Real Vulnerabilities
Found by AI Agents
Every finding below was discovered autonomously by Strobes AI agents during authorized security assessments. Click any card to see the full agent trace with thinking steps, tool calls, and the chain of reasoning that led to discovery.
The GraphQL Heist: Parameter Pollution Meets CSRF Bypass
AI agent discovered URL query parameters silently override JSON body in GraphQL requests on a Rails-backed fintech platform, then chained it with a CSRF token bypass via URL authenticity_token to achieve full unauthenticated mutation injection.
KYC Bypass Chain: Zero-Field Entity Passes Verification
Agent systematically tested all API endpoints without authentication and discovered multiple endpoints that process requests without any auth checks.
SQL Injection via AES Encryption WAF Bypass
Agent analyzed a prior security report to learn SQLi patterns, then used the discovered AES encryption key to encrypt payloads that bypass the WAF, achieving blind SQL injection.
Path Traversal + Config Overwrite = Platform DoS
Agent discovered an unsanitized FileName parameter in a bulk import endpoint. By crafting a path traversal payload, it overwrote the IIS configuration file, causing a full platform outage.
IDOR Chain to Full Account Impersonation
During workspace setup and initial recon, the agent mapped the full API surface of a payment gateway, discovering critical authentication weaknesses including SID non-validation and IDOR chains.
SSRF Webhook Chain: Financial Data Exfiltration
Agent tested file upload and webhook functionality, discovering that malicious file types are accepted and webhook URLs can be pointed to attacker-controlled servers for data exfiltration.
Auth Bypass via Content-Type Manipulation
Agent discovered that card PIN reset, wallet transfer, and IP whitelist management endpoints all bypass authentication when requests use form-encoded body instead of JSON.
JWT Zero-Validation to SuperAdmin Impersonation
While testing for XSS, the agent discovered zero JWT signature validation - accepting alg:none, empty signatures, and forged tokens. It escalated to SuperAdmin impersonation and cross-tenant data access.
Unauthenticated Token Refresh Grants Full API Access
Agent discovered that an empty POST to the /refresh endpoint returns a valid JWE access token without any authentication. This token is accepted by all 45 protected API endpoints.
ASPX Web Shell Upload Accepted on Fintech Platform
Agent tested for remote code execution by uploading ASPX web shells, PHP scripts, and polyglot files. Multiple upload endpoints accepted all file types without validation.
Stored XSS via Angular bypassSecurityTrustHtml
Agent identified all input fields where user-controlled data is reflected or stored, then tested for XSS with context-specific payloads. Found stored XSS chains through Angular's bypassSecurityTrustHtml.
Zero-Auth BOLA: Entire Merchant Database Exposed
Agent analyzed a security assessment report and learned the API's broken authorization patterns, then verified that any GUID grants access to the entire merchant database.
JS Bundle Attack Surface Extraction on Super-App
Agent deep-crawled React JS bundles from a super-app's bill payments module, extracting hardcoded API routes, service IDs, and fetch/axios calls to map the complete attack surface.
Subdomain Takeover on Internal Domains
Agent identified subdomain takeover opportunities where CNAME records point to unclaimed endpoints, including domains with 'internal' and 'codereview' in their names.
JS Bundle Crypto Key Extraction: Full API Decryption
During workspace setup, the agent discovered AES encryption keys hardcoded in Angular JS bundles, where the same value is used as both the key and IV.
Swagger UI with 480 Internal Endpoints Discovered
During black-box recon, the agent discovered publicly accessible Swagger UI exposing 480 internal API endpoints including wallet/payment endpoints and admin controls.
DOM XSS via Cookie Source to jQuery .prepend() Sink
Agent traced a DOM XSS vulnerability from cookie source through storelogin.min.js to an unsanitized jQuery .prepend() sink, confirming JavaScript execution via cookie injection.
Blind SSRF via HTTPS Scheme Bypass
During injection testing, the agent discovered that while http:// URLs are blocked, https://127.0.0.1 is accepted, with a 15-second TCP timeout confirming internal network access.
Unauthenticated Chargeback Record IDOR
Agent discovered session credentials leaking to third-party services, and chargeback endpoints accessible without authentication via sequential ID enumeration.
Stored SSRF via Webhook with DNS Alias Bypass
Agent validated stored SSRF findings by testing webhook URL registration with DNS aliases resolving to internal IPs, bypassing WAF and application-layer validators.
Hystrix Dashboard and Service Controls Exposed
During black-box testing, the agent discovered exposed microservice dashboards with service pause/resume controls, config management, and unauthenticated payment endpoints.