AI Explorer · Tier 2 scenario playbooks
Ten scripted scenarios for the classes static rules can't reach (IDOR, OAuth bypass, JWT confusion, GraphQL abuse, mass assignment, price manipulation, role tampering, workflow bypass, multi-step ATO, cross-tenant UUID).
Last updated Jun 9, 2026
What it is
Tier 2 takes each Tier 1 candidate and runs it through a scripted scenario playbook, a bounded sequence of probes designed to confirm or refute the vulnerability class for that endpoint.
Each scenario is a small program with:
- A fixed objective (“confirm IDOR on this endpoint”)
- An HTTP probe tool the LLM can call (with the egress lock: only this scan’s target host is reachable)
- A success criterion (“response leaks another user’s record” with concrete bytes)
- A hard turn cap so the LLM can’t burn budget on a stuck case
What playbooks exist today
| Class | Probes for |
|---|---|
| IDOR / BFLA | Object IDs in URL or body that another tenant’s session can read |
OAuth redirect_uri bypass | Open redirect or token-leak via redirect_uri manipulation |
| JWT algorithm confusion | alg=none, HS256 vs RS256 confusion, key confusion |
| GraphQL abuse | Introspection-on, batching, alias overload, depth limit bypass |
| Mass assignment | Hidden field assignment (admin=true, org_id=other) on user-controlled JSON |
| Price manipulation | Cart/checkout flows accepting negative quantities or external prices |
| Role escalation | Profile-update endpoints accepting role/is_admin/permissions |
| Workflow bypass | Order-of-operations checks (skip approval, skip payment) |
| Multi-step ATO | Signup → password reset → token leak chains |
| Cross-tenant UUID | UUID-based resources reachable across tenant boundaries |
What it produces
For each candidate Tier 2 examines, one of three outcomes:
| Outcome | What lands in the report |
|---|---|
| Confirmed | Real finding with the exact probe sequence as PoC |
| Rejected | Drop the Tier 1 hypothesis; remember so Tier 3 doesn’t re-probe |
| Hypothesis preserved | Tier 2 was inconclusive; finding lands as “AI-inferred, not actively probed” at lower confidence |
Destructive ops gate
Five playbooks (mass assignment, price manipulation, role escalation, workflow bypass, multi-step ATO) require the destructive-tests toggle ON, because they write state. With the toggle OFF the scan stays strictly read-only and these scenarios skip cleanly.
Why it matters
These ten classes account for the majority of real bugs in modern web apps, and they’re exactly what a static DAST scanner cannot find. Tier 2 is the wedge between “scanner that finds OWASP A03” and “audit that finds the bugs that get paid in bug bounty.”