[00:00.850 --> 00:01.850]  Welcome, everybody.
[00:02.170 --> 00:05.130]  This is the AI hacking talk, or one of six, really.
[00:06.970 --> 00:08.370]  Thank you, HOPE, for having me.
[00:08.470 --> 00:15.350]  My name is Erica, and this is a whole talk of hacking stories, one of which is the AI zero day.
[00:15.770 --> 00:20.490]  I saw on LinkedIn someone say that when there's a zero shot, zero day, we're in trouble.
[00:20.670 --> 00:22.850]  And then I thought, oh, I do that.
[00:23.290 --> 00:24.970]  I should probably say something.
[00:26.710 --> 00:38.590]  So, yes, this will be a few old CVs that I've released, and sort of showcasing, reimagining, hacking without the whole idea of remove brain, replace with AI, which I really don't like that sentiment.
[00:39.330 --> 00:42.170]  And we'll get into some of these zero day stories.
[00:42.670 --> 00:46.050]  First things first, these are my own views.
[00:46.230 --> 00:47.970]  I'm not here on my employer's dime.
[00:48.150 --> 00:50.210]  This is just my own opinions.
[00:51.290 --> 00:54.470]  And you probably know me from my bots more than you know me.
[00:55.070 --> 01:04.370]  So, there's quite a few bots, and I put a lot of effort into something, if it's fun, as you can see from this very highly sophisticated chart.
[01:05.490 --> 01:08.630]  I will put a lot of effort into crazy things.
[01:08.670 --> 01:13.870]  But this talk is mostly about exploit chains and search engine bombing for exploit targets.
[01:13.870 --> 01:16.950]  And that's a little bit of AI manipulation and those sort of things.
[01:17.630 --> 01:21.250]  Feel free to ask about these after, but the scope of the talk is mostly exploits.
[01:21.250 --> 01:25.250]  So, I, as I said, I'm Erica or Burninator.
[01:25.610 --> 01:31.530]  I love to make art, just, just with pen and paper or like cartooning, like digitally.
[01:31.530 --> 01:38.850]  So, I have some complex feelings about AI art, tendential to this talk, but I've been hacking since I was a teenager.
[01:39.110 --> 01:42.870]  And I've been a pen tester lead, where I've trained pen testers.
[01:42.970 --> 01:45.310]  I've been a red teamer and a software engineer.
[01:46.710 --> 01:50.090]  And I love to talk about it, so you probably see me at other talks.
[01:50.290 --> 01:56.790]  I organized the 2600 group, or I did in 2022 in Maine, where I'm from.
[01:56.910 --> 02:01.730]  And we have an awesome group called DC 207, very welcoming group, very awesome community.
[02:02.250 --> 02:04.550]  And that's part of MaineSec as well.
[02:04.830 --> 02:10.190]  So, I'll also be running a few different contests this year, along with this guy.
[02:10.190 --> 02:11.930]  If you raise your hand, yeah.
[02:13.110 --> 02:15.030]  Defcon, so come see us at the contest booth.
[02:15.230 --> 02:17.630]  We have something called Wall of Bribes, for example.
[02:18.070 --> 02:19.090]  And I love to blog.
[02:19.290 --> 02:24.610]  So, my current role is very R&D, which in 2024 means a lot of AI.
[02:24.870 --> 02:27.010]  So, there'll be quite a bit of AI in this talk.
[02:27.810 --> 02:32.370]  And I'll be talking about context and what context means a lot in all of these slides.
[02:32.750 --> 02:36.950]  And you can kind of divide the two ways I'm using AI into two different areas.
[02:37.850 --> 02:48.430]  And that's all separate from traditional automation, because you guys may be familiar with the fact that a non-technical person doesn't really see the difference between AI and a traditional script, right?
[02:48.490 --> 02:50.130]  They want to shoehorn AI into everything.
[02:50.350 --> 02:51.550]  We're not doing that here.
[02:51.710 --> 02:54.850]  We're only going to use AI when we absolutely need it.
[02:55.210 --> 03:03.950]  And so, in that case, there's two different ways I tend to use it, which is tool orchestration and sort of an applied knowledge approach with generative AI.
[03:03.950 --> 03:10.850]  And then those are more predictable, more deterministic responses, but still may involve simulated subjective reasoning.
[03:11.350 --> 03:17.530]  Those are different from more generative exploits or creating new things.
[03:17.750 --> 03:20.770]  So, I would say zero-day is a new thing in many cases.
[03:20.770 --> 03:24.070]  It's a new insight into how to break a system.
[03:24.510 --> 03:31.250]  And so, we'll have to go over some definitions, how the context works within the context of a transformer or GPT system.
[03:31.250 --> 03:35.210]  And, of course, the actual stories of using the AI systems.
[03:35.470 --> 03:41.950]  And how do we think about a Turing test when a lot of these machines are fooling people very well?
[03:42.030 --> 03:42.890]  How do we design that?
[03:46.250 --> 03:49.350]  So, here's just an example of some of the technologies we discussed.
[03:50.210 --> 03:57.430]  I have a lot of people use the OpenAI API, where you sort of do, like, GPT function calling.
[03:57.550 --> 04:00.350]  I think they might have called it tooling now, if I could get a show of hands.
[04:00.750 --> 04:01.030]  One person.
[04:01.150 --> 04:01.290]  Okay.
[04:02.250 --> 04:03.710]  So, we'll get into that in just a bit.
[04:03.910 --> 04:06.750]  And so, of course, all the generative big players.
[04:06.750 --> 04:10.470]  You've got Gemini, previously barred, Bing, ChatGPT.
[04:11.050 --> 04:12.870]  I've heard that many times this con.
[04:13.310 --> 04:19.370]  And as well as a few traditional application attacks, which I typically combine with an AI attack.
[04:20.810 --> 04:21.530]  Let's see.
[04:21.830 --> 04:23.630]  What this talk is and isn't.
[04:23.730 --> 04:28.190]  The really cool thing about a lot of these systems is that it accepts goals by design.
[04:28.390 --> 04:29.610]  That is a hacker's dream.
[04:29.850 --> 04:30.150]  Okay?
[04:31.090 --> 04:33.750]  Just allowing it to help you hack it.
[04:34.270 --> 04:39.130]  And so, there's also this concept of beginner's mind, which is pretty close to my heart.
[04:39.450 --> 04:43.170]  Is anyone familiar with beginner's mind and sort of that Zen school sort of thing?
[04:43.350 --> 04:44.090]  Oh, there's a few hands.
[04:44.090 --> 04:44.410]  Awesome.
[04:44.530 --> 04:44.730]  Yeah.
[04:44.910 --> 04:52.070]  So, when I was training pen testers, I was always surprised when someone very new to the field could find something that other people couldn't.
[04:52.170 --> 04:54.290]  And that I'd been doing it for, like, 20 years.
[04:54.430 --> 04:57.030]  And they would just come up with something that was so left field.
[04:57.030 --> 05:02.690]  And something I am so scared of happening with AI is that it's derivative by nature.
[05:02.890 --> 05:12.030]  And so, I think it sort of forms pathways of thinking that sort of discourage beginner's mind because it throws so much information at you at once and can do so much.
[05:12.150 --> 05:13.430]  So, that's a concern for me.
[05:13.590 --> 05:23.950]  So, we're going to talk about how do we play with that and sort of embrace the creative uses of AI without the destructive ones while being destructive, while hacking.
[05:24.990 --> 05:30.330]  And the cool thing about beginner's mind is that when you don't know what isn't possible, you can do more.
[05:30.570 --> 05:32.030]  And I've always loved that.
[05:32.170 --> 05:34.190]  And I miss being new to this field so much.
[05:34.270 --> 05:36.210]  So, I try to teach people about it instead.
[05:37.490 --> 05:41.070]  And so, I'm not a cert person.
[05:41.150 --> 05:42.190]  I don't have a lot of certs.
[05:42.270 --> 05:45.250]  I do think that it's in the same vein as AI.
[05:45.450 --> 05:47.610]  Sometimes certs kind of lead you in a linear path.
[05:47.750 --> 05:50.410]  And this is coming from someone with a formal education too.
[05:50.410 --> 06:03.890]  This is... I went to school for computer science where I know that it affected the way that I do my hacking, that my app sec, you know, experience comes from some of my development work and things like that, for better or for worse.
[06:04.010 --> 06:08.870]  So, all I ask is people to be aware of how experience sort of affects your beginner's mind.
[06:09.070 --> 06:12.530]  Especially when you're thinking about thinking when you're prompting an AI.
[06:14.310 --> 06:15.710]  This is not evangelism.
[06:15.850 --> 06:17.170]  I just want to see what it can do.
[06:17.690 --> 06:19.070]  What else goes on here?
[06:19.230 --> 06:20.810]  We're going to talk about tool orchestration.
[06:20.970 --> 06:23.050]  This is not Pentest GPT at all.
[06:24.110 --> 06:32.270]  Pentest GPT is almost more like a checklist of suggestions during a Pentest, which are typically a more rigid methodology list.
[06:32.550 --> 06:34.030]  This is completely different.
[06:34.030 --> 06:36.890]  And this is all from an article I wrote for 2600.
[06:37.050 --> 06:42.830]  So, if you want to see that, that one's in that volume in that article.
[06:45.190 --> 06:46.330]  Oh, let's see.
[06:47.350 --> 06:48.530]  So, some definitions.
[06:48.970 --> 06:55.070]  A trainable system that can emulate human cognition in a way that traditional programming doesn't.
[06:55.230 --> 06:59.250]  That's kind of how I'm using AI here because otherwise it's kind of a marketing term.
[06:59.250 --> 07:00.470]  Honestly, it's pretty vague.
[07:01.010 --> 07:02.530]  So, that's how I use it.
