Technical articles, offensive security methodologies, AI-driven cyber operations and emerging threat analysis.
BackBox Labs analyzed the NetBird client daemon on Linux and chained several individually moderate weaknesses in its local gRPC interface into a full root privilege escalation affecting versions up to and including 0.75.0, with no memory corruption, kernel bugs, or race conditions involved.
ReadWe pointed BackBox AI at a live Android RAT and asked for a full analysis. It unpacked a dropper, decoded an XOR-obfuscated C2 URL straight from smali bytecode, confirmed that the C2 infrastructure was still responding by speaking the malware's own protocol, and attributed the operation. This is what evidence-driven analytical reasoning looks like when it reaches past red teaming.
ReadIn the age of artificial intelligence, whoever controls models, data and infrastructure controls far more than technology. Why technological sovereignty has become a strategic question, and the contribution of a project born in Italy.
ReadBackBox AI found a local root escalation on Linux distributions that package Bettercap with a systemd service. The flaw is not in Bettercap's code but in the packaging: the service runs its REST API as root with authentication disabled. The unit was removed upstream.
ReadBackBox AI found that a small crafted file could exhaust available memory during an ordinary Binwalk scan, with no extraction flag required. The Binwalk maintainer confirmed the issue and fixed it by capping decompression at 100 MB.
ReadBackBox AI surfaced two header-trust weaknesses in SearXNG: a Host header injection leading to open redirect and cache poisoning, and an X-Forwarded-For rate-limiter bypass. Disclosed responsibly, both come down to trusting client-controlled HTTP headers.
ReadWhy BackBox AI bets on architecture over model size, and how we partner, pro bono, with a selected group of open source projects.
ReadA data-driven comparison of BackBox AI against Aikido Security and XBOW on the Photoview application, using Doyensec's independent severity review as a common yardstick. The focus is signal over noise: matching the serious-vulnerability coverage of a higher-volume competitor with far fewer low-value findings.
ReadComparative security benchmark between BackBox AI and Neo (ProjectDiscovery) on the MedPortal application, focusing on vulnerability coverage, false positive validation, and attack chain analysis
ReadHow BackBox AI leveraged multimodal visual capabilities to analyze PCB production files and autonomously identify hidden anomalies in the Hack The Box Critical Flight scenario
ReadHow BackBox AI autonomously exploited a hard Hack The Box machine by chaining real-world CVEs without human intervention
ReadA detailed analysis of how BackBox AI autonomously compromised a vulnerable SOAP service by exploiting XXE and default credentials in the XBOW Validation Benchmark.
ReadHow BackBox Labs applies an adversary-driven Threat Led Penetration Testing (TLPT) methodology that combines threat intelligence, AI-powered attack surface discovery, and human expertise to measure real operational resilience.
ReadA controlled demonstration of BackBox AI operating in an OT/ICS environment, interpreting industrial systems and safely interfacing with PLCs in a virtual lab setting.
ReadA detailed technical analysis of how BackBox AI successfully exploited a complex PHP deserialization vulnerability in PortSwigger Web Security Academy's expert-level lab, developing a custom gadget chain for remote code execution.
ReadExplore how AI is transforming cybersecurity with BackBox AI's platform enabling both offensive and defensive intelligence operations.
Read