--- description: "Request reattacks on the Fluid Attacks platform to test the success of fixes addressing vulnerabilities. Understand reattack outcomes and troubleshoot errors." keywords: "reattack, request reattack, vulnerabilities, reattack error message, retest, Fluid Attacks platform, Fluid Attacks documentation" other: private: false title: Verify fixes with reattacks --- # Verify fixes with reattacks import { Image } from "@/components/image"; ## Request a reattack > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User, Vulnerability Manager or Group Manager > [!TIP] > > **Note:** Before requesting a reattack, make sure you have [synced](https://help.fluidattacks.com/portal/en/kb/articles/manage-repositories#Know_your_Git_repositories_table) the fixed software version to the platform. When you have fixed your code or service configuration to address a reported vulnerability, you can request a reattack to validate the effectiveness of your effort. Reattacks are retests performed by Fluid Attacks' tool and pentesters (the latter are available exclusively in the [Advanced plan](https://help.fluidattacks.com/portal/en/kb/articles/continuous-hacking-free-trial-plans-and-pricing#Continuous_Hacking_plans)). Reattack requests can be sent from Fluid Attacks' platform in the [Vulnerabilities](https://help.fluidattacks.com/portal/en/kb/articles/see-where-vulnerabilities-are-and-more-details#See_where_vulnerabilities_are_located) and [To do](https://help.fluidattacks.com/portal/en/kb/articles/see-vulnerabilities-assigned-to-you) sections. But you can also send them from [VS Code](https://help.fluidattacks.com/portal/en/kb/articles/view-vulnerable-lines-use-fix-options-and-more#Request_reattacks) thanks to Fluid Attacks' integration. This page is dedicated to sending reattack requests from the platform. These are the steps to do it from Vulnerabilities: 1. Go to the intended [group](https://help.fluidattacks.com/portal/en/kb/articles/platform-faq#What_is_a_group)'s [**Vulnerabilities**](https://help.fluidattacks.com/portal/en/kb/articles/see-where-vulnerabilities-are-and-more-details#See_the_list_of_vulnerabilities_detected) section and click on the weakness name. Select type of vulnerability to reattack on the Fluid Attacks platform

Select type of vulnerability to reattack on the Fluid Attacks platform

1. Select the vulnerability to be verified by the reattack. Only entries with the 'Vulnerable' status and whose reattack status is neither 'Requested' nor '[On hold](https://help.fluidattacks.com/portal/en/kb/articles/verify-fixes-with-reattacks#Reattacks_on_hold)' are eligible. Then click on the **Reattack** button.

Select vulnerability to reattack on the Fluid Attacks platform

> [!TIP] > > You may select multiple vulnerabilities and then click **Reattack**. If the reattack is not possible for some vulnerabilities, the reason is displayed in the next pop-up window. 1. In the pop-up window, provide a detailed description (minimum 10 characters) of the fix you implemented to address the vulnerability (if applies). Request reattacks on the Fluid Attacks platform

Request reattacks on the Fluid Attacks platform

> [!TIP] > > If the reattack is to be performed by Fluid Attacks' tool, you do not need to provide a justification but rather only make sure that the fixed version is synced to the platform. Read more about [reattacks by the tool](https://help.fluidattacks.com/portal/en/kb/articles/verify-fixes-with-reattacks#Reattacks_for_vulnerabilities_detected_by_the_automated_tool) below. 1. Click **Confirm**. The Reattack column for that vulnerability then displays the value 'Requested'. View reattack status on the Fluid Attacks platform

View reattack status on the Fluid Attacks platform

To request reattacks from the To do section, follow these steps: 1. Go to the **To do** section. Find the To do section on the Fluid Attacks platform

1. In **Assigned vulnerabilities**, select the vulnerability by its check box and click on **Reattack**. Reattack from To do on the Fluid Attacks platform

1. Provide a justification (minimum 10 characters) in the pop-up window (if applies) and click **Confirm**. After requesting the reattack you need to wait for the tool or pentesters to inform you of the outcome. If performed by the tool, the reattack may take several minutes. If performed by security analysts, the response time adheres to the conditions specified in the [service-level agreement](https://help.fluidattacks.com/portal/en/kb/articles/response-sla), i.e., a median of 16 office hours. Moreover, a new comment related to your request appears in the type of vulnerability's **Comments** section. If applicable, [a further comment](https://help.fluidattacks.com/portal/en/kb/articles/verify-fixes-with-reattacks#Reattacks_for_vulnerabilities_detected_by_the_automated_tool) appears shortly after, where Fluid Attacks' tool informs you of the reattack outcome. If security analysts are involved, they may add detailed comments along with the reattack outcome information. View reattack status in Comments on the Fluid Attacks platform

View reattack status in Comments on the Fluid Attacks platform

## Reattack outcomes On the platform, there are two possible reattack outcomes which are informed in the Reattack column of the [Vulnerabilities table](https://help.fluidattacks.com/portal/en/kb/articles/see-where-vulnerabilities-are-and-more-details#See_where_vulnerabilities_are_located). 1. **Verified (vulnerable):** The vulnerability is still exploitable. Fluid Attacks' tool or pentesters provide evidence of the exploit, accessible in the [Evidence section](https://help.fluidattacks.com/portal/en/kb/articles/examine-the-evidence-of-exploitability). You should attempt remediation again and then request another reattack. 1. **Verified (safe):** The vulnerability has been successfully remediated. Reattack outcomes are recorded in the type of vulnerability's [Tracking](https://help.fluidattacks.com/portal/en/kb/articles/see-where-vulnerabilities-are-and-more-details#See_the_timeline_of_a_type_of_vulnerability) and [Comments](https://help.fluidattacks.com/portal/en/kb/articles/see-where-vulnerabilities-are-and-more-details#Comment_on_a_type_of_vulnerability) sections. ## Reattacks on hold Reattacks might be temporarily delayed due to situations from your side, which Fluid Attacks calls "events." To learn more about them, read [Resolve events impeding tests](https://help.fluidattacks.com/portal/en/kb/articles/resolve-events-impeding-tests). Delayed reattacks are shown in the Vulnerabilities table with the value 'On hold'. View reattacks on hold on the Fluid Attacks platform

