https://shellvoide.com/blog/blog The Shellvoide security blog: AI-driven penetration testing, vulnerability research, and application security insights from the team behind KLUE. en-us info@shellvoide.com (Shellvoide) info@shellvoide.com (Shellvoide) Fri, 17 Jul 2026 00:00:00 GMT https://shellvoide.com/blog/blog/websocket-auth-bypass-bug-bounty-case-study https://shellvoide.com/blog/blog/websocket-auth-bypass-bug-bounty-case-study A detailed bug bounty writeup. Our autonomous agent KLUE spent hours proving a hardened crypto-mining marketplace was hardened, then reverse-engineered its HMAC signing scheme, mapped a STOMP WebSocket buried in the authenticated app bundles, and discovered it performed no authentication at all, routing private per-tenant channels off a client-supplied parameter. An unauthenticated, cross-tenant data leak, responsibly disclosed and rewarded. Fri, 17 Jul 2026 00:00:00 GMT info@shellvoide.com (Shellvoide) kluecase-studybug-bountyai-pentestingwebsocket-securitybroken-authenticationstompbolaidorautonomous-securityappsecpentesting https://shellvoide.com/blog/blog/glm-deepseek-kimi-opus-pentest-benchmark https://shellvoide.com/blog/blog/glm-deepseek-kimi-opus-pentest-benchmark We ran KLUE against the same live production target four times, once each behind GLM 5.2, DeepSeek V4 Pro, Kimi K2.7 and Opus 4.8, all on an identical thirty minute budget. Same target, same clock, four risk verdicts from Low to Critical. A field report on what each model sees, what it walks past, whether it got the severity right, and why the cheapest run came back with the most. Mon, 22 Jun 2026 00:00:00 GMT info@shellvoide.com (Shellvoide) ai-pentestingkluebenchmarkglmdeepseekkimi-k2claude-opusptaasautonomous-securityappsecpentesting https://shellvoide.com/blog/blog/klue-autonomous-pentest-six-cves https://shellvoide.com/blog/blog/klue-autonomous-pentest-six-cves We gave our autonomous pentesting agent, KLUE, one real engagement against a mature open-source codebase and 2 hours 43 minutes on the clock. It came back with six CVE-assigned vulnerabilities, including a chained second-order SQL injection and a template injection that reached a shell. This is the annotated reasoning trace. Tue, 09 Jun 2026 00:00:00 GMT info@shellvoide.com (Shellvoide) kluecase-studyai-pentestingautonomous-securityappsecvulnerability-researchsql-injectionrcesstissrfxsspenetration-testing https://shellvoide.com/blog/blog/klue-dast-benchmark-juice-shop https://shellvoide.com/blog/blog/klue-dast-benchmark-juice-shop We pointed OWASP ZAP, Burp Suite, Acunetix, and our own KLUE at the same live, deliberately-broken web app. Three of them crawled it and reported headers. One forged an admin token, dumped every user, and reset the admin password, all from two requests, unauthenticated. A field report on what dynamic scanners can and cannot reach. Sat, 06 Jun 2026 00:00:00 GMT info@shellvoide.com (Shellvoide) dastdynamic-analysiskluebenchmarkjuice-shopowasp-zapburp-suiteacunetixappsecautonomous-securityai-pentesting https://shellvoide.com/blog/blog/klue-sast-benchmark-juice-shop https://shellvoide.com/blog/blog/klue-sast-benchmark-juice-shop A SAST benchmark on OWASP Juice Shop pitting Semgrep, SonarQube, and Snyk Code against KLUE, our autonomous source code analysis platform. The story is in the precision column, and in the vulnerability classes that have no pattern to match at all. Sat, 16 May 2026 00:00:00 GMT info@shellvoide.com (Shellvoide) saststatic-analysiskluebenchmarkjuice-shopsemgrepsonarqubesnyk-codeappsecautonomous-securityai-pentesting https://shellvoide.com/blog/blog/kimi-k2-vs-claude-opus-pentest-benchmark