[07:03.010 --> 07:05.690]  And, of course, you hear a lot about this one.
[07:05.810 --> 07:11.210]  The generative models one, which is from a technology that came out in 2017 called Transformers.
[07:11.350 --> 07:12.250]  Which we'll discuss.
[07:12.510 --> 07:13.550]  And why it's special.
[07:13.670 --> 07:19.330]  Why it generates content as opposed to sort of classifying and doing all the typical traditional AI things.
[07:19.570 --> 07:22.670]  Like neural networks do in machine learning.
[07:22.850 --> 07:24.670]  Those things have been around for quite a while.
[07:26.490 --> 07:28.550]  So, how does it do all this stuff?
[07:29.090 --> 07:30.530]  We use it to write emails.
[07:30.530 --> 07:31.930]  We use it to do all these things.
[07:32.570 --> 07:35.650]  Do people regularly use Copilot or ChatGPT?
[07:35.790 --> 07:37.310]  I just want to show of hands real quick.
[07:37.670 --> 07:38.110]  Yeah, okay.
[07:38.310 --> 07:38.410]  Yep.
[07:40.010 --> 07:40.410]  Same.
[07:40.970 --> 07:44.310]  So, I'm kind of wondering, you know, how does it do all this stuff?
[07:44.490 --> 07:49.790]  And there was a great DEF CON workshop about how context works in a transformer.
[07:49.790 --> 07:53.630]  Which is the algorithm inside the T for GPT transformer.
[07:54.230 --> 07:54.330]  Right?
[07:54.610 --> 07:55.810]  So, how does that work?
[07:56.010 --> 07:57.110]  I love this example.
[07:57.310 --> 08:00.910]  So, if you give it something like this in a prompt.
[08:01.090 --> 08:03.410]  And prompt means just the input to the system, as you know.
[08:03.730 --> 08:07.070]  You say, the animal didn't cross the street because it was too tired.
[08:07.470 --> 08:10.050]  As a human, you all know that it means the animal.
[08:10.050 --> 08:11.590]  The street's not tired.
[08:11.890 --> 08:17.530]  Well, it has to look in its vast knowledge of what could statistically be meaning...
[08:18.270 --> 08:20.870]  For what you could statistically be meaning by it.
[08:21.050 --> 08:25.090]  So, it figures out that it is the animal because that's what makes sense.
[08:25.230 --> 08:26.950]  And so, this isn't logic.
[08:27.130 --> 08:27.830]  This is language.
[08:28.110 --> 08:29.690]  It's not always going to be right.
[08:29.690 --> 08:32.150]  It just gives you what sounds like should be right.
[08:33.450 --> 08:36.130]  Fortunately, for hacking, you don't have to be right all the time.
[08:36.290 --> 08:39.610]  You can try 90 things and then the 91st thing works.
[08:39.730 --> 08:41.630]  So, that's why I've been using it so much.
[08:42.530 --> 08:45.690]  And so, this whole idea is called self-attention.
[08:46.050 --> 08:50.610]  And we only recently just got the computational power available to us.
[08:50.730 --> 08:56.310]  Where we could have a system where by the end of the sentence, it is still remembering the beginning of the sentence.
[08:56.490 --> 08:58.350]  So, it's able to create what's called context.
[08:58.350 --> 09:02.830]  So, it has the memory and ability to do that.
[09:03.990 --> 09:08.750]  And so, imagine that this context isn't just one sentence.
[09:08.990 --> 09:10.070]  It's layers of knowledge.
[09:10.250 --> 09:12.330]  It's layers of bits of information.
[09:12.330 --> 09:16.150]  So, big, big knowledge sets can be used here.
[09:16.890 --> 09:20.930]  So, here's an example of ChatGPT sort of applying knowledge set.
[09:21.130 --> 09:28.670]  So, as part of a startup, I was working on code that uses a prompt in the background for essentially automating medical billing and medical coding.
[09:28.890 --> 09:32.070]  These are roles where you need to have a cert usually.
[09:32.290 --> 09:33.310]  There's a handbook involved.
[09:33.410 --> 09:34.150]  There's a bit of training.
[09:34.670 --> 09:37.030]  And that is available to the system.
[09:37.250 --> 09:39.310]  You know, it's something that you could ask it.
[09:39.370 --> 09:42.430]  How do you take these doctor's notes and turn it into an insurance bill?
[09:42.810 --> 09:43.070]  Right?
[09:43.310 --> 09:45.210]  So, it's a fairly complex role.
[09:45.910 --> 09:47.850]  So, it takes two prompts instead of one.
[09:47.850 --> 09:53.170]  And so, I'm using some prompt engineering techniques to say, ask clarifying questions.
[09:53.470 --> 09:59.150]  And without ever actually answering those clarifying questions, it actually leads it down a more correct path.
[09:59.330 --> 09:59.750]  Right?
[09:59.850 --> 10:07.010]  That's kind of a prompt engineering trick is sort of those asking itself to explain step-by-step reasoning and things like that.
[10:07.510 --> 10:10.190]  So, in this window, this is the context window.
[10:10.350 --> 10:11.170]  It is the whole chat.
[10:11.170 --> 10:13.310]  When you start a new chat, it's a new context.
[10:13.690 --> 10:15.770]  So, I use the word context a lot.
[10:15.770 --> 10:17.770]  And it's not a search engine.
[10:17.890 --> 10:20.650]  As you can see, it's dynamically applying knowledge.
[10:20.650 --> 10:20.990]  Right?
[10:21.190 --> 10:29.170]  So, if you throw these prompts into the API I mentioned earlier as part of a Python script, you can just have this run autonomously.
[10:29.390 --> 10:29.470]  Right?
[10:29.690 --> 10:35.250]  So, that's kind of the direction that I see a lot of people using this for.
[10:36.270 --> 10:46.050]  But before we get into the hard stuff, like new things, like zero days, or CVEs, I want to talk about known vulnerabilities and sort of applying that knowledge from a data set.
[10:46.770 --> 10:49.950]  And now I guess this could be all kinds of different knowledge.
[10:50.110 --> 11:03.330]  You know, I know a system like Chat2PT passed the bar exam, which does require you taking a knowledge of law and applying it very well so you can write about it, counting any sort of system that has a lot of rules about something.
[11:03.570 --> 11:05.230]  It's going to be pretty good at applying it.
[11:06.250 --> 11:08.530]  I like to tell people it is not a search engine.
[11:08.710 --> 11:12.250]  There's definitely a tendency for people to treat it like Google.
[11:12.430 --> 11:13.150]  It is not.
[11:13.330 --> 11:29.430]  And so, I refer to this cycle, where it's something where you want to automate a process where you have a tool input, it's applied knowledge, you take the output from that tool, you make a decision about using the next tool, and so on and so forth.
[11:29.710 --> 11:31.730]  I could be talking about anything just there.
[11:31.730 --> 11:35.910]  I could be talking about a PowerPoint presentation, and then an email to the boss, and then et cetera, et cetera.
[11:36.150 --> 11:45.810]  I could be talking about hacking tools, which is what I'll be showing you momentarily, where it's the Nmap output that is now going to go to DurBuster output, or GoBuster, whatever.
[11:46.410 --> 11:51.210]  And so, that's essentially what's called an agent, so it's more an autonomous AI bot.
[11:52.030 --> 11:56.950]  And so, this is what that looks like when you actually do it.
[11:56.950 --> 12:07.090]  But this is a screenshot of my Python for a more generic application of applying a scoring system, or a compliance system.
[12:07.250 --> 12:13.490]  Or it's more like from the defensive space, where this is something more vague that can be applied to a lot of things.
[12:14.030 --> 12:15.830]  I'm going to walk through the different parts of it.
[12:15.830 --> 12:28.970]  So, it's basically building this array that represents the function that you've made, which is, I want it to return a number from one to ten based on this rubric, and then I give it the rubric, and then I give it the information, and it makes a decision.
[12:29.310 --> 12:32.750]  And so, it's able to detect from the input what it needs to do next.
[12:32.970 --> 12:34.710]  And so, again, rinse and repeat.
[12:34.890 --> 12:36.250]  Just do the cycle over and over.
[12:36.470 --> 12:40.270]  And that's the crux of the app, because the rest of it's pretty boilerplate Python.
[12:40.270 --> 12:44.730]  So, it's basically how to automate the prompting.
[12:45.330 --> 12:48.890]  And so, this is called function calling, or tool calling.
[12:49.070 --> 12:50.430]  They might be calling it GPTs now.
[12:50.430 --> 12:51.050]  I'm not sure.
[12:51.350 --> 12:53.190]  But it's in the OpenAI API.
[12:54.050 --> 13:02.110]  And so, any kind of judgment call that has some subjective reasoning, you know, I can imagine this using for medical diagnostics, things like that.
[13:02.550 --> 13:03.970]  It's very powerful.
[13:04.490 --> 13:08.190]  It doesn't really matter what kind of defensive compliance you could be using this for.
[13:08.190 --> 13:11.050]  Or it could be CJIS, or FedRAMP, or what have you.
[13:11.770 --> 13:15.990]  But, I think that I would have loved this around the log4j crisis.
[13:16.390 --> 13:28.750]  Because you remember how hard it was to find the dependencies of dependencies, where it figures out things like, okay, you've got an app that's using an app that has a library that's then using a Java thing that has the logging.
[13:29.110 --> 13:32.830]  That was very hard to figure out where that was.
[13:32.830 --> 13:41.970]  And so, you can see those layers of context, being able to process that and score it and say, alright, or instead of a score, you could say, does it have it or not?
[13:42.070 --> 13:42.970]  Yes or no, right?
[13:43.370 --> 13:44.750]  That would have been super helpful.
