SQL Injection
CriticalAn unsanitised query parameter accepts ' OR '1'='1 and returns full result rows: read access to the underlying database from an unauthenticated request.
Offensive Security · AI red team · Continuous pentesting
Your attack surface, red-teamed by AI. Every day.
Vulnix0 builds a live inventory of every domain, subdomain, open port and exposed service your organisation owns, then runs the same reconnaissance-to-exploitation chain an attacker would use to actually break in. It does this continuously and under policy control, instead of once a year in a PDF.
Vulnix0 is the first project out of Velocity Lab, OneFirewall Alliance's research and development team. It was built with AquilaX Security, OneFirewall's code and infrastructure assessment partner, and it now runs live, enriched with the same alliance threat intelligence used across the rest of the OneFirewall platform.
Read about Velocity Lab →The platform
Sixteen modules. One engine. No gaps between them.
Most teams run a scanner for the perimeter, a separate tool for the application layer, a mailing list for threat intel, and a spreadsheet to track what a pentester found eight months ago. Vulnix0 replaces that stack with sixteen modules, and every one of them feeds the same asset graph and the same finding-correlation engine.
001
Attack Surface Management
Continuous enumeration of domains, subdomains, open ports and cloud-hosted assets. Every pass is diffed against the last one.
002
Asset Discovery & Recon
Subdomain enumeration (wordlist plus passive Certificate Transparency monitoring), DNS record analysis, WHOIS, technology fingerprinting, subdomain-takeover detection and lookalike/typosquat domain monitoring, all before exploitation starts.
003
Automated Penetration Testing
Configurable, module-scoped exploit attempts against what recon finds: default-credential and login-lockout testing, HTTP request smuggling and Host header injection. Results come back as reproducible request/response evidence, not a bare CVSS score.
004
Dynamic Application Security Testing
Runtime fuzzing of every crawled parameter for injection, broken access control and logic flaws, plus GraphQL introspection/playground exposure and JWT/session-token checks (alg:none, weak signing secrets, missing expiry).
005
Dynamic Security Analysis
Full-site crawl, form and parameter extraction, HTTP method and WebDAV exposure audit, and header-posture scoring ahead of the exploit phase.
006
Data Leakage Detection
Exposed .env files, verbose stack traces, hardcoded secrets, API keys and private keys in crawled responses, plus a passive GDPR/ePrivacy check for third-party trackers set without a consent mechanism.
007
DNS & Email Security
SPF/DKIM/DMARC validation with a plain-English spoofability verdict, DNSSEC chain validation, unauthenticated zone-transfer (AXFR) testing, wildcard-DNS detection and open-resolver testing on your own nameservers.
008
Files Discovery
Directory and file enumeration against the paths attackers check first (.git, backups, configuration dumps) plus public cloud-storage bucket checks across S3, GCS, Azure Blob and DigitalOcean Spaces.
009
Performance & Resilience Testing
A configurable stress test (concurrency, request volume, duration) that measures latency percentiles and rate-limit behaviour under real load, plus a bounded, safe DoS-resilience check. It is never a real denial-of-service attack.
010
Offensive Security Assessments
Correlates findings from every module into attack paths, and fingerprints the WAF/CDN actually standing in front of the target. This is how an adversary chains low-severity issues into a breach.
011
Open Port Analysis
Full TCP enumeration with service fingerprinting, including anonymous LDAP bind and weak RDP (no NLA/TLS) checks, flagging insecure protocols and exposed databases.
012
Threat Intelligence Validation
Cross-references owned domains, IPs and file hashes against live threat-intelligence feeds where configured.
013
Threat Intel
The asset inventory feeds continuous reputation correlation rather than a one-time lookup.
014
Cybercrime Intel
Checks whether your IPs and domains already appear in botnet, C2 or phishing-tracking sources.
015
TLS/SSL Security Scan
Native cipher-suite, protocol, OCSP-stapling, HSTS-preload and certificate-chain assessment with no external binary required, certificate-expiry alerting, and an opt-in deep testssl.sh pass.
