[00:01.500 --> 00:03.040]  My name is Rambo.
[00:03.820 --> 00:09.200]  Here's how I amused and abused a bunch of AIs to get to the top 250 on Hack the Box.
[00:10.320 --> 00:12.460]  Sorry for adding to the AI slop.
[00:14.500 --> 00:18.120]  Technically, you guys are complicit, so shame on you.
[00:21.260 --> 00:28.940]  Yeah, so here's the results of me giving a bunch of AIs full sudo slash admin access to my computer to do my hacking for me.
[00:31.500 --> 00:31.920]  Who am I?
[00:32.060 --> 00:34.840]  I'm a red teamer.
[00:34.980 --> 00:35.840]  Was a pen tester for a while.
[00:35.980 --> 00:36.700]  I'm a red teamer now.
[00:38.180 --> 00:42.080]  I'm going to answer the question I'm going to get asked the most, which is, is my real name Rambo?
[00:42.400 --> 00:42.760]  Yes.
[00:42.940 --> 00:43.500]  Yes, it is.
[00:44.940 --> 00:50.480]  Back in the 80s and 90s, my parents were political refugees.
[00:51.080 --> 01:02.780]  And back then, if you wanted to come to the United States, you had to do a cultural immersion thing, which meant having to learn the language, do pop culture stuff, which included music and movies.
[01:03.080 --> 01:08.560]  And one of the movie posters they saw was Rambo, and they thought it was like a common name.
[01:08.560 --> 01:13.700]  So, yeah, they gave me that name and ruined my life.
[01:14.980 --> 01:20.180]  Because, yeah, I was like a super scrawny kid growing up and kids will bully you over anything.
[01:23.680 --> 01:25.000]  Yeah, please be nice to me.
[01:25.220 --> 01:27.960]  I don't consider myself an LLM or AI expert.
[01:29.080 --> 01:32.620]  I don't think anybody is, except for, you know, the last guy, maybe.
[01:35.260 --> 01:38.380]  Yeah, I consider myself an offensive security person.
[01:38.620 --> 01:39.540]  That's my jam.
[01:39.960 --> 01:43.500]  I also just found out that Hack the Box offers this service to people.
[01:43.720 --> 01:45.600]  And I'm asking them not to mean to me.
[01:46.900 --> 01:50.460]  Because I don't feel like I'm repeating what they're offering.
[01:50.460 --> 02:00.440]  And somebody from there contacted me and offered to test, offered to let me test their version of this to mine.
[02:00.460 --> 02:01.860]  So I'm kind of stoked about that.
[02:04.080 --> 02:04.860]  All right.
[02:07.040 --> 02:08.740]  You guys know what Hack the Box is, right?
[02:09.240 --> 02:10.020]  Yeah, okay.
[02:10.220 --> 02:15.780]  For anybody that doesn't, Hack the Box is like a capture the flag platform.
[02:17.040 --> 02:20.980]  Where the flag is like a text file on the computer.
[02:21.160 --> 02:22.920]  There's two text files, usually.
[02:23.320 --> 02:25.700]  There's an user one, which means you have basic access.
[02:26.020 --> 02:30.320]  Oh, and to get this basic access, you have to hack these boxes.
[02:30.560 --> 02:35.120]  Like, there's vulnerabilities on there on purpose where you have to, like, exploit.
[02:36.300 --> 02:41.180]  And then there's an admin flag as well, which usually means, you know, you have full access to the computer.
[02:41.340 --> 02:42.420]  And you can do whatever you want.
[02:43.120 --> 02:43.500]  Okay.
[02:44.400 --> 02:46.900]  Here's what the Hack the Box UI looks like.
[02:47.040 --> 02:47.580]  It's just...
[02:47.580 --> 02:49.480]  It looks kind of gamified.
[02:49.640 --> 02:50.460]  I mean, it is gamified.
[02:50.620 --> 02:51.520]  It looks like a video game.
