Safety and Impact¶

This reference page explains how NodeZero manages destructive behavior, runtime controls, and operational impact during WebApp testing.

Destructive Action Handling¶

Potentially destructive actions are governed by route rules, scope, intensity, and the accepted testing use case before launch. NodeZero is designed to favor bounded test artifacts – such as test posts, bogus data, or stored-payload validation – over uncontrolled destructive actions against customer data.

Mid-Run Stop Controls¶

A running WebApp test can be stopped from its Real-Time View, using the stop control available for NodeZero pentests.

Expected Logs and Traffic Patterns¶

WebApp testing typically runs in two broad phases. The first emphasizes enumeration and route discovery and may resemble accelerated application traffic. The second emphasizes attack execution and may produce repeated requests to the same URLs and parameters with varied payloads. The attack phase can trigger SOC alerts, WAF rules, or rate limits.

Traffic Allowlisting¶

External applications can be allowlisted by retrieving NodeZero's testing source IP before launch and adding that address or range to the appropriate WAF (Web Application Firelog) or perimeter allowlist. Allowlisting is recommended when the goal is to test underlying application behavior rather than measure whether perimeter controls block commodity payloads.