[13:46.990 --> 13:53.350]  And sometimes I hook it up to a browser to help with fact-checking, because when I say autonomous, what I really mean is someone's watching it, right?
[13:53.550 --> 13:54.370]  It's very important.
[13:56.330 --> 14:00.250]  So, and using the browser to do fact-checking, either manually or with the system.
[14:01.930 --> 14:07.570]  So, this is a little bit more of that demo, the known vulnerable hacking tool, and some of that orchestration.
[14:07.870 --> 14:20.570]  And so, I'm going to have GPT run a few different scanners and tools, and then instead of me looking at the tool output manually, it's basically like a, you know, a mini pen test GPT.
[14:20.570 --> 14:22.550]  It's going to try to make a decision on the next command.
[14:22.690 --> 14:24.930]  Instead of suggesting the command, it's just going to do it.
[14:25.410 --> 14:32.290]  I do not recommend this in a traditional pen testing environment, because you're very much putting a brick on the gas pedal.
[14:32.790 --> 14:35.610]  Like, there's no way to know what it will run.
[14:35.830 --> 14:38.850]  So, this is a personal R&D project for myself.
[14:39.870 --> 14:41.730]  I'm going to show you just a glimpse of what happened.
[14:42.730 --> 14:45.270]  So, we're going to look at this fake website.
[14:45.510 --> 14:50.150]  All of my real examples are going to be heavily redacted or made fictional like this one.
[14:50.570 --> 14:58.210]  So, just to give you an idea, let's say this bank site is hosting, you know, Tomcat server to host its site.
[14:58.410 --> 15:02.510]  And we're going to make it do something else.
[15:02.770 --> 15:05.910]  So, let's see.
[15:06.530 --> 15:07.250]  So, yeah.
[15:07.490 --> 15:11.770]  So, we're going to automate that run tool interpreted results cycle right now.
[15:12.010 --> 15:14.770]  It's very fast because most of it happens in the background.
[15:14.770 --> 15:16.050]  So, I'll just start the video.
[15:22.110 --> 15:22.650]  All right.
[15:22.850 --> 15:27.910]  So, it looks like halfway through the process, it's seeing some different pages.
[15:27.930 --> 15:30.470]  Perhaps it's run EnMap or something like that.
[15:31.250 --> 15:33.370]  I'm not sure what the output of that tool was.
[15:33.690 --> 15:35.250]  Or which tool that outputs from.
[15:36.050 --> 15:38.750]  So, it's going to find this management page.
[15:38.910 --> 15:39.870]  It's going to do that search.
[15:39.870 --> 15:45.550]  Maybe it's going to go to Daniel Musler's, you know, list of, you know, known default passwords.
[15:45.710 --> 15:46.070]  Find it.
[15:46.230 --> 15:46.710]  Go run it.
[15:46.910 --> 15:48.010]  And there you go.
[15:49.090 --> 15:50.690]  So, that was awfully fast.
[15:50.930 --> 15:54.590]  But that's just a proof of concept to sort of show how that works.
[15:55.530 --> 15:57.370]  Now, that's the boring part of hacking, right?
[15:57.590 --> 16:00.350]  So, that's the thing they don't show you in Hollywood.
[16:00.350 --> 16:04.570]  Or that's not the glamorous thing you think of when you join a red team where you're like, I'm going to get some zero days.
[16:05.230 --> 16:09.430]  That's more of the more tedious processes like this one, which is scan the port.
[16:09.730 --> 16:10.910]  Find some webcams.
[16:11.130 --> 16:13.330]  You got to do the vulnerability check on those.
[16:13.470 --> 16:14.250]  See if it's patched.
[16:14.290 --> 16:15.690]  Or you got to look for default credentials.
[16:15.970 --> 16:17.410]  It's kind of predictable, right?
[16:18.210 --> 16:19.950]  So, it's very similar to that.
[16:20.090 --> 16:26.030]  It's like to try to get away from some of the more boring parts and focus on the zero-day parts.
[16:26.170 --> 16:28.250]  I encourage that automation, right?
[16:28.970 --> 16:33.890]  And so, it's been pretty good, you know?
[16:34.050 --> 16:35.790]  And we already use a lot of tools already.
[16:35.950 --> 16:39.490]  We use, you know, Burp Suite and dynamic scans and things like that.
[16:39.630 --> 16:40.770]  You know, crawling and auditing.
[16:40.890 --> 16:45.970]  It's not that far-fetched to have another automated tool because it's just another automated tool.
[16:46.810 --> 16:51.170]  However, it has given me something important, which is the automating of automation.
[16:51.510 --> 16:54.490]  So, a lot of people know that GPT is very good at coding.
[16:54.490 --> 17:00.810]  And it's also good at sort of helping with brainstorming and finding, like, more original attacks.
[17:01.090 --> 17:04.190]  And so, this is the story about that.
[17:04.750 --> 17:06.630]  So, let's talk about that.
[17:07.830 --> 17:11.930]  So, in this situation, again, very redacted AWeb app.
[17:12.410 --> 17:19.230]  So, you've got this input field where it's got this awfully tempting variable here.
[17:19.230 --> 17:22.430]  It's got something in curly braces that might be something interesting.
[17:23.130 --> 17:25.090]  And that it shouldn't maybe be displaying.
[17:25.330 --> 17:29.850]  And so, I try to go for the remote code execution because I assume that it's doing something.
[17:30.050 --> 17:32.810]  Like, maybe there's template injection or something similar to that.
[17:33.430 --> 17:36.290]  And so, let's go for it.
[17:36.850 --> 17:42.750]  Typically here, I'm going to try to do a bunch of symbols and polyglots and just sort of do a lot of trial and error.
[17:42.930 --> 17:44.630]  Or automate the trial and error.
[17:45.310 --> 17:47.530]  Or run scans again to see what happens.
[17:47.530 --> 17:51.310]  And I'll end up with a list of requirements for what is needed to run.
[17:51.610 --> 17:55.710]  In this scenario, it was building a report file.
[17:55.710 --> 17:58.530]  And so, I was not totally blind.
[17:58.730 --> 18:00.890]  I wouldn't see the error messages coming back.
[18:03.130 --> 18:04.430]  Or most of the error message.
[18:04.550 --> 18:07.210]  But I could see that it looked like a C sharp thing.
[18:07.430 --> 18:09.330]  Just based on my development experience.
[18:09.570 --> 18:10.930]  And so, I knew it had to be C sharp.
[18:11.410 --> 18:16.530]  I noticed that it would break if I didn't put something inside those curly braces that returned an object.
[18:17.090 --> 18:19.650]  I found that I couldn't do curly braces within it.
[18:19.770 --> 18:22.590]  So, I'm trying to write C sharp into this one little variable, right?
[18:22.950 --> 18:24.910]  And I'm finding these limitations as I go.
[18:25.230 --> 18:26.870]  So, it needs to be one line.
[18:26.970 --> 18:28.030]  It can't be concatenating.
[18:28.150 --> 18:31.470]  It can't be anonymous functions or lambdas or things that have these special characters.
[18:31.830 --> 18:37.490]  It's going to have to be a lot of mental gymnastics to build up this special payload so that it will work.
[18:37.490 --> 18:43.730]  And so that I can do a payload that, you know, downloads by nasty malware or whatever.
[18:43.730 --> 18:46.090]  Or starts to do post-exploitation, right?
[18:46.310 --> 18:54.110]  So, all these functions or all these specific requirements are something that took me manually like three days to research.
[18:54.290 --> 18:57.430]  To like sort of figure out what puzzle pieces I could put together.
[18:57.930 --> 19:01.250]  But I'm going to show you how fast the AI was able to do it.
[19:01.250 --> 19:07.870]  And so we're going to take that weird behavior of an error or the report doesn't work anymore and turn it into bad behavior.
[19:07.870 --> 19:12.110]  Which kind of sums up basically anything in hacking, now that I think about it.
[19:14.110 --> 19:19.430]  So, yeah, any error is just an attack that you haven't converted into an exploit yet.
[19:19.690 --> 19:20.830]  That's how I think about it.
[19:22.710 --> 19:27.870]  So, what's funny is when I tried this, I was told it was impossible by the machine.
[19:27.870 --> 19:28.910]  Don't listen to the machine.
[19:30.910 --> 19:34.430]  And also, 3.5 did a really terrible job.
[19:34.450 --> 19:39.550]  It took me like 30 prompts to get a valid line that actually filled those requirements.
[19:39.850 --> 19:41.910]  And so I tried a few different systems.
[19:42.690 --> 19:44.990]  But GPT-4 did it in one shot.
[19:45.190 --> 19:46.710]  You know, it was really cool.
[19:47.210 --> 19:51.930]  And it's good at finding an uncommon way to do something.
[19:51.930 --> 19:56.430]  So, a lot of these payloads, when I'm making zero days, it'll do a counterintuitive thing.
[19:56.610 --> 20:01.330]  And if you think about it, a lot of people who are hacking do the counterintuitive thing, right?
[20:01.470 --> 20:05.090]  So, you're doing that weird behavior in order to meet that goal.
[20:06.030 --> 20:13.210]  And so, if you're playing with this, with the API, think about the temperature setting, which is to say the predictability.
[20:13.210 --> 20:24.910]  So, if everyone's using something to hack in exactly the same way, and they're all using the same system, this system, and they don't play with that temperature setting, you might all get the same answer depending on how you're prompted.
[20:25.190 --> 20:28.070]  Which then you're back in the same boat as like the certs or whatever.
[20:28.330 --> 20:35.810]  So, if you want to hack a little bit differently enough so no one else has seen the zero day before, you've got to consider that.
[20:35.970 --> 20:36.970]  So, just a consideration.
[20:39.110 --> 20:45.930]  So, I think even Bing, actually, in the user interface on the site, has like a balance versus precise versus creative setting.
