Two servers returned a blank “page not found.” We changed the name in the request, and the staff-only systems behind them started answering. By the end, we had access to more than 20 restricted employee domains.
Two load balancers.
One oversized file.
A lot of doors.
A very quiet 404
On this customer’s external perimeter, the employee-only systems sat behind a single sign-on service. The rest was mostly simple public websites, and most interesting looking URLs sent us straight to the single sign-on page, exactly as designed.
With no obvious misconfiguration in sight, we asked our tooling which targets skipped that redirect.
Two did.
Both were load balancers, which are servers that route incoming traffic to the right application, and both returned a bare “page not found.”
Same door, different name
Next, we sent many slightly altered requests and watched what changed. Each one asked for a different site name. Subtle differences in the responses suggested something further down the chain was reacting to the name we gave it.
So, we tried the hostname of every employee portal that had earlier redirected to sign-on.
Three of them bypassed the login and opened restricted employee applications.
Our working assumption is that the load balancers match the name in the request to routing rules for the container platform that runs their apps and never check where the request came from. We haven’t confirmed that.
A map nobody meant to hand out
Further requests returned a 90MB response from a monitoring endpoint. It held the entire internal layout of the customer’s services.
Our tooling matched its entries against subdomains we already knew and rebuilt more of them. With that list in hand, we went back to the load balancers for another round, and the total reached 20+ restricted employee domains.
Lying around in plain sight
We ran a light file search across those domains, using the first bypass. It turned up full administrative access to a customer relationship management platform, through leaked access tokens (digital passes that let software act with an account’s permissions).
It also found several environment files, which are configuration files, holding hardcoded production and staging credentials.
The last find was a production token for a code hosting platform. Fortunately, it had already expired.
The copilot still needs a pilot
ACE is part of RAID, our Red Team AI Division. It maps the external perimeter, then acts as a copilot for our consultants, pointing them to high-value targets, vulnerabilities, and the paths an attacker could take. It doesn’t connect the dots on its own. An operator decides which ones matter.
What it does well is suggest creative attack vectors, compare hundreds of responses for subtle differences, and work through a 90MB file in seconds. The human still decides what to do next when ACE identifies a response that subtly differs from the established baseline. And because the Swarm covers more ground at the same time, assets that might otherwise go untested get tested.
Those doors were meant to send us to the single sign-on page. Two load balancers let us skip it.
What RAID means for you: assets that might otherwise go untested get tested. RAID builds the agentic attack capabilities inside every Constant Cyber Attack, and operators approve each sensitive action before it runs. It makes people faster. It doesn’t replace them.