--- title: "Automation vs. Manual Testing · VORNAC Research" description: "Where automation earns its keep, where it misses by design, and the seams where a human reviewer must take over — paired against the manual techniques that resist tooling." url: https://www.vornac.com/en/research/offensive-tradecraft/automation-vs-manual lang: en published: 2026-06-02 updated: 2026-06-02 alternate_de: https://www.vornac.com/research/offensive-tradecraft/automation-vs-manual --- [Research Index](https://www.vornac.com/en/research) / [1 · Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) / Automation vs. Manual Testing Reference · [1 Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) # Automation vs. Manual Testing. Where automation earns its keep, where it misses by design, and the seams where a human reviewer must take over — paired against the manual techniques that resist tooling. ## Where automation earns its keep - **Directory + parameter fuzzing.** `ffuf` against a quality wordlist surfaces 80% of forgotten endpoints in minutes. Humans cannot beat this volumetrically. - **Reflected XSS in clearly tainted params.** `Dalfox` or Burp Active Scan finds the obvious sinks. Tag-and-attribute reflection patterns are well-covered. - **Classic SQLi in URL/POST params.** `sqlmap` against a parameter that the developer didn't bind correctly. Time-based and union-based both well-handled. - **Known-CVE checks.** `nuclei` against a fingerprinted stack. Templates encode the exact request shape; minimal tester time per finding. - **Response-shape diffing.** Send 50 payloads, compare response sizes/codes/headers, sort by deviation. Surfaces inconsistencies a human eye would miss. - **TLS posture checks.** `testssl.sh`, `sslyze`. Mechanical and complete. ## Where automation goes silent - **Business logic.** The attack is a legitimate sequence of legitimate calls — discount stacking, race-condition double-spend, multi-step authorization checks. No fuzzer reconstructs intent. - **Authorization across pages and roles.** User A creates resource, User B retrieves via guessed ID. Scanner runs as User A only and never sees the gap. - **Stored XSS where source and sink are decoupled.** Attacker submits form A, payload renders on admin dashboard B. Dynamic scanner never crosses the surface boundary. - **Authentication-state coupling.** Action requires state X set by prior action Y. Scanner replays in isolation and gets a 400 instead of the vulnerable path. - **Logic-based IDOR.** ID is a UUID, not enumerable. Manual analysis needed to recognize that the UUID is exposed in a sibling endpoint's response. - **Authentication bypass via parser confusion.** Trailing newline, unicode normalization, JSON parsing differences between auth layer and app layer. Requires hypothesis-driven testing. ## Allocation rule - **Day 1.** Run all automation in parallel while you walk the application manually. Both inputs feed day 2. - **Day 2–N.** Manual testing on the surfaces automation can't reach. Use automation output as a triage map, not as findings. - **Last day.** Re-run automation against any changes the team made during testing. Confirms regressions in real time, before the report. **Rule of thumb**If 80% of the findings in a report came from automated scanner output, the engagement underdelivered. The unique value of a human tester is exactly the findings automation cannot reach. Bill accordingly. Domain [1 · Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) Tier Reference Engagement phases ReconDirectory FuzzingXSSSQL InjectionBusiness Logic Published 2 June 2026 Looking up an acronym? [Open the Glossary](https://www.vornac.com/en/glossary) ## Related notes in this domain - [Featured Comprehensive Pentest Reference](https://www.vornac.com/en/research/offensive-tradecraft/comprehensive-pentest-reference) - [Featured Pentest Methodology — Canonical Reference](https://www.vornac.com/en/research/offensive-tradecraft/pentest-methodology-canon) - [Featured Advanced Penetration Testing & Red Team](https://www.vornac.com/en/research/offensive-tradecraft/advanced-pentest-and-redteam) - [Featured Recon & Discovery](https://www.vornac.com/en/research/offensive-tradecraft/recon-and-discovery) - [Featured Web Server — Attack & Defense](https://www.vornac.com/en/research/offensive-tradecraft/web-server-attack-defense) - [Featured Active Directory Pentest](https://www.vornac.com/en/research/offensive-tradecraft/active-directory-pentest) - [Featured Internal Pivoting & Lateral Movement](https://www.vornac.com/en/research/offensive-tradecraft/internal-pivoting) - [Reference Recon Tooling — Operator Reference](https://www.vornac.com/en/research/offensive-tradecraft/recon-tooling) - [Reference Operator Toolkits — Catalog & Reference](https://www.vornac.com/en/research/offensive-tradecraft/operator-toolkits) - [Background Social Engineering & Phishing](https://www.vornac.com/en/research/offensive-tradecraft/social-engineering-phishing) - [Background Pentester Foundations & CTF Practice](https://www.vornac.com/en/research/offensive-tradecraft/pentester-foundations) [Previous note Operator Toolkits — Catalog & Reference](https://www.vornac.com/en/research/offensive-tradecraft/operator-toolkits) [Back to domain](https://www.vornac.com/en/research/offensive-tradecraft) [Next note Social Engineering & Phishing](https://www.vornac.com/en/research/offensive-tradecraft/social-engineering-phishing) From reference to evidence ## Run this against your own environment.