[20:46.170 --> 20:48.070]  I believe that's temperature in the background.
[20:48.430 --> 20:48.810]  Anyway.
[20:50.150 --> 20:52.990]  So, after all of this, we get some valid payloads.
[20:53.910 --> 20:59.070]  And just keep in mind that this is something that, you know, GPT-4 is available for like 20 bucks a month.
[20:59.410 --> 21:05.890]  And I say that not to sell it to you, I'm not affiliated with OpenAI, but to tell you that it's freely available.
[21:05.890 --> 21:13.070]  It's a very, very powerful thing that was done in, you know, four minutes instead of three days of a professional hacker's time.
[21:14.430 --> 21:15.870]  So, it's a little scary.
[21:16.570 --> 21:19.090]  And we get these two awesome payloads.
[21:19.210 --> 21:23.850]  You know, this is the original CVE that I wrote up before I tried it with the AI.
[21:24.390 --> 21:27.690]  And, of course, you can kind of see, you know, this isn't magic.
[21:27.690 --> 21:32.310]  It's, you know, probably pulling from stack overflow to recombine things in just the right way.
[21:32.750 --> 21:38.710]  And all I could think when I saw this was, I wish that doctors would use this.
[21:38.890 --> 21:43.350]  Like, I wish that diagnoses were done this way.
[21:43.350 --> 21:52.190]  Because if you have ten doctors and only one of them happens to read that rare disease, you know, in some medical journal the night before, they might not catch that rare disease, right?
[21:52.430 --> 21:59.450]  So, having this vast knowledge that you can apply instantly this way, it immediately made me think of the medical field instead of hacking.
[21:59.610 --> 22:01.270]  Because, I mean, that's got its own implications.
[22:01.270 --> 22:04.450]  So, I found it absolutely fascinating.
[22:04.450 --> 22:10.130]  And that was when the disbelief on what it could do kind of disappeared for me because I saw that.
[22:10.390 --> 22:11.950]  Oh, and of course, I got the shell, right?
[22:13.330 --> 22:14.130]  So, woohoo!
[22:15.530 --> 22:21.770]  This one is a kind of a freebie, too, because it was already running as root because of the way I know, right?
[22:22.310 --> 22:30.850]  I didn't have to do any privilege escalation because it was compiling the C sharp in the background, which I believe requires higher privileges, if I can remember.
[22:31.490 --> 22:42.350]  And funny enough, the process that was running off of the app that was doing that, the library, it might have been a library of a library, was running as root.
[22:42.490 --> 22:44.070]  And the application itself was not.
[22:44.250 --> 22:45.330]  So, riddle me that.
[22:45.490 --> 22:46.690]  I don't know how that's possible.
[22:46.690 --> 22:50.150]  But I saw it for myself in the task manager once I got into the machine.
[22:50.390 --> 22:51.790]  So, whoa.
[22:52.950 --> 22:59.330]  And I do an attack chaining talk as well, which I won't go into details here, but I love attack chaining.
[22:59.510 --> 23:07.730]  And so, something that was really important to me is to preserve attack chaining and sort of the creativity that goes into it and not replace that with AI.
[23:08.030 --> 23:11.990]  So, I'm trying to find a good way to get that balance, right?
[23:12.790 --> 23:17.070]  Another way I like to think about this is context for exploits.
[23:17.530 --> 23:19.250]  So, what do I mean by that?
[23:19.370 --> 23:20.670]  Some things aren't super cut and dry.
[23:20.850 --> 23:23.230]  Obviously, popping a shell is pretty cut and dry.
[23:23.230 --> 23:24.790]  You're not supposed to be doing that.
[23:24.930 --> 23:33.490]  But sometimes, there's some business logic limits that are not super obvious and can't be done with a scanner or some traditional sort of scanner.
[23:33.810 --> 23:38.490]  For example, I did bug bounties where I could move items in and out of someone's shopping cart.
[23:39.230 --> 23:47.130]  It's not really obvious that that's not supposed to happen or like kiosk escape or certain user role limits and things like that.
[23:47.330 --> 23:49.030]  Breaking anonymity in a strange way.
[23:49.750 --> 23:55.810]  These aren't necessarily things that you pick up the way you would with other categories of attacks like cross-site scripting and things like that.
[23:56.030 --> 24:03.270]  So, the cool thing about GPT is if you give it the manual for the app that you're trying to hit, you can figure out what you're not supposed to do.
[24:03.270 --> 24:11.810]  And I believe Daniel Meisler did a podcast that there's a small YouTube link at the bottom about this where it's kind of like the hacker to-do list, right?
[24:11.870 --> 24:15.210]  It's telling you all the things you're not supposed to be able to do, and then you go do it.
[24:17.130 --> 24:17.910]  Kind of helpful.
[24:18.170 --> 24:21.270]  So, there's also AI-generated hacking tools.
[24:21.270 --> 24:24.050]  This is another objectively bad thing, cross-site scripting.
[24:24.050 --> 24:38.410]  And so, I'll kind of start with the idea of if I find something kind of unusual, like an unusual type of XSS, can the AI help me automate it and sort of spread it more widely?
[24:38.530 --> 24:40.550]  Because I'm a bug bounty hunter as well.
[24:41.350 --> 24:47.290]  So, in this case, we're going to use the form validation in a field to do an XSS.
[24:47.650 --> 24:50.370]  And spoiler, the answer is yes, it's going to help me out.
[24:50.370 --> 24:54.990]  So, you can kind of see that I'm trying stuff in this email field on this web app.
[24:55.390 --> 24:58.710]  And that's kind of the error that I get.
[24:59.590 --> 25:04.130]  More specifically, the whole web app looks more like this, where it's a contact form.
[25:04.290 --> 25:06.010]  I'm sort of doing the discovery.
[25:06.010 --> 25:12.030]  I'm doing the intel to figure out, okay, the name field, which should be free form, is not allowing cross-site scripting.
[25:12.510 --> 25:13.770]  Okay, neither is the address field.
[25:13.870 --> 25:15.570]  What are the odds that the email field will?
[25:15.750 --> 25:18.030]  Well, it's going to say that's not an email.
[25:18.030 --> 25:25.210]  But as long as I have an email address in the payload, it will launch, right?
[25:25.650 --> 25:27.290]  So, it's kind of a fun little idea, right?
[25:27.430 --> 25:34.690]  And so, I start thinking, can I do something that expands this and sort of abstracts this out for any kind of heavily formatted data field?
[25:34.850 --> 25:40.130]  So, if you have social security number or a phone number or something like that, as long as I have a phone number in it, will it launch?
[25:40.130 --> 25:44.230]  And so, I know from my developer days how much this hurts.
[25:44.830 --> 25:45.270]  Because...
[25:45.270 --> 25:46.990]  If this had been me, right?
[25:47.610 --> 25:54.070]  Because I know that in these fields, they typically have business validation or security validation.
[25:54.070 --> 25:55.970]  And they're not always the same.
[25:56.390 --> 25:57.850]  Usually, they're not both implemented.
[25:58.150 --> 26:01.570]  So, the business logic was there where, yes, it's got to be an email address.
[26:01.790 --> 26:03.070]  The security wasn't there.
[26:03.070 --> 26:05.110]  But in the free form fields, they had the security.
[26:05.810 --> 26:06.810]  And there you go.
[26:07.070 --> 26:08.290]  There's the hole.
[26:09.390 --> 26:12.830]  So, I was thinking, how is the AI going to figure out how to do this?
[26:12.950 --> 26:17.510]  Like, I don't want to offshore too much of my, you know, critical thinking.
[26:17.510 --> 26:20.190]  But I want to see if it can kind of outthink me here.
[26:20.630 --> 26:28.130]  Is it going to just send a polyglot to each field and figure out that there's some kind of form validation expected maybe from the label, perhaps?
[26:28.130 --> 26:30.170]  It knows that there's an email label before it.
[26:30.250 --> 26:31.790]  So, is it going to use that to figure out?
[26:31.790 --> 26:34.570]  Because it has a concept of what an email address looks like, right?
[26:34.670 --> 26:36.410]  And all these different data fields.
[26:36.610 --> 26:39.470]  But no, it actually thought of another solution that I'd never heard of.
[26:39.590 --> 26:40.630]  This is how that happened.
[26:41.670 --> 26:44.910]  So, my prompt is pretty ugly to read aloud.
[26:45.630 --> 26:47.470]  But... or kind of unnatural to say.
[26:47.950 --> 26:49.730]  But the bot liked it because it worked.
[26:50.170 --> 26:55.990]  So, the prompt engineering is sort of the art of being really clear and detailed about what you want it to do.
[26:56.390 --> 27:00.290]  And so, I said, I need a Selenium script that's going to look for these input fields.
[27:00.290 --> 27:04.090]  And then you're going to find one that has, you know, does data format requirements.
[27:04.510 --> 27:08.390]  And, you know, true to the hacker ethos, you're going to use your restrictions to your advantage.
[27:08.390 --> 27:11.370]  And you're going to, you know, use that to build the XSS payload.
[27:12.590 --> 27:14.090]  By the way, bone to pick.
[27:14.090 --> 27:21.490]  I said Selenium script because I get annoyed with dynamic scanners that don't actually run the JavaScript payload.
[27:21.750 --> 27:22.590]  You don't know what I mean?
[27:22.730 --> 27:29.690]  So, they say they find XSS, but it's really just the string is available to the web page.
[27:29.790 --> 27:32.410]  Like, it's able to send it and reflect it, but it doesn't run it.
[27:32.550 --> 27:34.990]  So, Selenium has a JavaScript engine inside it.
[27:35.090 --> 27:40.170]  So, when I do this stuff, I want it to actually validate it for me because that's a lot of false positives, right?
