Breaking the Bot: GenAI Web App Attack Surface & Exploitation
summary
Covers a threat‑modeling workflow (PASTA) and an OWASP Top 10 for LLM apps with hands‑on exploits: demonstrates a successful prompt injection that returns bomb instructions by combining obfuscation, prefill and countermanding; forces SSRF to read a localhost file (flag) via the chatbot; triggers XSS by asking the summarizer to process script payloads; and achieves system prompt leakage by injecting text via a date field that alters the system prompt. Exercises run against ptos.webtest.ninja and mitigations include stronger system prompts, removing user‑editable assistant state, supervisor LLMs and prompt fuzzing.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:05GenAI threat modeling
- 6:01Threat modeling with PASA
- 18:12OAS Top 10 for LLMs
- 25:51Prompt injection deep dive
- 38:52Sensitive data disclosure demo
- 44:51Supply chain vulnerabilities
- 47:40Data and model poisoning
- 51:52Improper output handling demo
- 55:23Excessive agency risks
- 58:37System prompt leakage
- 1:01:27Vector embedding weaknesses
- 1:04:37Misinformation and hallucinations in LLMs
- 1:06:45Unbound consumption risks
- 1:08:11Mitigation recommendations
related talks
54mA Practical Guide to AI Threats & Mitigation Strategies
25mPreventing an OWASP Top 10 in the world of AI
28mSecuring LLMs: Insights into OWASP top 10
20mUnderstanding and Mitigating Risks in LLM-Powered Web Apps
24mSecuring Language Models Against Prompt Injection
56mAttacking AI
33mAgentic ProbLLMs: Exploiting AI Computer-Use and Coding Agents
51mPrompt Injection: When Hackers Befriend Your AI