https://shellvoide.com/blog/blog/kimi-k2-vs-claude-opus-pentest-benchmark We ran four frontier models through the same autonomous pentest engagement. Recall, time to finish, and dollars per run all tell different stories, and Kimi K2.6 turned out to be the surprise on the leaderboard. Sat, 02 May 2026 00:00:00 GMT info@shellvoide.com (Shellvoide) ai-pentestingkluebenchmarkkimi-k2claude-opusptaasautonomous-securityappsecpentesting https://shellvoide.com/blog/blog/klue-61-minute-ai-pentest-case-study https://shellvoide.com/blog/blog/klue-61-minute-ai-pentest-case-study A case study from an autonomous AI pentest run by KLUE. Eleven confirmed findings in just over an hour, including a blind SQL injection that led to full database takeover. A practitioner walkthrough of the discoveries, the methodology, and the takeaways. Thu, 23 Apr 2026 00:00:00 GMT info@shellvoide.com (Shellvoide) ai-pentestingsql-injectioncorscase-studyklueptaasauthorization-bypassappsecpentestingautonomous-security https://shellvoide.com/blog/blog/blockchain-fundamentals-a-security-engineers-mental-model https://shellvoide.com/blog/blog/blockchain-fundamentals-a-security-engineers-mental-model Blockchain fundamentals for security engineers covering cryptographic primitives, block structure, consensus (PoW/PoS), Web3 tooling, transaction anatomy, and core Web3 security concepts. Wed, 08 Apr 2026 00:00:00 GMT info@shellvoide.com (Shellvoide) blockchainweb3web3-securitycryptographyethereumsmart-contractsinfosec https://shellvoide.com/blog/blog/jwt-attacks-in-the-wild-from-decode-to-exploit https://shellvoide.com/blog/blog/jwt-attacks-in-the-wild-from-decode-to-exploit A practical JWT security guide covering what JWT is, common JWT vulnerabilities, JWT attacks, exploit techniques, and defensive best practices for developers, pentesters, and API security teams. Mon, 06 Apr 2026 00:00:00 GMT info@shellvoide.com (Shellvoide) jwt-securityapi-securityappsecpentestingoauthauthentication https://shellvoide.com/blog/blog/api-pentesting-checklist-what-most-teams-miss https://shellvoide.com/blog/blog/api-pentesting-checklist-what-most-teams-miss Complete API pentesting checklist with OWASP API Top 10 (2023), BOLA/IDOR tests, JWT and OAuth checks, GraphQL security testing, SSRF payloads, business logic abuse scenarios, and reporting guidance. Mon, 30 Mar 2026 00:00:00 GMT info@shellvoide.com (Shellvoide) api-securityapi-pentesting-checklistowasp-api-top-10graphql-securityrest-api-securityjwt-securityidorappsec https://shellvoide.com/blog/blog/kali-cursor-fix https://shellvoide.com/blog/blog/kali-cursor-fix Fix the Kali Linux black screen blinking cursor on boot in VMware or VirtualBox. Switch to a TTY, run startx, and get the desktop back fast. Mon, 16 Mar 2026 00:00:00 GMT info@shellvoide.com (Shellvoide) kalilinuxvirtualboxvmwaretroubleshooting https://shellvoide.com/blog/blog/aws-client-vpn-with-sso-interactive-setup-guide https://shellvoide.com/blog/blog/aws-client-vpn-with-sso-interactive-setup-guide Interactive guide to set up AWS Client VPN with IAM Identity Center SSO. Fri, 13 Mar 2026 00:00:00 GMT info@shellvoide.com (Shellvoide) awsclient-vpnssoiam-identity-centernetwork-security https://shellvoide.com/blog/blog/setting-up-openclaw-on-docker https://shellvoide.com/blog/blog/setting-up-openclaw-on-docker OpenClaw (ClawdBot) is powerful, but running it bare-metal on your host is a security gamble. In this guide, we skip the expensive Mac Mini route and deploy OpenClaw inside a Docker container: fully isolated, completely free, and set up with a single command. Sat, 07 Mar 2026 00:00:00 GMT info@shellvoide.com (Shellvoide) cybersecuritydockeraiopenclawtoolsself-hosting