[27:40.170 --> 27:43.090]  So, that's why I designed the prompt that way.
[27:43.990 --> 27:45.330]  And it did a pretty good job.
[27:45.930 --> 27:48.450]  So, and yes, it did its complaint.
[27:49.390 --> 27:52.590]  Yeah, it might be a letter prophecy or content policy.
[27:52.990 --> 27:54.570]  It still does the code, though.
[27:54.710 --> 27:55.550]  It still makes the code.
[27:55.910 --> 27:57.970]  And since then, I've been using a local model.
[27:57.990 --> 28:00.510]  So, the filter bypasses are not an issue anymore.
[28:00.670 --> 28:05.570]  And anyone who's doing hacking, you've got to do locally hosted or some kind of private instance.
[28:05.570 --> 28:08.070]  Or you will get all kinds of content filter issues.
[28:08.630 --> 28:12.350]  So, anyway, let's see.
[28:13.010 --> 28:17.190]  What it ended up doing is it made code that it looks on that HTML page.
[28:17.190 --> 28:19.790]  And it looks for that attribute type in that field.
[28:19.850 --> 28:22.330]  And it uses that to figure out, is it an email?
[28:22.910 --> 28:23.670]  Things like that.
[28:23.930 --> 28:25.230]  I had never heard of that.
[28:25.270 --> 28:26.170]  I thought that was kind of cool.
[28:26.770 --> 28:29.250]  So, what I would do here is kind of rinse and repeat.
[28:29.470 --> 28:33.730]  And sort of keep building up the script with different types of, you know, formats.
[28:33.730 --> 28:37.070]  Or maybe even have it completely rewrite it if there's another idea.
[28:37.210 --> 28:39.690]  And just sort of almost brainstorm along with it.
[28:39.950 --> 28:41.610]  Based on what it's churning out.
[28:41.770 --> 28:45.950]  And so, I'm kind of learning as I'm working with the AI.
[28:46.570 --> 28:48.470]  Not to answer for morphize it or anything.
[28:48.710 --> 28:52.190]  But it's really kind of creepy to say it's a partnership.
[28:52.430 --> 28:53.670]  But it kind of is sometimes.
[28:55.130 --> 28:57.310]  Because it's just like a brainstorming tool to me.
[28:57.450 --> 28:58.590]  So, it can feel like that.
[28:59.750 --> 29:01.290]  So, yeah.
[29:01.430 --> 29:02.830]  It ends up working pretty well.
[29:03.050 --> 29:05.390]  This is what it ended up outputting for a payload.
[29:05.910 --> 29:07.670]  And while that's super counter-intuitive.
[29:07.850 --> 29:09.830]  Like, I would never write an XSS that way.
[29:09.950 --> 29:11.910]  It's in a bizarre order.
[29:12.750 --> 29:14.350]  It just put the email first.
[29:14.510 --> 29:16.150]  And then it tacked on the XSS.
[29:16.370 --> 29:17.530]  But it did work.
[29:17.530 --> 29:18.430]  Which was kind of cool.
[29:19.050 --> 29:20.550]  And so, I don't know.
[29:21.310 --> 29:24.410]  And, you know, hacking is just all about...
[29:24.410 --> 29:24.970]  Yeah, that's weird.
[29:24.970 --> 29:25.530]  But it worked.
[29:25.850 --> 29:28.150]  So, fine.
[29:28.670 --> 29:32.810]  And so, I noticed a lot of, you know, people...
[29:32.810 --> 29:36.070]  When you publish your exploits, you might try to put a deliberate bug.
[29:36.070 --> 29:37.810]  Or make something look kind of weird on purpose.
[29:37.950 --> 29:41.110]  To sort of gatekeep people who might run a dangerous exploit.
[29:41.570 --> 29:41.770]  Right?
[29:41.910 --> 29:45.470]  Because you don't want just some 12-year-old to just run something nasty.
[29:47.070 --> 29:48.690]  And I don't think that'll work anymore.
[29:48.690 --> 29:50.630]  Because you can give it to the bot.
[29:50.710 --> 29:51.510]  And it will fix it.
[29:51.610 --> 29:52.330]  And it'll look weird.
[29:52.390 --> 29:53.970]  But it'll fix the syntax errors.
[29:54.450 --> 29:54.850]  Like...
[29:54.850 --> 29:56.650]  So, that's a whole different attack surface.
[29:56.810 --> 29:57.450]  Whole different talk.
[29:57.670 --> 29:58.690]  But, yeah.
[29:59.450 --> 30:02.130]  So, we can kind of see this is a combination of AI and human.
[30:02.270 --> 30:04.130]  And that's really important to remember.
[30:04.390 --> 30:07.310]  That the human is a critical part of the hacking process.
[30:07.330 --> 30:08.450]  No matter what they say.
[30:08.610 --> 30:11.310]  I mean, with generative AI or general AI.
[30:11.310 --> 30:12.890]  I mean, unless it's super intelligent.
[30:13.150 --> 30:18.310]  I think humans and AI together are such a powerful force.
[30:18.570 --> 30:21.190]  Versus just human or just AI at this point.
[30:22.050 --> 30:22.910]  And here's another example.
[30:23.130 --> 30:24.990]  So, SQL injection bypass.
[30:25.490 --> 30:28.850]  So, here's another way to kind of think through that process.
[30:29.010 --> 30:31.570]  Another real-life situation that's been redacted.
[30:31.570 --> 30:35.570]  So, a very persistent attacker will try to bypass your WAF.
[30:36.270 --> 30:37.750]  Or your URL filters.
[30:37.930 --> 30:38.790]  Or whatever you're using.
[30:39.170 --> 30:41.110]  By WAF, I mean web application firewall.
[30:41.330 --> 30:44.210]  Anything with rules to try to keep your SQL injection out.
[30:45.490 --> 30:47.830]  So, I came across something like that.
[30:47.970 --> 30:50.810]  I was on this site where I had SQL injection in the URL.
[30:51.070 --> 30:53.030]  And I was doing some pretty typical stuff.
[30:53.170 --> 30:53.750]  SQL map.
[30:53.910 --> 30:54.470]  Things like that.
[30:54.930 --> 30:57.410]  And I got the sense that, you know.
[30:57.530 --> 30:59.570]  Because it was an error-based SQL.
[31:03.790 --> 31:04.470]  SQL injection.
[31:04.630 --> 31:09.830]  I might be able to use it to pull these individual records from the user and passwords table.
[31:10.210 --> 31:12.430]  And so, I was getting blocked a lot.
[31:12.630 --> 31:16.030]  Like, it wasn't actually able to display the important data.
[31:16.230 --> 31:17.070]  But I knew it was juicy.
[31:17.150 --> 31:18.410]  I knew there was something going on.
[31:18.590 --> 31:23.370]  And so, I spent a whole day looking at the SQL manual for this particular SQL language.
[31:23.490 --> 31:27.610]  To try to find an obscure way to iterate through each record.
[31:27.610 --> 31:29.690]  Because it wasn't allowing me select or where.
[31:29.970 --> 31:31.270]  Or certain things.
[31:31.830 --> 31:33.510]  And so, I found lead and lag.
[31:33.650 --> 31:35.490]  Which I'd never used in my developer days.
[31:35.750 --> 31:37.550]  And it actually ended up working.
[31:37.770 --> 31:41.790]  I was able to dump the GUIDs for the users and the passwords.
[31:42.590 --> 31:45.010]  And continue on with my exploits.
[31:45.450 --> 31:47.530]  So, what does this tell me?
[31:47.690 --> 31:48.990]  Alright, that's a lot of research time.
[31:49.090 --> 31:49.790]  That's a whole day.
[31:49.790 --> 31:53.290]  Me trying to find just the right obscure thing.
[31:54.690 --> 31:56.790]  But what if I had done it in 2024?
[31:57.410 --> 32:00.430]  I'd say, hey, ChatGPT body.
[32:00.910 --> 32:04.610]  I need SQL commands that don't involve a where.
[32:04.870 --> 32:08.170]  Or I can, you know, use a cursor or something.
[32:08.310 --> 32:10.390]  I got to get through all these records in a weird way.
[32:10.550 --> 32:11.210]  Help me out.
[32:11.270 --> 32:13.670]  And it lists like 10 different ways to do it in 10 seconds.
[32:14.850 --> 32:20.150]  So, and if I'd use Google to do that, you know, I might have gotten sites about SQL commands.
[32:20.150 --> 32:22.570]  I would have been basically reading the manual again, right?
[32:22.670 --> 32:28.590]  So, applying that knowledge set is again kind of the value of this system for me.
[32:28.990 --> 32:30.770]  That would have been a much quicker hack.
[32:31.430 --> 32:36.430]  So, this is a more old school attack for optical character recognition for CAPTCHA bypass.
[32:37.150 --> 32:38.950]  I am not the expert of CAPTCHA bypass.
[32:38.950 --> 32:43.930]  I saw amazing things at Defcon where they did all different types of CAPTCHA bypass.
[32:44.150 --> 32:47.170]  There was image matching and all kinds of sophisticated things.
[32:47.590 --> 32:50.970]  Audio, I think at one point they were able to do a bypass.
[32:51.930 --> 32:56.430]  But this is going to be using the Tesseract library, which I think is old enough to drink.
[32:56.990 --> 33:01.570]  Like, I'm pretty sure it's... it was open-source in like 2008.
[33:01.970 --> 33:06.430]  So, anyway, another web app that's very generic.
[33:06.430 --> 33:10.610]  So, we've got this CAPTCHA that we're going to have to read and interpret.
[33:10.850 --> 33:23.790]  And as with every attack with a lot of my web app research and getting the site to do extra new features for free, I usually have to look at the traffic between the client and the server.
