RAVEN — Verified pentest

Code

FAM-PENTEST-WEB

Status

ready — code maturity

Availability

available — whether it is offerable

Ingest

live — how a target enters

Rules of Engagement

Required (acts on a live target)

Kind

Family (a selectable assessment)

Whether a specific vulnerability is actually exploitable — demonstrated by an observed, unforgeable server-side state change, not inferred from a pattern.

RAVEN is a profile of the shared autonomous agent: it discovers the surface, forms a hypothesis about a class (say, command injection), and selects a probe ordered by information gain — but only after the tool gate authorizes it. The probe is sent against the live endpoint and the response is captured.

Each vulnerability class has a validator that confirms only on a postcondition that cannot be faked, re-derived from the actual request/response: a one-time nonce echoed by an injected command, a boundary-anchored template result absent from the baseline, an out-of-band collaborator that received a server-side request. RAVEN never authors a finding itself — a confirmed validator result becomes a promotable verifier result and the membrane decides. Anything undecided is retained as UNVERIFIABLE, never reported.

For OS command injection, a benign `echo <nonce>` whose output appears while the literal payload does not proves execution; a follow-up identity command confirms it. Reflected XSS is the one honest exception: unescaped reflection into an HTML sink is proven, but script execution is labelled inference because no browser is run.