016
Continuous Security Monitoring
Every module re-runs on schedule, with drift detection instead of a single point-in-time report.
Methodology
Hunt. Exploit. Prove. Repeat.
Four stages, not a single scan. Each one feeds the next, and the loop restarts the moment your infrastructure changes, not when a yearly calendar entry comes round.
01
Discover
Reconnaissance agents enumerate domains, subdomains, APIs, cloud assets and exposed credentials, then build a graph of how they connect.
02
Exploit, under policy
Each candidate finding is actually attempted, not inferred from a banner, within the aggressiveness ceiling you set per scan.
03
Prioritise
A SQL injection on an internal staging form and one on your auth endpoint get the same CVSS score. Here they get very different priorities.
04
Repeat, on change
A new subdomain, an opened port or a newly deployed endpoint triggers re-testing on its own. No engagement letter required.
Sample findings
What an attacker, or Vulnix0, would actually find.
Eight entries from the classes of finding the engine confirms most often across real engagements. Each one is a live check with a request and a response behind it, not a CVE title copied off an advisory feed.
Stored Cross-Site Scripting
HighA comment or profile field stores <script> payloads and replays them to every later visitor of that page, session included.
Broken Object-Level Authorization
HighIncrementing an ?id= parameter returns other users' records with no ownership check. Classic IDOR, confirmed by sequential probing.
Anonymous FTP Login
HighUSER anonymous / PASS <anything> is accepted with no real credential check, giving unauthenticated access to whatever file store sits behind it.
Unauthenticated Redis Access
CriticalCommands succeed with no AUTH at all: read, write or delete every key. This is the exact signal behind a long string of real ransom and wiper incidents.
Kubernetes Dashboard — Skip Auth
CriticalA dashboard reachable with no RBAC, offering "Skip" instead of a token, logs you in as whatever the service account can do. The same bug was behind the 2018 Tesla cryptomining breach.
Unauthenticated AI Model API (Ollama / MCP)
HighThe model-serving API or an MCP server's tools/list answers with no auth: model inventory, inference and, in some cases, filesystem or shell tool access for anyone who finds the port.
DNS Zone Transfer (AXFR)
CriticalThe nameserver hands the entire zone (every internal hostname, mail server and IP) to any anonymous dig axfr request, not just its configured secondaries.
These eight are illustrative, not exhaustive. Below is the class taxonomy the sixteen modules actually test against, grouped the way a penetration tester scopes an engagement.
Injection & application logic
CWE-89 · CWE-79 · CWE-78 · CWE-22 · CWE-639- SQL injection, including blind and time-based extraction
- Reflected and stored cross-site scripting
- OS command injection and path traversal
- Server-side template injection (SSTI)
- Broken object-level authorization (IDOR/BOLA) via sequential-ID probing
- Open redirect and CORS misconfiguration
Authentication & session handling
CWE-287 · CWE-306 · CWE-798- Missing or bypassable authentication on exposed services
- Default and hardcoded credential acceptance
- Session cookie attributes: Secure, HttpOnly, SameSite
- Brute-force and rate-limit exposure on login and reset endpoints
Exposed infrastructure & services
CWE-306 · CWE-200- Unauthenticated Redis, MongoDB and Elasticsearch instances
- Anonymous FTP and open SMTP relays
- Kubernetes Dashboard, kubelet and etcd without RBAC
- Remote-management exposure: VNC, WinRM, RDP
- IoT/ICS protocol exposure: MQTT, Modbus, RTSP, DICOM
AI/ML attack surface
CWE-306 · T1595.002- Unauthenticated Ollama and other model-serving APIs
- MCP servers exposing
tools/listwith filesystem or shell access - Vector database exposure without access control
Network, DNS & transport
CWE-200 · CWE-295 · CWE-326- DNS zone transfer (AXFR) exposure
- SPF, DKIM and DMARC misconfiguration enabling spoofing
- Deprecated TLS versions and weak cipher suites
- Certificate chain, expiry and revocation status
Information disclosure
CWE-200 · CWE-538- Exposed
.env,.gitand backup files - Verbose stack traces and internal hostname leakage
- Hardcoded secrets and credential patterns in responses
External reputation & threat correlation
OneFirewall Alliance intelligence- Domain/IP presence on botnet, C2 and phishing infrastructure lists
- Dark-web and paste-site mentions tied to your assets
- Historical compromise indicators on owned infrastructure
Why continuous
The annual pentest was never built for how fast you ship.