[33:24.050 --> 33:25.530]  So, that's what happens here.
[33:25.690 --> 33:28.790]  I see that there's a guest going over the wire from the user field.
[33:28.790 --> 33:34.830]  And then there's some kind of URL with what looks like some kind of identifying JPEG where they host the CAPTCHA.
[33:34.910 --> 33:40.210]  And there doesn't seem to be a direct relation between the number in the JPEG and the number in the CAPTCHA.
[33:41.410 --> 33:42.550]  I tried that too.
[33:42.650 --> 33:44.470]  I was looking maybe there was some algorithm or something.
[33:45.470 --> 33:47.570]  So, what is sent to the server here?
[33:48.230 --> 33:51.470]  I'm going to use burp suite or any interception proxy to see.
[33:51.470 --> 33:56.430]  We know that we've got that user-provided guess and we also mentioned the URL of that image.
[33:56.510 --> 33:58.190]  But we also have the CSERF.
[33:58.630 --> 34:00.130]  I'm going to call it anti-CSERF.
[34:00.150 --> 34:04.590]  It always annoys me when people say CSERF token because it's to prevent CSERF.
[34:05.130 --> 34:08.470]  Which is to say cross-site request forgery.
[34:08.670 --> 34:23.510]  If you're not familiar, it is when you may have your bank open up in one tab in the browser and the malicious sites open in another tab and you're doing some kind of transaction but the malicious site is performing actions on your behalf to your banking site.
[34:23.670 --> 34:25.610]  Maybe with JavaScript or something like that.
[34:26.010 --> 34:35.130]  And so what the CSERF token, anti-CSERF token does, is it gives you an ID that sort of formalizes that this came from this form at this time.
[34:35.530 --> 34:38.850]  And that's a little bit how it works to sort of ID that request.
[34:39.090 --> 34:41.410]  And so we're going to have to do a bypass on that too.
[34:41.410 --> 34:49.250]  Because we want to automate this login, this captcha, because we want to password spray or continue with other attacks.
[34:49.530 --> 34:52.330]  So we're going to have to pretend to not be a bot.
[34:52.330 --> 34:53.310]  And obviously we're a bot.
[34:54.990 --> 35:01.530]  So this script is going to do that image request, pass it to the OCR program.
[35:01.810 --> 35:04.610]  Again, a case where you've got to use AI for that.
[35:04.810 --> 35:07.830]  There's really no other way to have it read an image, right?
[35:08.350 --> 35:21.510]  And so then at the same time, we're kind of chaining that exploit to the CSERF bypass request script, which is making that call up to the API that gives you the CSERF token, if I recall, and sort of does it all at once.
[35:21.730 --> 35:24.790]  And this is a complicated example because it's a real example.
[35:25.550 --> 35:27.230]  But it does end up working.
[35:28.030 --> 35:32.690]  So it's a little bit simplified, but that's kind of how that works.
[35:32.690 --> 35:38.030]  And yeah, it's been kind of a ride learning about this stuff.
[35:38.470 --> 35:43.190]  But one of the more scary parts was, all right, this works.
[35:43.590 --> 35:48.570]  So future Turing tests, why is it so good at the things that it does?
[35:50.190 --> 35:51.390]  This happened recently.
[35:51.390 --> 35:52.910]  This is kind of a funny white paper.
[35:53.270 --> 35:58.930]  Basically, a bunch of AI folks went to AI conferences and then wrote the reviews of the conference with AI.
[35:59.930 --> 36:00.950]  How do we know that?
[36:01.090 --> 36:05.650]  Because statistically, all of a sudden, these six words were very popular.
[36:07.590 --> 36:09.230]  Good old-fashioned statistics, right?
[36:09.350 --> 36:13.750]  So we've got all these really sophisticated, you know, LLM-based detectors and things like that.
[36:14.030 --> 36:16.790]  And yet, statistics helps you out.
[36:16.930 --> 36:20.910]  Can, you know, teachers use this to figure out if students are cheating?
[36:21.130 --> 36:22.290]  Well, they'd have to band together.
[36:22.290 --> 36:27.330]  We'd have to use all different, you know, schools' data to get enough data to do this.
[36:27.330 --> 36:28.530]  But I think it's a good start.
[36:29.350 --> 36:36.690]  And so, another really funny one is, you can tell if it's made by an AI, if it starts with, as an AI language model, right?
[36:39.330 --> 36:42.390]  I think there was, someone sent me a screenshot.
[36:42.590 --> 36:50.410]  I don't know if it was, I think it was Amazon or something, some other online store where all the products started with as an AI language model.
[36:50.410 --> 36:51.510]  So, yeah, okay.
[36:52.550 --> 37:03.410]  But then, more subtly, you know, there's finding weaknesses in the individual LLM strengths and sort of exploiting those weaknesses to figure out which LLM.
[37:03.510 --> 37:06.270]  And then, in that sense, you figure out that it is an LLM.
[37:06.490 --> 37:10.050]  So I spent a lot of time kind of geeking out reading these white papers.
[37:10.230 --> 37:11.830]  And what this is is called a benchmark.
[37:12.570 --> 37:21.910]  When you want to interpret a table like this, this benchmark table, each of those at the top are different types of, well, they're different types of benchmarks.
[37:22.070 --> 37:26.310]  And you can think of it like a rubric for how good it is at something.
[37:26.490 --> 37:29.770]  Like, BoolQ is, is the LLM good at answering yes or no questions?
[37:29.970 --> 37:37.910]  Which probably sounds simple, but if you say something like, was there a earthquake in India in 2008?
[37:38.730 --> 37:43.350]  That's kind of a lot of information to sort of make sure is correct and sort of be able to say yes or no.
[37:44.650 --> 37:46.050]  PIQA is physical intelligence.
[37:46.050 --> 37:49.470]  So, I'm going to show you an example of me trying to trick it with that.
[37:50.030 --> 37:52.690]  And, of course, hella swag, which...
[37:53.610 --> 37:54.510]  That one's harder.
[37:54.710 --> 38:00.650]  That stands for harder endings, longer context, and low-shot activities for situations with adversarial generation.
[38:02.410 --> 38:04.390]  That's a little forced to me, but it is a cool name.
[38:04.730 --> 38:09.390]  So, it just means common sense sentence completion without injecting information.
[38:09.530 --> 38:13.150]  So, can it complete a sentence without totally making stuff up?
[38:13.430 --> 38:14.170]  That's kind of the idea.
[38:14.790 --> 38:17.590]  So, and it looks a lot like a child's report card, right?
[38:17.650 --> 38:19.210]  Like, some of these are good at math.
[38:19.390 --> 38:21.490]  Some of them are not so good at coding.
[38:21.910 --> 38:23.010]  You know, you could add multilingual.
[38:23.470 --> 38:24.890]  Almost none of them are good at multilingual.
[38:25.450 --> 38:26.310]  It's not interesting.
[38:26.590 --> 38:27.890]  A lot of them are English-based.
[38:28.030 --> 38:29.410]  That is quite the statement.
[38:29.410 --> 38:30.970]  But, yeah.
[38:32.190 --> 38:37.550]  So, the idea here is you look at the system and what it's supposed to be able to do, and then you see what it's bad at.
[38:37.970 --> 38:44.110]  Here, you know, an image generator AI is going to have a hard time putting the word Greg on a shirt.
[38:46.370 --> 38:49.330]  So, PIQA, if I give it this puzzle, it failed.
[38:49.530 --> 38:51.150]  You know, this was last year.
[38:51.190 --> 38:54.130]  I don't know if it'll still fail, because obviously it's been trained on this now.
[38:54.130 --> 38:58.830]  But it basically said, you know, I'm going to bury coconuts above and below ground.
[38:59.050 --> 39:00.330]  X number of coconuts appear.
[39:00.870 --> 39:02.610]  Y underneath the sand.
[39:04.190 --> 39:05.430]  Well, it failed.
[39:05.530 --> 39:06.610]  It doesn't know how to do that.
[39:06.750 --> 39:09.570]  It doesn't know what underground means and how to count.
[39:09.810 --> 39:11.030]  It's very bad with encoding.
[39:11.030 --> 39:13.350]  If you say, give me three things, it might give you ten.
[39:13.670 --> 39:14.790]  You know, things like that.
[39:14.790 --> 39:17.550]  Again, it's predictive language and not logic.
[39:17.790 --> 39:18.490]  It's different.
[39:19.490 --> 39:23.310]  And very much all of this is in the PhD space, Turing tests.
[39:23.710 --> 39:26.470]  You know, it's just a lot of new stuff.
[39:26.650 --> 39:29.270]  And, of course, there's attacks on AI systems as well.
[39:29.730 --> 39:31.450]  This is a prompt injection attack.
[39:31.570 --> 39:37.570]  I love this because it's a combination of web app attack and a prompt attack.
[39:37.570 --> 39:40.370]  So, this person tried to do a local file include.
[39:40.670 --> 39:43.450]  And they were trying to pull that /etc/passwd file to get the passwords.
[39:43.690 --> 39:44.810]  And it said, no.
[39:45.290 --> 39:46.650]  And then they said, please.
[39:46.870 --> 39:47.390]  And then it worked.
[39:56.730 --> 39:58.510]  I can't even make this stuff up.
[39:58.650 --> 39:59.990]  Like, this is the future we're living in.
[40:02.590 --> 40:03.970]  So, this is Boxcar.
[40:04.110 --> 40:09.350]  It was very similar to ChatGPT where it takes chats and you can chat with it.
[40:09.350 --> 40:11.750]  Or you can hack it or tell it to hack itself.
[40:12.810 --> 40:13.110]  All right.
[40:13.330 --> 40:17.450]  So, that's from Google Red Team's list of attacks on AI systems.
