Proof, not promises
Measured, not marketed.
Every claim on this page is produced by a ground-truth benchmark or a live target we own — published with the score we actually got, including the misses. Especially the misses.
OWASP BenchmarkJava
The scoreboard, on the record.
The industry-standard ground-truth suite: 2,740 labeled cases. Detection and precision, class by class — no averages to hide in.
Path traversal: 95% detection at 100% precision. The seven misses are cases the benchmark itself marks physically impossible to reach over HTTP.
Zero false positives
Zero is what proof buys you. Every finding the engine reports is one it proved with a request — the payload, the response, the differential. Across all 2,740 ground-truth cases, the benchmark confirms it never once cried wolf.
It matters because a scanner that lies trains you to ignore it, and an ignored scanner is worse than none. TrojanStrike's discipline runs both ways: if we can't prove it, we don't report it — and when we report a finding, the evidence is there to prove it.
Live targets
The ladder we measure ourselves against.
Real applications, real intrusions, run end-to-end through the same engine we ship. The wins and the misses, side by side.
OWASP Juice Shop
Every challenge class solved, data extracted read-only — including all six hardest-tier challenges. Verdict: INSIDE_THE_WIRE.
OWASP WebGoat
Every tractable lesson detected, authenticated end-to-end — including hidden admin surfaces, cross-user profile reads, and the WebWolf companion app on its side port.
OWASP BenchmarkJava
Five injection classes mastered outright; path traversal at 95% — the seven misses are cases the benchmark itself marks unreachable over HTTP.
XBOW Validation Benchmarks
The autonomous red-team grading suite: 103 web-scoped challenges across 19 vulnerability families, run unassisted against live builds — detections admitted only with proof. The remaining 4 misses are published by name below.
XBOW · 19 families, on the record
The file we're measured against, family by family.
This is the benchmark class used to grade autonomous offensive systems. Every challenge is a live application in its own container; every detection below was proven with the request that demonstrates it — no hints, no assists.
Two numbers, kept apart on purpose: 99 challenges detected and 66 flags fully extracted read-only — proof-of-objective is the metric the suite grades hardest, and we don't let a detection claim it. Scored over 103 web-scoped challenges: one benchmark in the public 104-challenge set requires SSH and sits outside the web attack surface. The misses are named, not smoothed over — XBEN-022 (its SSTI signature still evades our oracles; an earlier detection was a false positive we caught and retracted ourselves — the real primitive is tracked in the engineering log) · XBEN-066 (its front-end normalizes every framing ambiguity before the second hop; 25 hand-probes found no parser disagreement to detect) · XBEN-092 (the SSRF bridge hardcodes its request body, so the unserialize sink is unreachable with a controlled payload), plus XBEN-054, which is unwinnable as shipped (its auth file path resolves outside the container — verified by hand). Each is tracked to root cause in our engineering log, and this grid is re-published after every sweep.
The intel flywheel
Bundles name internal hosts, DNS names the providers, the crawl names the routes — and every finding feeds the next check: a CMS author slug becomes an existence oracle's ground truth, an SPF include becomes an SSO candidate, a bundle-mined hostname becomes an SSRF target.
Every fix ships with a regression test that fails without it; the suite is the product's memory.
Where this goes
Proof engine, planning brain — then autonomy.
The proof engine
Every finding carries the request that proves it. 57 checks across 19 vulnerability families — nothing inferred, nothing hedged. If we can't prove it, we don't report it. The benchmarks on this page measure exactly what ships.
The planning brain
Already shipped. A planner fingerprints the stack mid-scan and re-orders the attack surface to fit it; a hypothesis ledger proposes and confirms theories as evidence lands; an attack graph escalates confirmed findings into demonstrated paths toward concrete goals. When an edge blocks a probe, the engine evolves encoding-aware variants and scores them against the target's own evidence — one bypass teaches the whole scan.
- 01fingerprintstack identified from live markers
- 02promotechecks re-ordered by signal, budget goes first to what fits
- 03hypothesizemid-scan theories proposed, weighted, confirmed or killed
- 04escalateconfirmed findings become graph nodes toward a goal
- 05provea demonstrated path, or the honest lesser verdict
The self-directed campaign
Full engagements run end-to-end with no human hand-off: it plans the attack, executes it, reads its own evidence, and re-plans — then proves every claim the way the proof engine does. The XBOW file isn't the ceiling. It's the warm-up.
The synthesis loop
A probe an edge rejects is data, not a dead end. The engine mutates encoding-aware variants and scores each against the target's own response evidence; a confirmed bypass re-arms every later probe in the scan.
The replica range
Weaponized proof never touches production targets. When a protocol finding needs a real chain — a smuggled prefix, a poisoned connection queue — the engine rebuilds the fingerprinted edge in a sandboxed replica and detonates it there, binary-proved through the real front-end binaries where containers allow. Production target traffic stays timing-only, forever: full chain, zero innocent users in the queue.
We don't hide the gap between here and there. We publish it, then close it.