A traditional pentest describes your environment on one day of the year. Your environment changes every week.
| Capability | Traditional pentest | Vulnix0 |
|---|---|---|
| Testing cadence | Once or twice a year | Continuous, 24/7 |
| Coverage as you grow | Fixed scope, goes stale fast | Discovers new assets automatically |
| Driven by | Manual human testers | AI agents with human-grade methodology |
| Time to re-test a fix | Next engagement cycle | Same day |
| Output | Static PDF report | Live dashboard and prioritised findings |
Access policy
This isn't a signup form. It's a live exploit chain.
Vulnix0 doesn't stop at finding a weakness. It chains reconnaissance through to verified exploitation against real infrastructure, so we don't put it behind a public "start scanning" button. Every account is provisioned by the OneFirewall team against a specific, vetted environment, and a person reviews it before a single request goes out.
Who it's for
- Security teams scanning assets they own, or are contractually authorised to test
- Enterprises replacing or augmenting an existing pentest or red-team programme
- MSSPs and OneFirewall Alliance partners operating under a signed client scope
- Research and red-team engagements with documented rules of engagement
Not available for
- Anonymous sign-ups with no verifiable ownership of the target environment
- Scans against infrastructure we can't confirm you're authorised to test
- Open, self-serve trials with no environment review
- Use outside the scope agreed at provisioning
FAQ
Questions, answered.
What is Vulnix0?
Vulnix0 is an AI-driven offensive security platform that continuously discovers your real attack surface and safely simulates real-world attacker behaviour against it. It combines attack surface management, autonomous penetration testing, DAST, threat intelligence validation and data leakage detection in one system.
Where did Vulnix0 come from?
Vulnix0 is the first project out of Velocity Lab, OneFirewall Alliance's R&D team. It was built inside the lab in collaboration with AquilaX Security and is now operating as a live product.
How is AI actually used in the pentesting?
AI chains reconnaissance, prioritises which discovered assets and parameters are worth testing, adapts exploit payloads based on live responses, and correlates findings the way a human red teamer would. That lets testing run continuously without a person manually driving every step.
Is it safe to run against production?
Vulnix0 is built for authorised, scoped testing. Scans run only against assets you define, with configurable policies ranging from passive reconnaissance up to active exploit verification.
Can I just sign up and start scanning?
No. Vulnix0 runs a live reconnaissance-to-exploitation chain against real infrastructure, so there is no open self-serve signup. Contact OneFirewall, tell us about the environment you want covered, and a scoped account is provisioned once ownership and authorisation are verified.
How is this different from an annual pentest?
A traditional pentest is a manual, point-in-time engagement that reflects your environment on one day a year. Vulnix0 runs continuously and autonomously, re-testing your attack surface as it changes.
What vulnerability classes does Vulnix0 test for?
Injection and application-logic flaws (SQL injection, XSS, SSTI, IDOR/BOLA), authentication and session weaknesses, exposed infrastructure (unauthenticated Redis, Kubernetes, VNC and similar), AI/ML attack surface (unauthenticated Ollama and MCP endpoints), DNS and TLS misconfiguration, information disclosure (exposed .env and .git files, leaked secrets), and external reputation signals from threat-intel and dark-web sources.
How do I get access?
Through OneFirewall. Use the contact form on this site and choose "Vulnix0 Access Request", or ask your OneFirewall account manager or partner. We'll review the environment with you and, if it's a fit, provision a scoped account.
Find out what an attacker would find. Today.
Access is vetted, not self-serve. Tell the OneFirewall team about your environment. If it's a fit, we'll scope it with you and bring you in.
Already provisioned? Sign in at vulnix0.com · A joint operation by OneFirewall Alliance (Velocity Lab) × AquilaX Security