The VITI Security Blog
Practical writing on managed IT + cybersecurity.
By the engineers doing the work - not a marketing team summarizing it. We write when we have something to say, not when the calendar says we should.
Continuous Bug Hunting Automation: Vexta's AI Loop and Hunt Mode
Continuous bug hunting automation means a scanner that keeps testing an authorized target over time and reasons about what to try next. Here is how Vexta's AI discovery loop and continuous-hunt mode do that.
Why an Exposed JavaScript Source Map Is a Bug Hunter's Shortcut
A public source map can hand over a site's original, unminified code, and whatever secrets got baked into it. Vexta reconstructs that source automatically and scans it for hardcoded keys and hidden endpoints.
WAF Detection in Vexta: Spotting a Firewall and Throttling Automatically
WAF detection in a vulnerability scanner means recognizing a firewall is in front of a target before a scan runs into it. Vexta fingerprints the WAF and throttles itself automatically to stay quiet.
How Vexta Tests for Business Logic Flaws Like Mass Assignment
A business logic bug rarely throws an error, it just quietly does the wrong thing. Vexta probes mass assignment across every write endpoint and negative-quantity abuse on money fields, gated behind explicit consent.
Vexta's WordPress, Drupal and Joomla Vulnerability Scanner
Most CMS risk lives in plugins and modules, not core. Vexta fingerprints WordPress, Drupal and Joomla, then enumerates plugins, themes, modules and extensions against an embedded CVE database.
How Vexta Detects HTTP Request Smuggling and Race Conditions
Request smuggling and race conditions both come down to two systems disagreeing about timing or framing. Vexta tests CL.TE/TE.CL/H2.CL desyncs and uses single-packet and last-byte-sync techniques to make races reproducible.
How Vexta Tests SAML and OAuth Single Sign-On for Auth Bypass
A flaw in single sign-on does not compromise one page, it compromises the front door to every app behind it. Vexta runs OIDC and SAML misconfiguration detectors plus a dedicated SAML signature wrapping check.
How Vexta Tests GraphQL APIs for Introspection and Auth Bypass
GraphQL hides its attack surface behind a single endpoint. Vexta uses the API's own introspection system to map it, then checks for batching abuse, denial-of-service and field-level auth bypass.
How Vexta Fuzzes REST APIs Using Their Own OpenAPI Schema
Vexta reads a target's own OpenAPI or Swagger definition and fires type-aware payloads at every declared route and parameter, so API testing does not depend on a hunter guessing endpoints.