
phases 1–3Build a complete picture of what's exposed — hosts, paths, tech.
Auth & session
phases 4–5Validate every door before knocking on the windows.
Injection & data exposure
phases 6–9The classics: SQLi, XSS, SSRF, broken object-level auth, GraphQL.
Exploitation & RCE
phases 10–12Anywhere code or state can be coerced into running on the server.
Infrastructure & content
phases 13–19Cloud, DNS, email, CMS, sockets, and content surfaces.
Verification & reporting
phases 20–22Prove every finding, hunt for novel chains, ship a clean report.
Every phase, in detail
Each phase has a defined goal, toolchain, and output schema.
01Reconnaissance›
Goal. Map the full external attack surface before touching any endpoint.
Outputs. Live subdomains, tech stack fingerprint, TLS posture, open ports.
02Manual vulnerability discovery›
Goal. Replay common bug-bounty patterns against the discovered surface.
Outputs. Quick-win findings: debug pages, default creds, exposed dashboards.
03Directory and file discovery›
Goal. Brute-force directories, files, and parameters the app never advertised.
Outputs. Hidden endpoints, backup files, leftover admin panels.
04CORS and cookie analysis›
Goal. Validate cross-origin and cookie hygiene end-to-end.
Outputs. Misconfigured Access-Control headers, missing SameSite/HttpOnly flags.
05Authentication and session testing›
Goal. Stress-test login, MFA, session, and password-reset flows.
Outputs. Token replay, weak JWT verification, account-takeover chains.
06Injection testing›
Goal. Probe every input for SQLi, XSS, SSTI, command injection.
Outputs. Confirmed injection vectors with payload + database fingerprint.
07SSRF testing›
Goal. Detect server-side request forgery via callbacks and metadata services.
Outputs. Out-of-band callbacks, cloud-metadata reads, internal-network pivots.
08IDOR and broken access control›
Goal. Test object-level authorization across roles and tenants.
Outputs. Cross-tenant reads/writes, missing ownership checks.
09API and GraphQL testing›
Goal. Audit REST + GraphQL endpoints, including introspection and batching.
Outputs. Introspection enabled, query-depth issues, broken auth on hidden routes.
10File upload testing›
Goal. Push uploads to break out of the storage sandbox.
Outputs. Path traversal, unsafe MIME handling, executable upload + RCE.
11Deserialization and RCE›
Goal. Exercise deserialization sinks across languages.
Outputs. Gadget-chain RCE on cookies, queues, RPC payloads.
12Race conditions and business logic›
Goal. Hit race conditions and business-logic boundaries.
Outputs. Double-spend, coupon stacking, TOCTOU privilege escalation.
13Subdomain takeover›
Goal. Hunt for unclaimed subdomains pointing at deprovisioned providers.
Outputs. Claimable CNAMEs (S3, Heroku, GitHub Pages, etc.).
14Open redirect testing›
Goal. Detect open redirects exploitable in phishing or OAuth flows.
Outputs. Unsanitised redirect parameters, host-header poisoning.
15Email security testing›
Goal. Audit SPF/DKIM/DMARC posture and inbox spoofability.
Outputs. Spoofable domains, weak DMARC policies, missing BIMI.
16Cloud and infrastructure›
Goal. Look for exposed cloud assets and infrastructure leakage.
Outputs. Public buckets, .git directories, leaked secrets in JS bundles.
17WebSocket testing›
Goal. Fuzz WebSocket handshakes and message flows.
Outputs. Missing origin checks, auth bypass over wss, message injection.
18CMS-specific testing›
Goal. Run CMS-specific playbooks (WordPress, Drupal, Magento, Shopify).
Outputs. Vulnerable plugins, XML-RPC misuse, theme-level RCE.
19Broken link hijacking and content spoofing›
Goal. Catch broken outbound links + spoofable content surfaces.
Outputs. Expired link targets, embed-based content spoofing.
20Exploit verification›
Goal. Re-run every suspected vulnerability with an exploit-class payload.
Outputs. Only verified, exploitable findings survive into the report.
21Novel vulnerability discovery›
Goal. LLM-driven hypothesis generation on app-specific logic.
Outputs. Novel chains the rule-based scanners didn't surface.
22Final report›
Goal. Assemble a branded, exec-ready report with full remediation guidance.
Outputs. PDF + HTML + JSON exports, CVSS scoring, evidence bundle per finding.
Operating principles
Exploit-verified by default
Every finding survives a second pass where the engine attempts a non-destructive proof-of-exploit. Unverifiable findings are dropped, not downgraded.
Deterministic + LLM-augmented
Rule-based phases give you reproducibility. The LLM layer (phase 21) adds the lateral thinking a static rule set misses.
Safe in production
No destructive payloads, rate-limit awareness, automatic backoff on 5xx surges, and a kill-switch you can hit from the dashboard.
Evidence over claims
Every finding ships with the request, the response, the payload, and a reproducible curl. No 'possibly vulnerable' fluff.
Run the methodology on your stack.
Start scanning on Cloud in minutes. Full 22 phases unlocked. One-time packs or subscriptions — credits never expire.