XBOW, an autonomous penetration tester, has reached the top spot on HackerOne

10 months ago

XBOW, an autonomous AI-driven penetration tester, reached the top spot on the US HackerOne leaderboard.
Initial testing involved CTF challenges and custom benchmarks before moving to real-world zero-day vulnerability discovery in open-source projects.
XBOW operates without human input, scaling rapidly to complete penetration tests in hours.
The transition to real-world environments was challenging due to the diversity of systems, from modern to legacy.
XBOW participated in public and private bug bounty programs on HackerOne, treating it like any external researcher.
Scaling involved strategic target prioritization using a scoring system based on various signals like WAF presence and HTTP status codes.
Domain deduplication was essential to avoid redundant testing of similar environments.
XBOW uses validators to ensure the accuracy of vulnerabilities, reducing false positives.
Over time, XBOW reported thousands of validated vulnerabilities, many affecting high-profile targets.
XBOW climbed to the top position on the HackerOne US leaderboard, submitting over 1,060 vulnerabilities.
Vulnerabilities included Remote Code Execution, SQL Injection, XXE, SSRF, and more, with many still awaiting resolution.
A notable discovery was a vulnerability in Palo Alto’s GlobalProtect VPN, affecting over 2,000 hosts.
XBOW’s findings were confirmed by program owners, demonstrating its real-world impact and adaptability.

Hasty Briefsbeta