Unifying Manual, Automated, and Agentic Web Security Testing Through an Intelligent Multi-Agent System
Why should an agent receive an entire HTTP transaction when only part of it needs to be analyzed?
AI-powered security agents often receive the complete HTTP transaction, including the request line, headers, body, response headers, and response body, regardless of the security task they are performing.
However, different security analyses require different levels of context. Some tasks depend only on specific parts of an HTTP transaction, while other analyses may require the entire HTTP transaction.
Providing unnecessary information increases token consumption, processing time, and the complexity of reasoning, while offering no additional value to the agent's decision-making process. It can also introduce irrelevant context that may increase the likelihood of reasoning errors, incorrect interpretations, and hallucinations, reducing the agent's overall accuracy and reliability.
Example: HTTP Verb Tampering Analysis
Imagine an agent is assigned to perform HTTP verb tampering analysis. The goal of this test is to determine whether changing the HTTP method can bypass access controls or modify application behavior.
The agent only needs to understand and manipulate the HTTP method:
GET → POST GET → PUT POST → DELETE
A typical HTTP request:
POST /api/v1/profile HTTP/1.1
Host: example.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
Content-Type: application/json
Cookie: session=abc123
{
"username": "alice",
"email": "[email protected]",
"role": "user"
}
For this specific task, the only required context is:
POST /api/v1/profile HTTP/1.1
The following information provides no additional value for verb tampering analysis:
Host: example.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
Content-Type: application/json
Cookie: session=abc123
{
"username": "alice",
"email": "[email protected]",
"role": "user"
}
The headers and request body are unrelated to determining whether changing the HTTP method affects the application's authorization behavior.
Why should an agent regenerate an entire HTTP request when only part of it needs to be modified?
AI-powered security agents often generate complete HTTP requests every time they need to perform a new test. However, many security testing techniques do not require creating a completely new request; they only require modifying a small part of an existing request.
Regenerating the entire request for every variation increases token consumption, execution time, and reasoning complexity.
Instead, agents should identify and modify only the required part while preserving the remaining request context.
Example: CORS Misconfiguration Testing
Imagine an agent is testing for CORS misconfiguration. The main action required is changing the Origin header and observing how the server responds.
GET /api/v1/profile HTTP/1.1 Host: example.com Origin: https://trusted.com Authorization: Bearer eyJhbGciOiJIUzI1NiIs... Cookie: session=abc123 User-Agent: Mozilla/5.0
The only required modification is:
- Origin: https://trusted.com + Origin: https://attacker.com
The rest of the HTTP request remains unchanged.
If the agent regenerates the complete HTTP request for every test case, it repeatedly produces:
- The same URL
- The same headers
- The same cookies
- The same authentication data
The method, URL, cookies, authentication data, and request body remain identical. Regenerating the complete request for every CORS test is unnecessary because the agent only needs to modify a single header value.
Example: API Version Fuzzing
Imagine an agent is testing whether different API versions expose security issues.
The original request:
POST /api/v1/profile/update HTTP/1.1
Host: example.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
Content-Type: application/json
Cookie: session=abc123
User-Agent: Mozilla/5.0
{
"user_id": "12345",
"username": "alice",
"email": "[email protected]",
"role": "user"
}
The testing strategy may require checking:
/api/v1/profile/update /api/v2/profile/update /api/v3/profile/update /api/v4/profile/update
The only changing part is the API version:
- POST /api/v1/profile/update HTTP/1.1 + POST /api/v2/profile/update HTTP/1.1
The method, headers, authentication data, cookies, request body, and other request parts remain identical.
Regenerating the complete request for every API version test is unnecessary because the agent only needs to modify a single part of the request path.
Addressing these challenges leads to the development of an agentic system that integrates the solutions to enable faster, more reliable, and cost-efficient security agents capable of operating with both large and small language models while reducing processing overhead.The system unifies manual, automated, and agent-driven security testing within a single framework. It also supports extensibility through plugins, allowing integration with existing security platforms such as Burp Suite, Caido, and other security platforms. The system is designed around an architecture where:
Agents Are Configurable
Configure every agent to match your workflow by selecting the tools and models it can use, choosing default configurations, assigning specialized skills, defining execution limits, and deploying or undeploying agents as needed. Manage API keys for your preferred LLM providers, monitor usage, and generate integration keys for external tools such as Burp Suite, Caido, and other security platforms.
Agents Are Interactive
Accelerate manual security testing with interactive agents such as Repeater Agent, designed for fast, on-demand actions. Modify and replay HTTP requests, change HTTP methods, tamper with API versions, transform request formats, and automate multiple repetitive testing tasks with a single prompt. These agents focus only on executing your instructions—they do not analyze vulnerabilities, validate findings, or make security decisions, leaving the investigation entirely under your control.
Agents Are Autonomous
Delegate complex security assessments to autonomous agents such as Pentester Agent, IDOR Agent, and other specialized security agents. Assign a high-level objective like discovering IDOR vulnerabilities, authentication flaws, or injection issues, and let the agent determine the best testing strategy. Even without an explicit objective, autonomous agents can analyze the provided request or endpoint, identify potential attack surfaces, and generate their own testing plan before beginning the assessment. They continue exploring, testing, validating, and reporting findings until the objective is achieved, a stopping condition is reached, or the configured execution limits are met, allowing researchers to focus on results instead of managing every testing step.
Contexts Are Controllable
Control exactly what information agents receive during security testing by defining their request and response context. Restrict agents to specific request components such as the request line, query parameters, headers, or body, or provide access to response headers, response bodies, and metadata such as status codes, response time, and response size. Agents only analyze the selected context, allowing you to reduce noise and focus testing on the information that matters.
Agents Are Orchestratable
Build sophisticated security workflows by combining multiple requests and multiple agents with flexible orchestration strategies. Assign one or more agents to each request and choose whether they work sequentially, in parallel, or through hybrid execution. Multiple requests can also be tested using the same execution strategies, enabling complex assessment pipelines. With a single prompt, the Planner Agent can generate workflows that coordinate requests, assign agents, and organize execution for efficient security testing.
Agents Are Schedulable
Automate security operations by scheduling agents to execute tasks at specific times or recurring intervals. Schedule one-time assessments, run recurring vulnerability checks, or launch complex workflows during off-hours. Once scheduled, agents automatically execute the assigned objectives without requiring manual intervention.
Agents Are Observable
Monitor every stage of agent execution through an interactive workflow graph that visualizes how agents connect, collaborate, and progress in real time. Track execution state through live status indicators, watch vulnerabilities appear as agents discover them, pause or resume running tasks whenever needed, and inspect any agent to view its activity, current status, assigned task, and results from a single interface.