View reattacks on hold on the Fluid Attacks platform

Once the events are resolved, the reattack request is automatically reactivated. ## Reattacks for vulnerabilities detected by the automated tool Bear in mind the following regarding reattacks for vulnerabilities detected by the automated tool: 1. No detailed justification is needed in your request as the tool does not take it into account. You are shown the following message instead. Reattack a vulnerability found by the Fluid Attacks scanner

Reattack a vulnerability found by the Fluid Attacks scanner

1. If you suspect a false positive or determine the finding poses no risk due to other security measures, [contact Fluid Attacks](https://help.fluidattacks.com/portal/en/kb/articles/send-fluid-attacks-an-email) or [request the zero risk treatment](https://help.fluidattacks.com/portal/en/kb/articles/request-a-vulnerability-be-dismissed-as-zero-risk), respectively, instead of a reattack. 1. The posts in Comments sections are simple messages mentioning vulnerabilities present and remediated resulting from the reattack. 1. If you have trouble remedying the vulnerability, consult the [vulnerability](https://db.fluidattacks.com/wek/) and [fixes](https://db.fluidattacks.com/fix/) documentation for code examples or use the [Fluid Attacks features that leverage generative artificial intelligence](https://help.fluidattacks.com/portal/en/kb/find-security-vulnerabilities/fix-code-with-gen-ai) to have an idea of how to proceed. ## Reattack a permanently accepted vulnerability > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User, Vulnerability Manager or User Manager Despite having accepted a vulnerability permanently on Fluid Attacks' platform, you can request a reattack if you determine you have remediated it. The steps to request a reattack for a permanently accepted vulnerability are no different from those [described above](https://help.fluidattacks.com/portal/en/kb/articles/verify-fixes-with-reattacks#Request_a_reattack). After sending the request, the column Reattack shows the value 'Requested'. Reattack an accepted vulnerability on the Fluid Attacks platform

Reattack an accepted vulnerability on the Fluid Attacks platform

## Error when requesting reattacks ### Add new changes to your repository before requesting a new reattack The platform prevents a reattack request if 1. the latest cloned version (last commit) of the repository associated with the vulnerability you are attempting to reattack is more than 1 day old, 1. the vulnerability is still present in that last commit (or even in a previous commit). In such cases, the error message prompts you to update the repository before requesting the reattack. These are the recommended steps when encountering this error: 1. Check the current version of the repository (in your remote version control system or remote container where the repository is hosted) and ensure the latest commit is recent and includes the fix. 1. Update the branch under evaluation (i.e., the one [registered in the Scope section](https://help.fluidattacks.com/portal/en/kb/articles/manage-roots#Add_a_new_Git_Root_manually)) to include the current version of the repository. 1. Return to the platform and [request the reattack](https://help.fluidattacks.com/portal/en/kb/articles/verify-fixes-with-reattacks#Request_a_reattack) again. 1. If necessary, manually update the repository in Scope and request the reattack once its Status is OK. > [!TIP] > > **Notes:** > > 1. Repeat these steps for each repository associated with multiple vulnerabilities you wish to reattack. > 2. Contact [help@fluidattacks.com](mailto:help@fluidattacks.com) if you face issues with the above steps or if you believe a repository update is not required. ### You had already requested that reattack If the reattack for the vulnerability has already been requested by you or your team and Fluid Attacks' response is pending, the platform does not let you request it again. You can identify vulnerabilities for which this applies by looking for the 'Requested' value in the Reattack column. ### You selected a vulnerability already marked as Safe If the vulnerability is marked as 'Safe' in the Status column, that means it is no longer present in your system, therefore, it is no use to reattack that past detection. ### You selected a vulnerability whose reattack is On hold As [explained above](https://help.fluidattacks.com/portal/en/kb/articles/verify-fixes-with-reattacks#Reattacks_on_hold), the reattack for a vulnerability might be delayed due to some situation you must resolve first (fully explained in the [**Events** section](https://help.fluidattacks.com/portal/en/kb/articles/resolve-events-impeding-tests)). The platform does not let you retry a reattack until after said delayed reattack has been effectuated and has found the vulnerability to be present still. ### Your current subscription does not include reattacks for the selected vulnerability Having downgraded to the Essential plan, you cannot request reattacks for vulnerabilities detected with penetration testing as a service, secure code review and reverse engineering (marked 'PTAAS', 'SCR' and 'RE' in the Technique column, respectively). You must upgrade back to the Advanced plan to request those reattacks. > [!TIP] > > **Free trial**Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your [21-day free trial](https://app.fluidattacks.com/SignUp) and discover the benefits of the [Continuous Hacking](https://fluidattacks.com/services/continuous-hacking/) [Essential plan](https://fluidattacks.com/plans/). If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out [this contact form](https://fluidattacks.com/contact-us/).