[40:17.630 --> 40:18.870]  It had this really good list.
[40:18.890 --> 40:20.730]  Like, six different ways you can hack an AI.
[40:21.010 --> 40:23.470]  And so, I'm trying to put some examples to each of those.
[40:24.170 --> 40:25.410]  And this is one of them.
[40:25.490 --> 40:26.390]  Training data extraction.
[40:26.630 --> 40:28.070]  There's a contest out there.
[40:28.350 --> 40:33.570]  If the AI is told to keep a secret, can you get the secret out in as few characters as possible?
[40:33.910 --> 40:34.470]  Kind of cool.
[40:34.610 --> 40:37.050]  But imagine it's your training data and it's kind of sensitive.
[40:37.210 --> 40:38.550]  You need to keep it to yourself.
[40:39.070 --> 40:41.130]  So, that would work in a real system too.
[40:42.010 --> 40:47.830]  And so, if you are working with models and you're downloading things, know that it's like anything else.
[40:47.950 --> 40:49.410]  You know, it can have malware in it.
[40:49.790 --> 40:50.770]  Just like anything.
[40:51.110 --> 40:55.550]  You know, there was something at Defcon where someone's model was backdoored.
[40:55.550 --> 41:06.430]  I think it was an H5 format file where you could actually put, by design, an executable library, right?
[41:06.610 --> 41:11.250]  So, if you're using a curious library and you're using layers in your neural network, one of the layers can be executable.
[41:11.490 --> 41:13.570]  And so, there you go.
[41:13.570 --> 41:15.270]  So, you can put something bad in there.
[41:16.410 --> 41:18.010]  And so, data poisoning...
[41:19.210 --> 41:24.450]  I mean, you can look at it like an antivirus can be poisoned to think something malicious is fine.
[41:24.570 --> 41:28.510]  So, if you train that, you can get your malware through that sort of thing.
[41:29.990 --> 41:31.530]  This is a cool one visually.
[41:31.890 --> 41:40.110]  So, adversarial injection where you can train the classifier based on just weird pixel configurations in an image classifier.
[41:40.310 --> 41:49.850]  I think MIT did this a few years ago, quite a while ago, where that turtle, because of the pattern on its back, it actually looks like a rifle to the system.
[41:49.850 --> 41:51.030]  So, it's classified as a rifle.
[41:52.370 --> 41:53.170]  I know.
[41:53.170 --> 41:59.510]  And so, the love stop hate sign, you know, this is actually...
[41:59.510 --> 42:08.170]  There's something about the combination of pixels where the image classifier thinks it's a speed limit sign, which is close to my heart because sometimes I'm in self-driving cars, right?
[42:08.930 --> 42:11.130]  So, you kind of see how that's crazy.
[42:11.570 --> 42:14.310]  But there's other types of adversarial injection.
[42:14.450 --> 42:18.090]  And this is debatable on how you want to categorize this one.
[42:18.150 --> 42:21.210]  But this is something I actually did myself from my own research.
[42:22.790 --> 42:26.090]  So, this is an attack on a search engine, right?
[42:26.750 --> 42:30.250]  So, basically, this isn't Google.
[42:30.770 --> 42:32.150]  Once again, this is redacted.
[42:32.290 --> 42:40.710]  So, this is a very similar system to a Google or Bing or something, where it will return relevant scores based on what's clicked on the most.
[42:40.870 --> 42:42.630]  And so, I was just looking for passwords.
[42:42.770 --> 42:45.330]  I was looking for plain text things, things that said password.
[42:46.030 --> 42:51.490]  I would go to the site and, lo and behold, if it has passwords out, there's other things that it tends to be vulnerable to.
[42:52.150 --> 42:57.690]  And typically, that's what happens with hacking, is if there's a few things, there's really a lot of things wrong.
[42:57.990 --> 43:02.890]  So, I went to the site, I would hack it, and I would come back, and then I would move on to the next one.
[43:03.590 --> 43:08.930]  And what I was noticing is that, over time, it was actually giving me more and more vulnerable sites.
[43:09.510 --> 43:14.470]  And so, I would get more sites that were easier to hack for me.
[43:14.470 --> 43:16.090]  Now, was I getting better at hacking?
[43:16.470 --> 43:16.790]  Maybe.
[43:17.010 --> 43:24.210]  But I also had a strong suspicion that it was returning the type of site that was easier to hack in general, or at least the way that I was doing it.
[43:24.410 --> 43:29.370]  And so, I'm doing some guesswork here because it's a proprietary system.
[43:29.490 --> 43:31.050]  It's a black box.
[43:31.730 --> 43:33.770]  You know, I can't see the inner workings.
[43:33.830 --> 43:35.230]  So, how do I prove that?
[43:35.670 --> 43:36.830]  I asked their support.
[43:37.710 --> 43:42.770]  I went on their support forums, and I said, if I keep clicking this, is this going to increase the score for this?
[43:42.770 --> 43:43.970]  And they said yes.
[43:44.670 --> 43:46.450]  So, this isn't a patch, right?
[43:46.530 --> 43:48.230]  This is something that's going to be patched ever.
[43:48.450 --> 43:50.210]  You know, it's just the way the system works.
[43:50.370 --> 43:57.230]  Again, this is a system where it is accepting goals from the user, and it's important to remember that every AI is like that.
[43:57.410 --> 43:58.150]  It accepts goals.
[43:58.350 --> 44:02.030]  That's... the flexibility is the power and the vulnerability.
[44:03.690 --> 44:07.190]  And so, there's another type of attack, an exfiltration attack.
[44:07.470 --> 44:16.850]  Again, not too far removed from a traditional attack, where if you have a file that's got binary data in it, but there's some that's plain text, you can go look for passwords and sensitive stuff.
[44:17.050 --> 44:18.410]  Same thing with a model file.
[44:18.570 --> 44:19.490]  It's just another binary.
[44:22.170 --> 44:26.410]  You don't have to have direct access to the model to do these kind of attacks.
[44:26.630 --> 44:28.510]  I know there was an awesome talk yesterday by Suha.
[44:28.730 --> 44:31.110]  She did a whole...
[44:31.810 --> 44:37.290]  There's a whole smorgasbord of awesome model attacks, and it gets very technical in the infrastructure of the ML.
[44:38.030 --> 44:39.770]  This is not as sophisticated.
[44:40.070 --> 44:41.790]  This is actually just a web app attack.
[44:41.990 --> 44:44.730]  It's this web cache detection that this researcher did.
[44:44.870 --> 44:57.110]  And so, be careful what you put into the system, because if your billing history and your chat history is exposed, that may be sensitive and it may be part of an attack.
[44:57.110 --> 44:58.830]  It may be able to be exfiltrated.
[45:01.590 --> 45:04.850]  All right, so I hope you guys learned a little bit about...
[45:04.850 --> 45:07.210]  You know, you can kind of be creative about AI usage.
[45:07.390 --> 45:09.050]  It's not all dystopia.
[45:09.170 --> 45:10.210]  Sometimes it's kind of cool.
[45:10.910 --> 45:19.290]  But also save your tokens or GPUs for stuff that really needs AI, because it is an expensive machine, and there's usually other ways to do things.
[45:20.110 --> 45:23.810]  So it's really just another hacking tool in my point of view.
[45:24.170 --> 45:32.390]  And just from an educational standpoint, the most important thing is to sort of preserve the diversity of thought.
[45:32.590 --> 45:39.370]  And that's basically to say, just like with any YouTube algorithm or something else, it's kind of putting you into an echo chamber.
[45:40.510 --> 45:45.990]  There was actually an awesome talk, actually, with speakers here talking about echo chambers and AI this morning.
[45:46.050 --> 45:53.250]  And I do fear that it is possible to lose the diversity of thought if everyone's using the AI the same way.
[45:53.430 --> 45:55.050]  So creativity is still important.
[45:55.050 --> 46:00.010]  And so definitely encourage, you know, unique perspectives come from unique paths, right?
[46:00.130 --> 46:02.430]  So, you know, work with diverse people.
[46:02.770 --> 46:08.190]  And, you know, it's important because you'll miss out if you don't have those ideas and weird ways of doing things.
[46:09.150 --> 46:11.110]  Well, I'm reachable on Discord.
[46:11.350 --> 46:12.750]  Probably most active on Discord.
[46:14.030 --> 46:17.690]  The platform which shall not be named, I don't know, however you want to call it.
[46:19.350 --> 46:23.990]  Maine 2600 has been inactive for the past year, but I am planning on starting it again.
[46:24.470 --> 46:28.090]  And I do blog everything here, and, of course, visit at DEFCON.
[46:28.430 --> 46:30.310]  So that's it.
[46:30.350 --> 46:30.710]  That's it.
[46:30.750 --> 46:31.150]  How's that?
[46:31.390 --> 46:32.110]  Thank you, guys.
[46:40.080 --> 46:40.740]  All right.
[46:40.920 --> 46:41.860]  We've got some spicy questions.
[46:42.220 --> 46:42.800]  Front row.
[46:42.940 --> 46:42.980]  Yeah.
[46:43.540 --> 46:44.220]  Great talk.
[46:44.600 --> 46:48.940]  Kind of a boring question, but I'm just curious, what local model are you using?
[46:49.440 --> 46:50.280]  All different types.
[46:50.540 --> 46:50.760]  Depends.
[46:52.560 --> 46:53.440]  Repeat the question.
[46:53.440 --> 46:54.220]  Repeat the question.
[46:54.340 --> 46:54.560]  Oh, of course.
[46:54.740 --> 46:54.860]  Yes.
[46:55.040 --> 46:56.540]  What local models am I using?
[46:56.860 --> 47:00.540]  So some of them that I can afford to run locally would be Mistral.
