Is this legal? Do I need permission?

AttackVector performs passive security scanning only — we analyze publicly available information like HTTP headers, SSL certificates, and technology fingerprints. We do NOT perform active exploitation. However, you should only scan websites you own or have explicit authorization to test.

How does AttackVector compare to traditional pentesting?

Traditional penetration tests cost $5,000–$50,000+ and take weeks. AttackVector provides instant AI-powered scanning starting at $79/mo. While it doesn't replace a full manual pentest for compliance purposes, it catches 80% of common vulnerabilities at 1% of the cost.

What does the free tier include?

The free scan includes SSL/TLS certificate analysis, HTTP security headers audit, technology stack detection, your top 3 vulnerabilities, and an overall security grade (A-F). Upgrade to Pro to unlock all vulnerabilities, CVE matching, and AI remediation guides.

How do the AI agents work?

AttackVector uses a pipeline of specialized AI agents: Recon Agent discovers endpoints, Fingerprint Agent detects your tech stack, Scanner Agent checks for misconfigurations, CVE Matcher cross-references the NVD database, and Report Writer generates human-readable findings with fix instructions.

How often should I scan my site?

We recommend scanning after every deployment and at least weekly. Pro subscribers get continuous monitoring with weekly automatic re-scans. New CVEs are published daily, so regular scanning is essential.

Can AttackVector scan internal/private networks?

No. For security reasons, AttackVector only scans publicly accessible URLs. We block requests to private IP ranges (localhost, 10.x.x.x, 192.168.x.x, etc.).

What is automated penetration testing?

Automated penetration testing uses AI and software tools to simulate cyberattacks on your systems, identifying vulnerabilities without requiring a human security consultant. AttackVector automates recon, fingerprinting, vulnerability scanning, CVE matching, and report generation — delivering results in seconds instead of weeks.

How much does a penetration test cost?

Traditional manual penetration tests cost between $5,000 and $50,000+ per engagement. AttackVector provides AI-powered pentesting starting with a free tier, with Pro plans at $79/mo and Premium at $199/mo — making enterprise-grade security accessible to startups and small businesses.

What vulnerabilities does AttackVector detect?

AttackVector detects OWASP Top 10 vulnerabilities including SQL injection, cross-site scripting (XSS), CSRF, broken authentication, security misconfigurations, sensitive data exposure, and more. Pro and Premium plans add CVE matching against the National Vulnerability Database, DNS security auditing, API security testing, and frontend pentesting.

Is AI pentesting as good as manual penetration testing?

AI pentesting catches 80% of common vulnerabilities instantly and is ideal for continuous monitoring. Manual pentesting is still recommended for compliance audits (PCI DSS, SOC 2) and testing complex business logic. AttackVector is best used as a complement — providing continuous coverage between annual manual pentests.

What is a CVE and how does CVE scanning work?

CVE (Common Vulnerabilities and Exposures) is a standardized system for identifying known security vulnerabilities. AttackVector detects your technology stack (frameworks, libraries, servers) and cross-references them against the National Vulnerability Database (NVD) with 50,000+ CVE entries to find known exploits affecting your software versions.

How do I check if my website is secure?

Enter your website URL at attackvector.tech/scan to get a free instant security assessment. You'll receive a security grade (A-F), SSL/TLS analysis, HTTP security headers audit, technology detection, and your top vulnerabilities — all in seconds with no signup required.

What is OWASP Top 10 and why does it matter?

The OWASP Top 10 is the industry standard list of the most critical web application security risks, published by the Open Worldwide Application Security Project. It includes injection attacks, broken authentication, sensitive data exposure, XML external entities, broken access control, security misconfigurations, XSS, insecure deserialization, using components with known vulnerabilities, and insufficient logging. AttackVector scans for all 10 categories.

Does AttackVector test APIs for vulnerabilities?

Yes. Pro and Premium plans include API discovery and API security testing. AttackVector automatically discovers API endpoints, then tests for SQL injection, command injection, authentication bypass, IDOR, rate limiting issues, CORS misconfigurations, and mass assignment vulnerabilities in your APIs.

