#react

Executive summary: The post documents building an offensive-security
AI agent using LangGraph's ReAct paradigm to automatically parse a
JavaScript asset, enumerate hidden API endpoints, and probe them for
misconfigurations and sensitive data exposure. The testbed is a
minimal Flask app that serves a vulnerable main.js and a set of
endpoints with differing access controls.

Technical details:
• The JavaScript asset contains an API_CONFIG object mapping logical
names to endpoints such as /api/v1/user-info, /api/v1/admin, and
/api/v1/profile.
• The script leaks a hardcoded admin key (ADMIN_KEY) used in an
X-Admin-Key header and uses fetch() to call endpoints.
• The /api/v1/user-info endpoint returns user records including SSN
and salary without authentication, representing an authorization
bypass/data exposure.

Analysis:
• Automating discovery via an LLM-driven agent that combines reasoning
and tool use (ReAct) is effective for parsing code, extracting
artifacts (endpoints, header requirements, secrets), and iteratively
testing endpoint behavior.
• The approach highlights common server-side weaknesses: hardcoded
secrets in client assets, endpoints lacking authentication, and
endpoints requiring custom headers that may be discoverable and
abused.

Detection:
• Monitor access patterns to main.js and other public assets for
unusual automated pulls.
• Implement rules to alert on responses containing PII fields like ssn
in API responses.
• Create IDS signatures to detect requests presenting X-Admin-Key
values or enumeration of /api/v1/* endpoints.

Mitigation:
• Remove hardcoded secrets from client-side code and rotate any exposed keys.
• Enforce authentication and authorization on endpoints returning
sensitive fields; apply least privilege and field-level redaction.
• Harden API surface with rate limits, anomaly detection, and require
proof-of-possession for high-privilege endpoints.

Limitations:
• The agent's effectiveness depends on prompt design, tool
capabilities for HTTP probing, and safe guardrails to avoid harmful
actions.
• Findings are illustrative of automation potential and do not
substitute for human-led penetration testing.

🔹 LangGraph #ReAct #Flask #APIsecurity #LLMsecurity

🔗 Source: https://infosecwriteups.com/building-my-first-offensive-security-agent-part-1-7b2dbb93c842

Show Original PostReport

25.09.2025 19:08

fstackbulletin (@fstackbulletin@mastodon.social)

State in the url in #React (the right way)

https://medium.com/@meric.emmanuel/state-in-the-url-in-react-the-right-way-3b031a3b183a

Show Original PostReport

25.09.2025 16:51

mortoray (@mortoray@peoplemaking.games)

React Hooks Demystified: The mechanics of useState

Explore how React's useState hook works under the hood and understand how state is tracked across renders -- a key to writing correct and predictable code.

https://mortoray.com/react-hooks-demystified-the-mechanics-of-usestate/

#coding #react #programming