methodology

The 22-phase engagement.

Every Xalgorix run executes these phases in order. Findings from each phase feed the next.

Reconnaissance

Manual vulnerability discovery

Directory and file discovery

CORS and cookie analysis

Authentication and session testing

Injection testing

SSRF testing

IDOR and broken access control

API and GraphQL testing

File upload testing

Deserialization and RCE

Race conditions and business logic

Subdomain takeover

Open redirect testing

Email security testing

Cloud and infrastructure

WebSocket testing

CMS-specific testing

Broken link hijacking and content spoofing

Exploit verification

Zero-day discovery

Final report