What is a DNS security audit?

A DNS security audit examines your domain's DNS configuration for security issues including missing SPF, DKIM, and DMARC records (email spoofing protection), DNSSEC validation, zone transfer vulnerabilities, dangling DNS records, and subdomain takeover risks. AttackVector includes comprehensive DNS auditing in Pro and Premium plans.

How does AI-powered vulnerability scanning work?

AttackVector deploys multiple specialized AI agents in parallel: a Recon Agent maps your attack surface, a Fingerprint Agent identifies your technology stack, a Scanner Agent tests for misconfigurations and vulnerabilities, a CVE Matcher finds known exploits in your software, and a Report Agent generates human-readable findings with step-by-step remediation guides.

The Most Exploited CVEs of the Last Decade — And Why They Still Work

The Exploits That Don't Retire

A single line of code in a logging library nearly brought the internet to its knees. That's Log4Shell (CVE-2021-44228). When it emerged in December 2021, chaos ensued. Companies raced to patch systems while attackers seized the opportunity. The vulnerability allowed remote code execution via a simple payload. Why does it still matter? Many systems remain unpatched. Even today, AttackVector identifies Log4Shell vulnerabilities in nearly 15% of its scans.

EternalBlue: The Gift That Keeps Giving

EternalBlue (CVE-2017-0144) powered the infamous WannaCry and NotPetya ransomware attacks. It exploits a bug in Microsoft's SMB protocol, allowing attackers to execute arbitrary code. Despite patches available since 2017, unpatched systems continue to suffer. WannaCry alone affected over 200,000 computers across 150 countries in days. Why? Organizations skipped updates. EternalBlue exemplifies why ignoring patch management is perilous.

Heartbleed: A Simple Mistake with Massive Impact

Heartbleed (CVE-2014-0160) taught us about trust. A missing bounds check in OpenSSL's heartbeat extension exposed millions of secrets. Attackers could read up to 64KB of memory with each heartbeat. Major sites like Yahoo! experienced data breaches within hours of disclosure. Yet, many organizations delayed patching, leaving systems vulnerable for years.

Equifax and Apache Struts: A Cautionary Tale

The Equifax breach, caused by CVE-2017-5638 in Apache Struts, allowed remote code execution through improperly handled headers. Equifax ignored this known issue, exposing 147 million records. The breach cost over $1.4 billion in settlements and fines. Equifax illustrates the catastrophic consequences of neglecting known vulnerabilities.

ProxyShell and ProxyLogon: The Exchange Server Nightmare

In 2021, ProxyShell (CVE-2021-26855) and ProxyLogon attacks exploited Microsoft Exchange servers. They allowed attackers to chain vulnerabilities for complete system compromise. Organizations worldwide were caught off guard. Despite awareness campaigns and patches, many servers remain vulnerable. AttackVector frequently flags these during scans, underscoring the need for proactive defense.

MOVEit and the Cl0p Ransomware Campaign

In 2023, the MOVEit SQL injection (CVE-2023-34362) fueled the Cl0p ransomware campaign. Attackers exploited a flaw in the MOVEit Transfer tool to exfiltrate data. The SQL injection allowed attackers to manipulate database queries, leading to severe breaches. Many victims delayed critical updates, mistakenly believing their systems were secure.

Shellshock: The Oldie But Goodie

Shellshock (CVE-2014-6271), the 25-year-old Bash bug, allowed remote attackers to execute commands through crafted environment variables. Despite its age, Shellshock still lurks in unpatched systems. AttackVector's scans reveal about 10% of legacy systems are vulnerable, making it a persistent threat.

Staying Ahead of the Game

How do we stop these nightmares? Patch regularly. It's essential. Scan your systems continuously. Use tools like AttackVector to identify and prioritize vulnerabilities. Map your attack surface—monitor changes diligently. Test for vulnerabilities using tools like nmap and nuclei. Finally, educate your team. Awareness is your first line of defense.

AttackVector helps you track CVEs against your tech stack, ensuring you're not caught off guard. Let's keep those windows shut for good.