Attack methods
The attack methods XBOW uses are under continual development. The methods can be grouped into checks for:
- Common weakness enumerations (CWEs): for example, local file inclusion, remote code execution, cache poisoning, open redirects, server-side request forgery, cross-site scripting, SQL injection.
- Flawed strategies: for example, business logic, race conditions, and MFA/2FA bypass.
- Technology-specific weaknesses: for example, GraphQL, Adobe Experience Manager, and WebSockets.
- Common misconfigurations: for example, SSL/TLS issues, default credentials, unrestricted file upload, exposed tokens, and config files.
- Common Vulnerabilities and Exposures (CVEs)
- Dynamic application security testing (DAST)
Where possible, each finding from an assessment is reported with the top-level CWE for the weakness. For a list of all supported CWEs, see Vulnerability classification.
Release phases
XBOW has a full-time research team working on new attack methods. When the precision of a new method is high enough, XBOW makes it available to customers, initially as a private preview but moving toward general availability as the analysis matures.
The release phase for an attack method reflects XBOW’s confidence in the precision of the results.
- Private preview: Precision is under development. Attack methods are available on request. Talk to your XBOW contact.
- Public preview: Precision is still maturing. Internal testing shows over 70% true positive results. Attack methods are available to all users who choose to enable them.
- Generally available (GA): Internal testing shows over 90% true positive results. XBOW tests for these methods in every comprehensive assessment.
Preview attack methods
You can enable attack methods that are in private or public preview when you configure an assessment. See Choose preview stages.
Note: Findings from private preview attacks may appear after your assessment is complete. To keep false positive results to a minimum, XBOW’s internal security team triages all findings from private preview methods before they are included in your results.
Retests
When you run an assessment to verify that a finding has been fully fixed, only the relevant attack methods are run.