> Source: https://planckproof.ai/meet-operator | Plain-Markdown twin of the page. HERO Operator · Agentic Pentest # From your spec to proof. Point Operator at your API. It tests every operation, chains a real exploit, and hands you a working proof, live. [Launch engagement](https://cloud.planckproof.ai) See a live run ↓ **139** Proven-exploitable **1,730** Findings **5** Live targets 01 LIVE RUN (real Operator UI, live) Operator, api.example.com✕ + cloud.planckproof.ai/scans ## api.example.com EXPLOITING FULL RUN RUNNING API agent, 32 operations ›_operator console · 0 events Working Ask the operator live · steering 02 PROOF (full-width finding) 01 The proof ## Open one. There’s the data. Every finding ships a working PoC, CVSS, the exact request, and the **other user’s account** it returned. cloud.planckproof.ai / findings / bola-users HIGH API1 NEW Broken Object Level Authorization (BOLA): any authenticated user can read any other account via /api/v2/users/{id} Confirmed by the AI exploitation agent with a working proof-of-concept. This is an illustrative example finding, not a specific customer result. CVSS 3.1 7.7 High · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Confidence ✓ AI-validated Frameworks API1:2023 CWE-639 Remediation Enforce object-level authorization on every request. Verify that the authenticated principal owns or is entitled to the requested object id server-side, and never trust a client-supplied id. Use unguessable identifiers as defense in depth, but do not rely on them in place of an ownership check. Request GET COPY GET /api/v2/users/1042 HTTP/1.1 Host: api.example.com Authorization: Bearer --- next request --- GET /api/v2/users/1043 HTTP/1.1 Host: api.example.com Authorization: Bearer Response 200 COPY { "id": 1042, "email": "me@acme.com" } --- next response --- HTTP/1.1 200 · server: nginx/1.24.0 content-type: application/json { "id": 1043, "email": "victim@othercorp.com", "phone": "+1 415 555 0164", "role": "admin" } References owasp.org/API-Security/…/API1-BOLA cwe.mitre.org/data/definitions/639.html CWE-284: Improper Access Control PortSwigger: IDOR ↻ Re-test → Replay STATUS open ▾ Ask AI about this finding Ask anything about this finding, impact, exploitation, remediation, how to verify a fix. e.g. how do I fix this? is it exploitable? Ask 03 ATTACK PATH 02 The impact ## One chain. Login to every account. The exact path an attacker walks from a forged token to every user’s data, mapped to MITRE ATT&CK. cloud.planckproof.ai / attack-path Proven chain → business impact 1 TA0006 · CREDENTIAL Forge any user’s JWT via md5(server timestamp) → 2 TA0001 · ACCESS BOLA: read any account via /users/{id} → 3 TA0004 · PRIV-ESC Mass-assign role=admin on another account → 4 TA0040 · LOGIC webhooks/restore forges a paid subscription → 5 TA0040 · IMPACT Any user’s data · unauthorized premium Credential Access Broken Authorization Privilege Escalation Business Logic 04 COMMAND CENTER (real overview, builds on scroll) 03 Command center ## Your exposure, as it builds. A live risk score, the severity split, OWASP/MITRE coverage and verification confidence, the whole picture assembling itself as you scroll. Security Overview Attack surface intelligence live 05 DELIVER (side by side) 04 Deliver ## Proof, where you already work. Straight to Jira, GitHub and Slack, deduped by fingerprint. Export CSV, JSON, SARIF, PDF. cloud.planckproof.ai / integrations Push findings to your stack **Jira** NOT SET One issue per new finding, deduped. Connect **GitHub** NOT SET Issue per finding, by severity. Connect **Slack** NOT SET Scan summary when a scan finishes. Connect **Webhook** NOT SET POST findings JSON to SIEM / SOAR. Connect CTA Ready when you are ## Know what’s exploitable before they do. Point Operator at your API. Get proof, not a to-do list. [Launch engagement](https://cloud.planckproof.ai) [Book a walkthrough](https://planckproof.ai/contact)