Zulfiqaar runs long penetration tests on its own. When it heads the wrong way, you send it a new instruction and it changes course without losing what it has found.
For authorized testing only: in-scope bug bounty, CTFs, and penetration tests you have written permission for.
Fully autonomous tools can't be corrected once they start, and manual testing is slow. Zulfiqaar does the legwork and takes new instructions while it runs.
Email and password. No card until you choose a plan.
Domains, scope, and the program or written permission you are testing under.
A person checks the authorization before any session time starts.
The agent tests on its own, and you can redirect it whenever you want.
Recon, exploitation, access-control testing and reporting run in one loop, with one memory and one set of scope checks.
The agent reads the target, forms a hypothesis, tries it and checks the result, then repeats. It keeps going for hours, so you can leave it on a hard target and come back to findings.
Repeater, intruder, comparer and encoder over raw sockets. Send malformed requests on purpose and see exactly what the server sent back, with no library tidying it first.
GET /api/v2/invoices/10423 HTTP/1.1 Host: app.acme.test Authorization: Bearer eyJhbGciOi…acct-B Accept: application/json
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 214
{"id":10423,"owner":"acct-A","total":"1,240.00"} A real browser for flows that need one, such as logins, multi-step forms and client-side apps. The headers your program requires are added to its traffic, so every request can be traced back to your test.
X-Bug-Bounty: researcher-7f3c nmap, sqlmap, ffuf and other Kali tools are available to the agent through MCP. It picks the tool that fits each step.
Findings, credentials, network layout and dead ends are saved as the agent works, so it carries on from where it was.
Two separately provisioned identities with their own tokens, so cross-account access is proven with real requests.
Read deployed bytecode, trace calls and check on-chain state in the same session as the web application.
Attack-surface and identity recon feed straight into testing, so anything recon turns up can be checked right away.
Each session runs in its own isolated container on our servers and streams to your browser.
Say the agent is deep into access-control testing but chasing the wrong endpoint. Instead of stopping it and starting over, you send one line. It changes course and keeps everything it has learned so far.
steer instructions are applied between steps, so no action is cut off halfway.queue lines up instructions for later, and the agent works through them in order.acme-api session 7f3c · step 48
probing /v2/orders/{id} · object-level auth candidate
replayed with account B's token … 403 Forbidden
enumerating /v2/invoices/{id} …
You steer: drop invoices, stay on /v2/orders, try IDOR via order_ref
instruction applied · memory kept
GET /v2/orders?order_ref=A-10423 (owner: another tenant)
cross-account read … 200 OK · finding saved
The scope checks are built into the HTTP engine, below the agent, so the agent has no way to turn them off. Anything risky waits for you.
Read the security overviewTry it for an hour with model costs included. After that, bring your own AI model key and pay only for how long you need access. There is no usage meter.
$25 one-off
1 hour
Model costs included, up to $15
$45
$15.00 per day · 3 days
Bring your own model key
$75
$10.71 per day · 7 days
Bring your own model key
$120
$4.00 per day · 30 days
Bring your own model key
Every plan includes the full platform. See what's included and how billing works.
An in-scope bug bounty program, a CTF, or written permission from the owner of the system. You describe it when you choose a session, and an operator checks it before any session time starts.
You connect your own AI model account, so model usage is billed to you by the provider. We never meter it, which is why the access plans have no usage limits.
You get the full platform for one hour with model costs included, up to $15 of usage. The hour ending is what ends the trial, so you are not cut off part way through.
Yes. Operators can watch and record sessions to make sure testing stays within the authorization you declared. The Privacy Policy explains what is kept and for how long.
No. Each session runs in an isolated container on our servers and streams to your browser.
If an operator rejects your authorization before your session starts, you are refunded. Once a session has started it is not refundable, except where the law requires it.
Create an account, describe your target and scope, and choose a session. An operator approves your authorization before the session starts.