The xz-utils backdoor (CVE-2024-3094): what a network scan can and cannot detect
How the backdoor in xz-utils 5.6.0 and 5.6.1 worked, and why a network scan cannot confirm it on its own.
An automated security audit with an AI-generated report and CVSS scoring. Web, network, code and compliance audits — from €2 per scan.
From external recon to an auto-generated CVSS report: scanning tools plus an AI-written report.
Executive summary, risk ranking and remediation written by an AI model run on CAI infrastructure.
Subfinder · httpx · naabu · katana · dnsx · gau. Re-runs the audit at an interval you choose (from 1 hour) and shows what is new, fixed or reopened.
Each finding has a severity and, where available, a CVSS score, plus remediation written by AI.
PDF, Word, JSON, CSV, HTML and Markdown, in English or Romanian.
Add a target (domain, IP, range) and confirm you are authorized to test it.
Choose the type (site / network / web / code / compliance / full). Preflight checks reachability.
Scan → Findings → AI report.
PDF report · CVSS · remediation · executive summary.
1 credit = 1 EUR. Pay per scan, no account needed (Pay-as-you-go). Monthly plans are optional.
DNS, SSL, headers, CT logs, risk score.
Port scanning (naabu) + Nuclei templates.
Nuclei + sqlmap + WPScan, mapped to the OWASP Top 10.
Semgrep (where enabled) + gitleaks for secrets.
Automated GDPR / NIS2 probes mapped to controls — automated coverage, not a compliance assessment.
Site + Network + Web (+ code analysis where enabled, if you provide a repo).
1 credit = 1 EUR. Purchased credits are valid for 12 months; free ones, for 14 days.
How the backdoor in xz-utils 5.6.0 and 5.6.1 worked, and why a network scan cannot confirm it on its own.
Practical requirements of Government Emergency Ordinance (GEO) no. 155/2024. Annual audit and incident reporting. Includes a checklist for your pentest provider contract.
20 free credits with your first account, valid for 14 days. No card. You need a verified email address.