Posts by Alvaro Muñoz on the XBOW blog
7 posts- Offensive Security Academy
A Vulnerability Is a Hypothesis. An Exploit Is the Proof.
Offensive security today has to determine what an attacker can actually reach and exploit in the running system, and then prove it.
- Product
Getting to “Should I?”, Instead of “Can I?”: How XBOW Finds IDORs With High Accuracy in Ambiguous Contexts
By understanding expected access patterns before testing them, XBOW brings context-aware reasoning to complex authorization issues.
- AI Research
Tales from the Trace: How Agentic AI Merges Static and Dynamic Testing
Agentic AI unifies static and dynamic testing, correlating code context with runtime behavior to produce more accurate, actionable vulnerability detection.
- Security Research
Another Byte Bites the Dust - How XBOW Turned a Blind SSRF into a File Reading Oracle
A complete arbitrary local file read vulnerability achieved through an ingenious byte-by-byte exfiltration technique.
- Security Research
Beyond the Bands: Exploiting TiTiler’s Expression Parser for Remote Code Execution
A methodical analysis of TiTiler's API endpoints and its expression parser, leading to arbitrary Python code execution on the server.
- Security Research
Breaking the Shield: How XBOW Discovered Multiple XSS Vulnerabilities in Palo Alto’s GlobalProtect VPN
XBOW discovered multiple cross-site scripting (XSS) vulnerabilities in Palo Alto Networks’ GlobalProtect VPN web application.
- Security Research
XBOW Battles Ninja Tables: Who’s the Real Ninja?
XBOW's AI pentester reveals an arbitrary file-read vulnerability in WordPress Ninja Tables—how it was found, impact, and responsible disclosure.