[47:00.540 --> 47:00.560]  Mistral.
[47:00.680 --> 47:02.820]  I can't afford to run GPT-4 locally.
[47:03.080 --> 47:07.180]  I would pay for Azure and things like that for something more sophisticated.
[47:07.860 --> 47:10.620]  But yeah, Mistral is not as good at coding as GPT-4.
[47:10.780 --> 47:12.660]  So I lean towards private hosted instances.
[47:13.940 --> 47:24.100]  And fun fact, you can petition Microsoft to turn off the filters if you need something adult or you need to include violence for whatever reason.
[47:24.820 --> 47:28.020]  However, it still has a hard time with hacking questions.
[47:28.020 --> 47:33.280]  So I still have to kind of layer and lead the question and use some prompt engineering techniques to do hacking.
[47:33.800 --> 47:35.460]  But it is super effective.
[47:36.420 --> 47:36.820]  Question?
[47:37.420 --> 47:38.080]  How do you...
[47:38.080 --> 47:40.680]  Do you have any comments related to non-determinism?
[47:40.840 --> 47:45.240]  And just like, okay, you run it once, you get one answer, you run it again, you get another answer?
[47:45.380 --> 47:46.800]  That bothers me as a computer scientist.
[47:47.100 --> 47:48.080]  Oh, gosh, yeah.
[47:48.900 --> 47:52.180]  So the question's about consistency and non-determinism and the responses.
[47:54.380 --> 47:56.180]  So that's a really good question.
[47:56.200 --> 48:01.660]  And that's actually part of the value, is that I do get a different answer each time if it's not working right.
[48:01.840 --> 48:05.440]  Like, so for 3.5, I needed 30 different tries to get that zero-day.
[48:07.560 --> 48:18.120]  But I will say, with function tooling, we don't know how OpenAI's GPT-4 works under the hood, but it does seem to be more consistent.
[48:19.340 --> 48:20.220]  Let me see.
[48:21.500 --> 48:24.100]  I'm trying to think of a way to...
[48:24.760 --> 48:25.820]  Maybe a follow-up.
[48:26.000 --> 48:30.140]  How do you know it's your tool that's not working versus you just didn't get lucky that time?
[48:30.780 --> 48:31.220]  Right.
[48:31.500 --> 48:32.320]  No, that's a good question.
[48:32.480 --> 48:34.220]  And that's why monitoring is important.
[48:34.340 --> 48:35.500]  That's why RAG is important.
[48:35.500 --> 48:40.480]  So if you need to train it on your data, you can do that with the API.
[48:42.140 --> 48:43.740]  But yeah, sometimes it'll vary.
[48:43.900 --> 48:46.440]  And so sometimes it's better for strictly subjective things.
[48:46.440 --> 48:53.320]  Where you mentioned computer science, I mean, you know how with a script, you can write it a few different ways and it's still good.
[48:54.000 --> 48:56.440]  That's kind of the problem I solve with this stuff.
[48:56.480 --> 48:59.260]  I don't try to do something where it has to be a specific answer.
[48:59.820 --> 49:07.720]  And when it comes to compliance, thankfully, the compliance or legal jargon or whatever it is, is so carefully framed that it becomes more consistent.
[49:08.000 --> 49:12.680]  So then it becomes a prompt engineering problem instead of a framework problem, if that makes sense.
[49:13.160 --> 49:13.380]  Yeah.
[49:13.380 --> 49:13.400]  Yeah.
[49:13.820 --> 49:15.640]  To be determined though, I could be wrong.
[49:16.640 --> 49:17.380]  Is there a...
[49:18.040 --> 49:18.440]  Oh, yeah.
[49:18.920 --> 49:19.160]  Yeah.
[49:19.380 --> 49:24.500]  You mentioned Daniel Muser a couple of times with his fabric project.
[49:25.000 --> 49:25.260]  What?
[49:25.480 --> 49:27.620]  Am I familiar with Daniel Muser's fabric project?
[49:28.480 --> 49:29.040]  No.
[49:29.040 --> 49:29.900]  Okay.
[49:30.160 --> 49:31.180]  So you have the project that
[49:36.000 --> 49:39.280]  makes them available as patents so the prompt becomes a patent.
[49:39.660 --> 49:40.780]  Oh, yes.
[49:40.780 --> 49:42.740]  And now you can run these things locally.
[49:43.460 --> 49:51.640]  You can download fabric running locally and the last revision he did, the last update he did, he created a context file.
[49:51.780 --> 49:55.880]  So now it's really easy to dump your context specifically in there.
[49:56.220 --> 49:57.620]  It's a context markdown file.
[49:58.040 --> 49:58.980]  Oh, thank you.
[50:01.180 --> 50:01.820]  That's cool.
[50:01.820 --> 50:01.900]  Cool.
[50:05.700 --> 50:06.660]  All right.
[50:07.240 --> 50:12.480]  So from the audience, there was a mention of Daniel Muser's prompt library called fabric.
[50:12.780 --> 50:17.800]  So if you need to use some of these patterns for hacking, definitely check that out.
[50:17.900 --> 50:18.240]  Thank you.
[50:19.160 --> 50:27.200]  How useful is a locally hosted LLM like LLAMA for doing sandbox sort of experimentation like this?
[50:27.560 --> 50:28.000]  Yeah.
[50:28.240 --> 50:32.780]  So I mentioned earlier, Mistral wasn't as good at coding and same goes for hacking.
[50:33.800 --> 50:36.460]  Most of the time I've been doing GPT-4.
[50:36.940 --> 50:37.160]  Yeah.
[50:37.320 --> 50:38.920]  I think there's something about it.
[50:39.040 --> 50:45.220]  Like there's guesses on how it works because it's a black box where there's a theory and that this may be totally wrong.
[50:45.360 --> 50:51.160]  This is just an idea of how it might be working that it's really like four 3.5 models under the hood voting with each other.
[50:52.160 --> 50:53.100]  I don't know.
[50:53.540 --> 50:54.960]  Please don't sue me, OpenAI.
[50:56.160 --> 51:01.760]  So it's just that the answers are more consistent as we've previously mentioned.
[51:01.760 --> 51:10.520]  And so that was a response to how useful are locally hosted GPT models or at LLMs.
[51:11.140 --> 51:11.500]  And yeah.
[51:11.900 --> 51:12.180]  Oh, yeah.
[51:12.400 --> 51:13.900]  Can I have this question?
[51:14.180 --> 51:14.500]  Yeah.
[51:14.560 --> 51:17.060]  If you run LAMA, you can actually run Mistral.
[51:17.240 --> 51:19.140]  You can run GPT 3.5.
[51:19.540 --> 51:21.860]  And there's at least two or three others you can run.
[51:22.040 --> 51:23.540]  So I use Mistral myself.
[51:23.760 --> 51:24.180]  Oh, cool.
[51:24.180 --> 51:26.540]  3.5 is absolutely relevant.
[51:26.740 --> 51:27.960]  So you can play around with it.
[51:28.220 --> 51:30.340]  You change the model when you're actually prompting.
[51:30.800 --> 51:31.500]  Thank you.
[51:31.980 --> 51:35.600]  Do you find that the prompts are different with Mistral versus 3.5?
[51:35.720 --> 51:38.220]  Like maybe I'm prompting differently for that LLM?
[51:38.220 --> 51:40.820]  I found 3.5 is better for coding.
[51:41.240 --> 51:41.680]  Interesting.
[51:42.080 --> 51:42.180]  Okay.
[51:42.380 --> 51:43.300]  3.5 is better for coding.
[51:43.440 --> 51:44.160]  I keep hearing that.
[51:45.220 --> 51:45.660]  So...
[51:45.660 --> 51:45.780]  Yep.
[51:45.900 --> 51:46.240]  More questions?
[51:46.460 --> 51:46.520]  Yeah.
[51:46.780 --> 51:49.880]  So you said you took like 30 tries to do a document RC.
[51:50.380 --> 51:50.820]  Yeah.
[51:51.500 --> 51:53.880]  And then I saw a couple other examples.
[51:54.380 --> 51:57.320]  Like how many of those examples took a lot of iterations?
[51:57.660 --> 52:03.300]  Like I feel that when I use AI, every time I change words, it gives me different responses.
[52:03.580 --> 52:08.260]  So like how do you become good at changing the prompts for getting the right answer that you want?
[52:09.580 --> 52:10.680]  Because I feel...
[52:10.680 --> 52:14.300]  I'm also afraid of like AI as a tool.
[52:14.840 --> 52:18.560]  I think I'm coming to create a better the best way to use AI.
[52:20.040 --> 52:24.860]  Can you give an example of like, was there one that would just straight out give you the right answer?
[52:25.060 --> 52:26.760]  Or how do you integrate from the prompts?
[52:27.060 --> 52:34.060]  What are some tools that you would recommend for someone to use AI in these situations to get better prompting?
[52:34.520 --> 52:36.620]  So the question was about prompt engineering.
[52:37.000 --> 52:39.880]  I am out of time, so feel free to catch me after.
[52:40.040 --> 52:41.780]  But there is a prompt engineering site.
[52:42.000 --> 52:44.940]  I think it's promptengineering.ai or something like that.
[52:45.180 --> 52:52.760]  It has all these different techniques like chain of thought and sort of examples that you provide the machine and it helps you do that.
[52:52.920 --> 52:54.900]  But that's a...
[52:54.900 --> 52:56.660]  Yeah, it's an art, not a science, right?
[52:56.740 --> 52:57.540]  It's still Frontier.
[52:57.840 --> 53:00.480]  So yeah, playing around with it does help you get good at it though.
[53:00.480 --> 53:02.040]  All right.
[53:02.820 --> 53:03.740]  Thank you.
[53:03.980 --> 53:04.100]  Yeah.