PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Breaking Crypto with XBOW

xbow.com | blog | #ai-security | #benchmark | #cryptography | #padding-oracle | #ai-pentesting | #exploit-development | #cbc
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

XBOW's autonomous solve of a padding-oracle benchmark: the agent built an exploit to decrypt a server cookie and bypass authentication — an attack the author calls the hardest he taught at NYU.
Published
Collected

Related coverage

research · eshard.com
Scared': Better, Faster, Stronger
We shed light on the journey that led us to enhance the speed, efficiency, and reliability of 'scared', our open-source side-channel library.
vulnerability · netspi.com
DeKrypto – Padding Oracle attack against IBM WebSphere Commerce (CVE-2013-05230)
A padding oracle attack against the krypto parameter in IBM WebSphere Commerce (CVE-2013-05230) is demonstrated with a public exploit, since none had been published for the flaw.
blog · xbow.com
How Attackers Are Using AI & What Defenders Must Do
Attackers are running AI driven attack chains from recon to exploitation in minutes. Here’s what actually changed, and why defenders need AI pentesting to keep pace.
blog · xbow.com
Grok 4.7 Is Different. So Is the Best Way to Use It.
XBOW tested Grok 4.7 on exploit crafting and agentic pentests: inside xAI's Build it improved substantially over 4.6, outside Build it slipped slightly—orchestration now matters as much as prompts.
blog · xbow.com
How to Run an AI Application Pentesting Vendor RFP: The Evaluation Framework that actually works
An RFP evaluation framework for buying AI application pentesting: separating true autonomous testing from scanners and AI-assisted workflows, with questions, criteria and scoring guidance.
blog · xbow.com
Legal Boundaries of AI Penetration Testing: Engagements, Laws & Permissions
A practitioner's guide to the legal boundaries of autonomous AI pentesting: why traditional authorization breaks down, and how scope, enforceable controls and evidence preservation should be designed.
Back