IntruderPayloads
vaf
IntruderPayloads | vaf | |
---|---|---|
2 | 1 | |
3,526 | 307 | |
- | - | |
1.8 | 1.8 | |
over 2 years ago | almost 2 years ago | |
BlitzBasic | Nim | |
- | GNU General Public License v3.0 only |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
IntruderPayloads
-
AI-powered Bing Chat spills its secrets via prompt injection attack
It's very interesting that AppSec may now begin to include "prompt injection" attacks as something of relevance.
Specifically with libraries like LangChain[0] that allow for you to perform complex actions ("What's the weather?" -> makes HTTP request to fetch weather) then we end up in a world where injection attacks can have side effects with security implications.
I've been thinking about what security might look like for a post-ChatGPT world and how I'd attempt to defend against it. I'd probably start by building a database of attack prompts, kind of like this[1] fuzz list but for AI, then I'd train a second neural net that acts like an adversarial neural network[2] to try to exploit the system based on those payloads. The end result would sort of like SQLMap[3] but for AI systems where it can automatically "leak" hidden prompts and potentially find "bypasses" to escape the sandbox.
Has anybody else spent any time thinking about how to defend systems against prompt injection attacks that have possible side effects (like making an HTTP request)?
0: https://langchain.readthedocs.io/en/latest/modules/agents/ex...
1: https://github.com/1N3/IntruderPayloads
2: https://en.wikipedia.org/wiki/Generative_adversarial_network
3: https://sqlmap.org/
-
Passed OSCP (70+10)! Experience sharing!
nmap, hacktricks and burpsuite are my best friend on enumeration. Search every port on hacktricks, fuzz every field in your web request on burpsuite using https://github.com/1N3/IntruderPayloads. Don't forget to try bruteforce if everything failed.
vaf
-
vaf - very advanced (web) fuzzer
Here's the GitHub repo: https://github.com/d4rckh/vaf
What are some alternatives?
ssti-payloads - 🎯 Server Side Template Injection Payloads
GRecon - Another version of katana, more automated but less stable. the purpose of this small tool is to run a Google based passive recon against your scope.
sql-injection-payload-list - 🎯 SQL Injection Payload List
Nim - Nim is a statically typed compiled systems programming language. It combines successful concepts from mature languages like Python, Ada and Modula. Its design focuses on efficiency, expressiveness, and elegance (in that order of priority).
dicectf-2023-challenges - All challenges from DiceCTF 2023
host - host is a simple, static, web server for easily hosting files over LAN. made with <3 in nim.
SQLMap - Automatic SQL injection and database takeover tool
HawkScan - Security Tool for Reconnaissance and Information Gathering on a website. (python 3.x)
PEASS-ng - PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)
nimquery - Nim library for querying HTML using CSS-selectors (like JavaScripts document.querySelector)
Reconky-Automated_Bash_Script - Reconky is an great Content Discovery bash script for bug bounty hunters which automate lot of task and organized in the well mannered form which help them to look forward.
prologue - Powerful and flexible web framework written in Nim