Pipeline Phases
GITEST has 15+ automated phases executed in sequence. GiDom (domain recon companion) adds 13 pre-exploitation phases that feed into the GITEST pipeline.
Phase Overview
GiDom: SETUP → RECON (passive) → URL DISCOVERY → DNS/PROBE → BRUTE-FORCE →
LOGIN SURFACE → LOGIN EXEC → PORT SCAN → FUZZ (unauth+auth) →
VULN SCAN (unauth+auth) → POST-AUTH DEEP SCAN → BRIDGE
GITEST: RECON → OSINT → CODE ANALYSIS → CMS/CRM → API → AUTH →
SUPPLY CHAIN → CLOUD → EXPLOITATION → POST-EXPLOITATION → REPORTING
Detailed Phases
GiDom — Domain Recon & Auth
GiDom runs before GITEST and handles the entire recon + auth pipeline:
| Phase | Description |
|---|---|
| 0. Setup + Credentials | Prompt for username/password (or skip for unauth) |
| 0B. Wordlist Download | Auto-download SecLists, AssetNote, Trickest |
| 1A. Passive Subdomain | subfinder + assetfinder + amass + chaos + crt.sh |
| 1B. URL Discovery | gau + waybackurls for historical URLs |
| 1C. DNS & Probing | dig + dnsx + pd-httpx |
| 1D. Subdomain Brute-Force | dnsx with 110K-10M wordlists |
| 1E. Login Surface Recon | Detect HTML forms, JSON APIs, basic auth |
| 1F. Login Execution | Auto-login + rules/terms acceptance |
| 2A. Port Scan | nmap top 1000 ports |
| 2B. Web Fuzzing | Dual mode: unauth + auth + diff comparison |
| 2C. Vulnerability Scan | Dual mode: nuclei unauth + auth |
| 3A. Post-Auth Deep Scan | JS re-download, API extract, config scan |
| → Bridge | Write findings JSON for GITEST import |
1. GITEST Reconnaissance
Subdomain discovery, port scanning, technology fingerprinting, and passive information gathering. Auto-imports GiDom bridge data when available.
2. OSINT
Open-source intelligence: email harvesting, data leaks, social media analysis.
3. Code Analysis
Static analysis, dependency scanning, and source code review for vulnerability discovery.
4. CMS/CRM
Framework detection and exploitation for CMS (WordPress, Joomla, Laravel) and CRM (Odoo, Salesforce).
5. API Security
REST and GraphQL API testing, including authentication bypass, injection, and rate limiting.
6. Authentication
Login bypass, session hijacking, JWT attacks, OAuth misconfiguration.
7. Supply Chain
Dependency analysis, malicious package detection, and third-party integration testing.
8. Cloud
AWS, GCP, Azure misconfiguration scanning with tools like ScoutSuite and Prowler.
9. Exploitation
Controlled vulnerability verification with CVSS scoring.
10. Post-Exploitation
Lateral movement, privilege escalation, persistence mechanism detection.
11. Reporting
Comprehensive markdown report generation with CVSS v3.1 scores.