Attack surfaces

Last updated: Aug 25, 2026


Supported

Fluid Attacks tests attack surfaces with two techniques: DAST and PTaaS. DAST is an automated scanner. PTaaS uses pentesters, and they test applications manually.

DAST

DAST tests these attack surfaces:

  • DNS records
  • Headers
  • HTML content
  • SSL connections for encryption suites, protocols, and X509 certificates
  • Unauthenticated HTTP endpoints
  • Webhooks
  • WebSockets

PTaaS

PTaaS tests every attack surface that DAST tests. Pentesters can also authenticate to applications, and they can follow API specifications such as Postman, OpenAPI, and Swagger. As a result, PTaaS also tests these attack surfaces:

  • Authenticated HTTP endpoints
  • GraphQL API
  • gRPC API
  • OpenAPIs
  • Postman APIs
  • REST API
  • SOAP APIs
  • Swagger APIs

Unsupported

DAST and PTaaS do not support DOM APIs.

On this page