Ragnarok · AppSec
Application Security
Ragnarok runs DAST, API fuzzing, and auth-layer testing against every endpoint in your application — automatically — and generates fix PRs for confirmed vulnerabilities before your next release ships.
How Ragnarok Tests Applications
Ragnarok's AppSec module treats your application the way a real attacker does — probing endpoints, fuzzing inputs, testing authentication flows, and chaining vulnerabilities to demonstrate real-world exploit paths. Unlike traditional DAST tools that generate noise, Ragnarok validates exploitability before raising a finding.
Every API endpoint in your application is tested on each scan — not a sampled subset. Ragnarok discovers new endpoints dynamically as it crawls, so surface area added in a sprint is tested in the same cycle.
DAST and API Fuzzing
- Full endpoint coverage: Ragnarok tests every API endpoint discovered during the scan — REST, GraphQL, and legacy XML-RPC — with no manual scope configuration required.
- Input fuzzing: Boundary conditions, injection payloads (SQLi, XSS, XXE, SSTI), and malformed inputs tested across all parameters and headers.
- Business logic testing: Ragnarok tests for IDOR, mass assignment, and broken object-level authorization — vulnerabilities that scanners miss entirely.
Auth Layer Testing — JWT, OAuth, SAML
- JWT attack coverage: Algorithm confusion (RS256 → HS256), none algorithm bypass, weak secret brute-force, and kid injection tested automatically.
- OAuth flow testing: Open redirect abuse, PKCE bypass, token leakage via referrer, and state parameter fixation covered in every scan.
- SAML assertion testing: XML signature wrapping, external entity injection, and assertion replay attacks — all validated by Ragnarok's auth-specialised agent.
Auto-Generated Fix PRs
- Remediation on discovery: For confirmed vulnerabilities with a deterministic fix, Ragnarok opens a pull request against your repository with the corrected code diff.
- Context-aware patches: PRs include the vulnerable code path, the attack proof-of-concept, the fix rationale, and test cases to verify the remediation.
- Developer workflow integration: PRs are created in your existing GitHub, GitLab, or Bitbucket workflow — no new tools for developers to learn.
Shift Left Without the Friction
Ragnarok integrates into your CI/CD pipeline as a scan gate. It runs against staging before every production deployment, blocking releases that introduce new high-severity findings. The gate is configurable — you set the severity threshold and Ragnarok enforces it automatically.
