Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The Red Agent POV: The One Boolean That Broke a B2B Platform’s Credit System

wiz.io | blog | #api-security | #authorization-bypass | #red-agent | #business-logic-flaw | #paywall-bypass

Summary

Part 3 of the Red Agent POV series: the autonomous pentester bypassed a B2B platform's credit system by appending one client flag to API calls, unmasking 600M+ profile contacts for free.
Published
Collected

original ↗

Related coverage

  1. The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL API (wiz.io)
  2. Introducing the Wiz Red Agent- AI-Powered Attacker (wiz.io)
  3. The Wiz Red Agent is Now Generally Available (wiz.io)
  4. Wiz ASM for any environment, any risk, everywhere (wiz.io)
  5. The Red Agent POV: How it Reasoned its Way to SSRF (wiz.io)
  6. Introducing the Red Agent POV Series (wiz.io)

back