> ## Documentation Index
> Fetch the complete documentation index at: https://docs.snapsec.co/llms.txt
> Use this file to discover all available pages before exploring further.

# How AI Pentesting Works

> The underlying architecture combining Large Language Model reasoning with offensive security toolchains.

Unlike static vulnerability scanners that match fixed regex signatures, Snapsec AI Pentesting behaves like a human penetration tester: it forms hypotheses, investigates application logic, and chains multiple minor flaws into high-impact exploits.

***

## The Reasoning Loop

```mermaid theme={null}
flowchart TD
    Recon["Phase 1: Surface Exploration & Recon
(Endpoints, Parameters, Role Tokens)"] --> Hypo["Phase 2: Hypothesis Generation
('Endpoint /api/users/102 may lack authorization check')"]
    Hypo --> Test["Phase 3: Targeted Probe & Payload Dispatch"]
    Test --> Analyze{"Phase 4: Response Analysis
Did server return unauthorized data or execute code?"}
    Analyze -->|No| Refine["Refine Hypothesis with Alternative Encoding / Auth Context"]
    Refine --> Test
    Analyze -->|Yes| Chain["Phase 5: Exploit Chaining & Privilege Escalation"]
    Chain --> Evidence["Phase 6: Capture Proof-of-Concept Evidence"]
```

***

## Key Cognitive Capabilities

1. **Context-Aware Authentication**: Understands multi-role systems (e.g., test as `User A` to see if `User B`'s records can be accessed via BOLA/IDOR).
2. **Stateful Multi-Step Workflows**: Completes checkout wizards, shopping carts, and multi-factor setup flows to reach deep business logic.
3. **Exploit Chaining**: Uses an SSRF to reach internal cloud metadata, extracts temporary IAM credentials, and accesses private S3 buckets.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.