Noctrodex DAST

High-precision Dynamic Application Security Testing — live attack surface mapping, authenticated fuzzing, and runtime exploit detection on infrastructure you isolate and control.

// What it is

Noctrodex DAST tests a running application the way an attacker would — probing the live surface, exercising authenticated paths, and confirming exploitability at runtime. It runs local-first against targets you own, so sensitive assessments stay inside your perimeter: no third-party scanning cloud, no per-query metering, no phone-home.

// Key capabilities

• Live attack surface mapping — discovers reachable endpoints, parameters, and flows against the running target.
• Authenticated fuzzing — drives probes through logged-in sessions so it reaches the surface unauthenticated scanners miss.
• Runtime exploit detection — confirms issues by observing real behaviour, cutting the false positives static-only tools leave behind.
• Scoped & safe by default — rate limits, scope controls, and destructive actions off unless you deliberately enable them.
• War Room GUI + CLI — an operator War Room for interactive scans and review, plus a scriptable CLI for pipelines.

// How it runs

The product installs from npm — npm install -g @noctrodex/dast — which brings down the readable War Room interface plus a compiled engine binary for your platform. Run noctrodex-dast and a browser opens to approve the device. Point it at a target you own; results stream into the War Room live. The engine runs on your machine, so probe traffic reaches the target from your IP address and never through us. The optional Helix σ model — explanation, payload reasoning, anomaly surfacing — is a separate on-device download tied to your account.

// Hardware and the GPU budget

The engine is built to run on ordinary 16 GB hardware, CPU-only, with no GPU at all. Where a GPU is present, the optional Helix σ model can offload part of its work to it — and it takes a deliberately small, fixed slice: 3 GB of video memory. The remaining layers stay on the CPU.

The budget is a hard ceiling rather than a guess. NOCTRODEX does not read your free VRAM and take what it finds; it asks for 3 GB and fits as many model layers as actually fit in that. This matters because customers run very different machines:

• Any driver. NVIDIA, AMD, Intel or a plain Vulkan driver all behave the same way, because the allocation is a number we set, not something inferred from a vendor tool.
• Shared and unified memory. On laptops and Apple-style unified memory, "free VRAM" is really system RAM. A fixed budget cannot over-commit it.
• Two GPUs. Machines with an integrated and a discrete card are common; you choose which one is used rather than getting whichever the driver enumerates first.
• No GPU, or an unusable one. If there is no GPU, no driver, or the runtime was built without GPU support, the model runs entirely on the CPU. Nothing fails and no scan is lost — it is simply slower.

Raise or lower the slice per machine with NOCTRODEX_DAST_GPU_BUDGET_MIB (in MiB), or pick the card with NOCTRODEX_DAST_GPU_INDEX. Set the budget to 0 to let the engine size itself from detected free VRAM instead.

// Licensing

Noctrodex DAST is a commercial release under account-based licensing: create an account, buy a licence, and activate it by approving a short code in your browser. Your licence runs on as many machines as you own — approve each one in the browser — for as long as your account is active. Choose a monthly or yearly term.