syslifters.ai

syslifters.ai runs penetration tests against web applications, APIs and Android apps with autonomous AI agents. You define a project with its scope and entry points and press Start run. Agents then map the application, look for vulnerabilities, independently verify what they find and write the results into a SysReptor report.

syslifters.ai attacks the target for real

The agents are not a passive scanner. They have a full shell, send real requests, submit forms, create and modify data and log in with the accounts you provide. Treat every run like a manual penetration test by a human tester, with the same impact on the target system.

How a run works

1. Recon. Agents start from your seed URLs and map the application: pages, endpoints, parameters, roles and technologies.
2. Curate. The findings of recon are condensed into living documentation of the application, which you can read in the Knowledge tab.
3. Hunt. Specialised agents test the mapped surface category by category (for example authorization, injection and session handling). New surface found during hunting is tested as well.
4. Verify. Every suspected vulnerability is reproduced from a clean session by an independent agent. Only reproduced issues become confirmed findings.
5. Report. Confirmed findings are written into a SysReptor project, including screenshots.

You can watch every step live in the project workspace and answer approval requests while the run is in progress.

Before you start

Read these pages before your first run. They cover what you are responsible for and how to avoid unwanted impact on the target.

• A pentest, not a vulnerability scan
• Authorization
• Scope
• Data residency and data handling
• Test systems and accounts
• Safety controls

Then follow the Quickstart to run your first project.