reconpal

ReconPal: Leveraging NLP for Infosec Recon is one of the most important phases that seem easy but takes a lot of effort and skill to do right. One needs to know about the right tools, correct queries/syntax, run those queries, correlate the information, and sanitize the output. All of this might ...

reconpal

ReconPal: 보안을 위한 NLP 활용 리콘Recon은 가장 중요한 단계 중 하나로, 쉬워 보이지만 제대로 수행하려면 많은 노력과 기술이 필요합니다. 올바른 도구, 올바른 쿼리/구문을 알고, 해당 쿼리를 실행하며, 정보를 상호 연관시키고, 출력을 정리해야 합니다. 이 모든 것은 숙련된 정보 보안/리콘 전문가에게는 쉬울 수 있지만, 그 외의 사람들에게는 여전히 마법에 가깝습니다. "싱가포르에서 UDP를 지원하는 오픈 Memcached 서버를 찾아줘" 또는 "싱가포르에 있는 IP 카메라 중 기본 자격 증명을 사용하는 것은 몇...

llm-security

新着: Bing Chat に対する間接インジェクション攻撃の実証 間接プロンプトインジェクションを用いた LLM の侵害 「…言語モデルとは、自然言語で書かれたプログラムを実行するチューリング完全な奇妙な機械である。検索を行うとき、あなたは『更新された事実を AI に組み込んでいる』のではなく、実際にはインターネットからランダムな未署名のコードブロブ（多くは攻撃者によって書かれたもの）をダウンロードし、それを完全な権限で LM 上で何気なく実行しているのだ。これは良い結末にはならない。」 - Gwern Branwen on LessWrong...

IATelligence

IATelligence IATelligence は、PEファイルからインポート アドレス テーブル（IAT）を抽出し、OpenAI の GPT-3 モデルを使用して、ファイルがインポートする各 Windows API に関する詳細を提供する Python スクリプトです。このスクリプトは、関連する MITRE ATT&CK テクニックを検索し、攻撃者がその API をどのように使用する可能性があるかを説明します。 また、ファイルのハッシュを表示し、GPT-3 リクエストのコストを見積もります。IATelligence は、マルウェア解析に GPT-3 を使用し、IAT...

EUVD-2023-49384

Malicious code in bioql PyPI...

CVE-2025-6206: Unrestricted Upload of File with Dangerous Type

The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aiomaticimageeditorajaxsubmit' function in all versions up to, and including, 2.5.0. This makes...

CVE-2024-13816: Missing Authorization

The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability checks on multiple functions in all versions up to, and including, 2.3.6. This mak...

CVE-2024-13882: Unrestricted Upload of File with Dangerous Type

The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aiomaticgeneratefeaturedimage' function in all versions up to, and including, 2.3.8. This makes...

CVE-2023-45063: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in ReCorp AI Content Writing Assistant Content Writer, GPT 3 & 4, ChatGPT, Image Generator All in One plugin = 1.1.5 versions...

WordPress AI Mojo – GPT-3 Playground for WordPress Plugin < 0.9.0 is vulnerable to Cross Site Scripting (XSS)

Software AI Mojo – GPT-3 Playground for WordPress Type Plugin Vulnerable versions 0.9.0 Fixed in 0.9.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5642cc65e7b6 Credits Rafie...

In Review: What GPT-3 Taught ChatGPT in a Year

Amidst the uproar and opinions since November 2022, we look at the possibilities and implications of what OpenAI’s ChatGPT presents to the cybersecurity industry using a comparison to earlier products, like its predecessor GPT-3...

What ChatGPT know about API Security?

There is no doubt that you heard about and seen the latest OpenAIs brilliant called ChatGPT. It can write poems, speak many languages, answer questions, play chess, make code and impress everyone. In this post, we show a few more of how this AI model is good in cybersecurity, in particular in API...

Awful 4chan chat bot spouts racial slurs and antisemitic abuse

“A robot may not injure a human being or, through inaction, allow a human being to come to harm” Science fiction readers, and many others, will recognize Asimov’s first law of robotics. After reading about a bot called GPT-4chan I was wondering whether we should include: “A bot may not insult a...

WordPress AI Mojo – GPT-3 Playground for WordPress plugin < 0.2.5 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress AI Mojo – GPT-3 Playground for WordPress plugin versions 0.2.5. Solution Update the WordPress AI Mojo – GPT-3 Playground for WordPress plugin to the latest available version at least 0.2.5...

Codex Exposed: Exploring the Capabilities and Risks of OpenAI’s Code Generator

The first of a series of blog posts examines the security risks of Codex, a code generator powered by the GPT-3 engine...

Using AI to Scale Spear Phishing

The problem with spear phishing is that it takes time and creativity to create individualized enticing phishing emails. Researchers are using GPT-3 to attempt to solve that problem: The researchers used OpenAIs GPT-3 platform in conjunction with other AI-as-a-service products focused on personali...

AI Wrote Better Phishing Emails Than Humans in a Recent Test

Researchers found that tools like OpenAI's GPT-3 helped craft devilishly effective spearphishing messages...

AIs and Fake Comments

This month, the New York state attorney general issued a report on a scheme by "U.S. Companies and Partisans to Hack Democracy." This wasn’t another attempt by Republicans to make it harder for Black people and urban residents to vote. It was a concerted attack on another core element of US...