# AI Pen Testing — Security Assessment Report

> AI-powered penetration testing for websites and apps. Get a full vulnerability report with CVSS scores, proof-of-concept exploits, and step-by-step remediation.

Canonical: https://www.aimakers.co/ai-pen-testing/
Last updated: 2026-09-24

## Find the holes before they do.

AI Pen Testing

I test your site the way a real attacker would, then hand you the report.

WordPress fingerprint & version detection

User enumeration (REST API, author, login)

XML-RPC brute force testing

Security headers & SSL/TLS audit

Sensitive file exposure (.git, .env, backups)

CVSS-scored report + free retest

Fixed price per engagement, quoted after a short scoping chat with me. Send me the URL — I'll come back with the scope and a timeline.

9 vulnerabilities found
2 critical · 3 high

Real findings

## Real holes, from real assessments.

### Admin password cracked

XML-RPC multicall allows 1,000 password attempts per request. Admin password found in 23 seconds.

### Source code exposed

.git repository publicly accessible. Full source, config files and commit history downloadable.

### Database credentials leaked

Backup wp-config.php~ contains database host, username and password in plain text.

### User data enumeration

REST API exposes every username and ID at /wp-json/wp/v2/users — no authentication required.

### Clickjacking vulnerable

No X-Frame-Options or CSP frame-ancestors. The site can be embedded in a malicious iframe.

### Outdated software

Theme carries 3 known CVEs. WordPress and 4 plugins behind on security patches.

How it works

## From your URL to a report you can act on.

### You send me the URL

Tell me what to scan. I agree the scope with you, plus anything to leave alone. Ten minutes.

### AI scans everything

Reconnaissance, user enumeration, brute force testing, header analysis and file exposure checks.

### I validate every finding

Each vulnerability verified by hand with a working proof-of-concept. No false positives.

### You get the report

Executive summary, CVSS scores and the exact steps to fix every issue. Free retest after.

### You don't know what you don't know.

43% of cyberattacks target small businesses. Most find out too late.

FAQ

## Questions you're probably asking.

### What do you actually test?

Everything a real attacker would try. WordPress fingerprinting, user enumeration, XML-RPC brute force, security headers, sensitive file exposure, clickjacking, SSL/TLS configuration and REST API data leaks. The same tools attackers use — I just work for you.

### Will this break my site?

No. Non-destructive scans, controlled brute force with agreed limits, and I confirm scope before I start. You get a full report, not a broken website.

### How long does it take?

Most reports land within 3-5 business days. The scan runs in hours — the rest is analysis, validation and writing fix steps you can follow.

### What do I get in the report?

An executive summary, every vulnerability with a CVSS severity rating, proof-of-concept for each one, and step-by-step fix instructions. Plus a free retest after you apply them.

### Is this just an automated scan?

No. The AI finds vulnerabilities fast, then I review every finding by hand, drop the false positives and write remediation you can actually act on.

Learn more

[AI Pen Testing: Find Vulnerabilities 80x FasterGuide](https://www.aimakers.co/blog/ai-penetration-testing/) · [Custom AI DevelopmentService](https://www.aimakers.co/custom-ai/) · [AI Agents & ChatbotsService](https://www.aimakers.co/ai-assistants/) · [My WorkPortfolio](https://www.aimakers.co/work/)

AI Security

## Ready to find your blind spots? Let's test it.

Send me your URL. I'll come back with everything an attacker would find.

I reply within 24 hours

A short scoping chat with me

A fixed price, quoted in writing

[mark@aimakers.co](mailto:mark@aimakers.co)

### Send me a message

I reply within 24 hours.