Crossfyre
Publications
What we have measured, how we measured it, and where the method fails.
- Paper
- A method and a measurement, written so someone can repeat it and disagree.
- Report
- What we found on one target or across one survey, with the evidence.
- Post
- How something works, or what changed. No claim to be a result.
15 results
-
Flutter doesn't care what Android trusts
Every interception tool works by editing one Android config file. Flutter has never read that file. Here is how we find the function that actually decides, without a byte signature, and what happened when we ran it against every Flutter app on one phone.
5 min read mobileandroidflutter -
Rate limits are about where you are, not how fast
Content discovery, subdomain brute force and port scanning all fail the same way, and it is not speed. Here is what actually gets a large authorized scan finished, and the part of it we cannot do for you.
4 min read methodologyreconrate-limits -
What a scanner finds when the answer key is written first
Nineteen deliberately vulnerable targets, each with a machine-readable answer key written before the scan so nobody could move the goalposts afterwards, plus one target rigged so that every finding is wrong by construction. Final score: 48 of 48. The unflattering part is that none of the six we clawed back came from teaching the engine to detect anything new. It could already find all six. It was busy breaking the applications it was measuring, timing itself against a brake it had set an hour earlier, and being scored by a harness that threw away the one field the score is matched on.
benchmarkdetectionfalse positives -
Every false positive we have shipped had the same cause
Four separate false positives, four different vulnerability classes, one root cause: the scanner accepted something it had caused as proof. A template matched a marker it had put in the request. An SSRF probe counted a callback our own client made. Here are the four, and the five rules that now stop them, each enforced by a test rather than by review.
9 min read false positivesscanningdetection -
Cloudflare Access protects your domain, not your deployment
Our admin panel sat behind Cloudflare Access and redirected every request to a login. The same deployment, on the address Cloudflare gives every Pages project by default, served the full app to anyone who asked. An Access policy is bound to a hostname, and a deployment usually answers on more than one. Here is how to check yours in about a minute.
cloudflareaccessmisconfiguration -
Five of our authorization tests were passing for the wrong reason
A negative test asserts that a request is refused. Ours were refused, they went green, and five of them never reached the authorization check at all: the request body was malformed, so the server rejected the shape and returned before any permission was evaluated. A passing suite cannot tell that apart from a real refusal. Here is the audit that can.
8 min read testingauthorizationapi -
Intercept a pinned mobile app from an unrooted phone
On-device traffic capture is common and it all stops at certificate pinning. The Crossfyre Tracer answers pinning with a server-assisted APK repackage that needs no root and no computer, so a pinned Android app on a stock physical handset yields full request and response bodies. Here is exactly how it works, and what it is not.
7 min read mobileandroidinterception -
The tenant parameter our AI assistant does not have
We shipped an assistant that could read data belonging to other customers. The interesting part is not the bug, which was an ordinary missing WHERE clause, but the fix: the model has no way to say which tenant it means, so a fully jailbroken one still cannot reach across the boundary. Written up because a lot of teams are shipping this exact shape right now.
multi-tenancyllmauthorization -
The bug class scanners cannot see: BOLA, BFLA and BOPLA
Broken authorization sits at the top of the OWASP API list and template scanners are hopeless at it, because a valid request from the wrong person has nothing malformed to match on. Here is the testing model that does work.
4 min read methodologyauthorizationbola -
A scanner that stops at the login page is testing a different app
Almost everything worth testing lives behind a login, and an unauthenticated scan never sees any of it. Here is what it takes to get in, and how we handle your credentials without spreading them across a fleet.
4 min read guidesauthenticated-scanningoauth -
Whose IP address is your scanner using?
If a hosted scanner sends probes from its own infrastructure, then every customer shares one reputation, and the first person to get that address blocked breaks the product for everyone else. We audited our own platform against that rule and found a component breaking it. This is the rule, the audit, and what we changed.
7 min read architecturemulti-tenancyegress -
Four bugs we found in ourselves
An internal review of the surfaces we had added over the previous month found four issues: a hosted headless browser that would follow a user-supplied URL to cloud metadata, an unauthenticated registration endpoint with no ceiling, a re-registration path that did not require the original secret, and a response reader with no size limit. All four are fixed. Published because a security vendor that only reports other people's bugs is telling you half of something.
disclosuressrfaudit -
How Crossfyre scans survive a crashed node
A reclaimed instance, a closed laptop lid, a target that starts tarpitting. Most tooling loses the whole run to any of those. Here is what we do instead, and why a dead machine costs you nothing.
6 min read resiliencearchitecturenodes -
Valkyrie: turning the scanner firehose into ranked findings
Raw recon output is a firehose of mostly noise. Valkyrie is the triage layer that reads it, ranks what matters by severity, and tells you why each finding is worth your time. Here is what it does, what it costs, and what it does not do yet.
6 min read valkyrieaifindings -
Scanning is not metered. Credits are only for AI.
Your plan sets your limits and unlocks capabilities. Scanning inside them is not metered, so no per-scan fee and no billed minutes. Credits are a separate wallet, and Valkyrie is the only thing that spends them.
5 min read billingcreditspricing