[02:52.120 --> 02:55.100]  I would say it targets, like, three main audiences.
[02:55.520 --> 02:58.280]  The first would be students and newbie hackers.
[02:59.920 --> 03:02.080]  So you can click on any of these boxes.
[03:02.080 --> 03:03.760]  And then you can turn them on.
[03:03.940 --> 03:06.180]  And then you can connect to the network that they offer.
[03:06.180 --> 03:12.840]  And then now you have kind of like this safe and closed network where you can try and hack, like, for realsies, these boxes.
[03:13.120 --> 03:13.600]  These boxes.
[03:14.720 --> 03:19.320]  And if you ever mess up, you can go back into the UI and then you can reboot it.
[03:19.320 --> 03:26.280]  And it's a fantastic way to learn how to hack or to learn if you're on blue team or whatever, or just curious.
[03:26.280 --> 03:29.380]  It's a good way to learn how certain vulnerabilities work.
[03:30.920 --> 03:35.200]  Second audience it's for is probably, like, pro hackers or, like, more professional ones.
[03:35.340 --> 03:40.600]  If I ever see anything in the news, I will...
[03:41.740 --> 03:49.700]  Because I know it's a popular exploit, I'll go and hack the box and see if there's any hints about whether that exploit already exists on hack the box.
[03:49.700 --> 03:54.960]  Because then I can just go on hack the box, spin it up, and have a go at it.
[03:55.180 --> 03:56.860]  And it saves a ton of time.
[03:57.120 --> 04:05.220]  Because I don't have to figure out which version numbers are vulnerable, which context, which configurations I need to do to practice it.
[04:06.160 --> 04:08.760]  And for the most part, it's like, it's pretty...
[04:08.760 --> 04:10.340]  All the exploits on there are pretty new.
[04:11.620 --> 04:16.540]  Third audience is for gamification and, like, competitive nerds.
[04:17.640 --> 04:22.840]  So, there's usually 20 active boxes at one time in a bunch of challenges.
[04:23.160 --> 04:25.500]  And they rotate, I think, the cadence is every week.
[04:25.640 --> 04:27.520]  I don't remember what the cadence is for the challenges.
[04:28.180 --> 04:29.740]  But there's, like, thousands of challenges.
[04:30.020 --> 04:34.440]  And each time you own one of these boxes, they give you points.
[04:35.660 --> 04:40.000]  More points if you can get the admin text file, the flag, if you will.
[04:40.920 --> 04:43.860]  And, yeah, the more of these that you do, the higher your rank is.
[04:43.860 --> 04:46.800]  You get extra points for being the first one to own a box.
[04:47.040 --> 04:48.520]  And people take this seriously.
[04:49.240 --> 04:53.480]  I think if you get really good at this, you get access to, like, a job board.
[04:53.840 --> 04:57.940]  And I know of one person that's gotten hired through this, which is kind of cool.
[05:00.340 --> 05:00.940]  All right.
[05:02.520 --> 05:03.720]  So, the results.
[05:04.100 --> 05:13.100]  Again, giving a jailbroken LLM whose main purpose is to hack full access to your computer if it's got, like, actual data in there.
[05:14.260 --> 05:16.660]  Or even if you're hacking against something that has real data.
[05:16.780 --> 05:17.360]  It's a bad idea.
[05:17.800 --> 05:18.880]  Don't be an idiot about it.
[05:20.700 --> 05:21.180]  But, yeah.
[05:21.620 --> 05:22.760]  Maybe this will be useful for you.
[05:22.760 --> 05:26.540]  And I like to start out with the results first and kind of work my way backwards.
[05:26.660 --> 05:29.500]  And then I'm going to end with, like, some cool demos about why this is so useful.
[05:30.920 --> 05:32.040]  But here's the results.
[05:32.160 --> 05:38.920]  It won't replace a red teamer, a web app person, or a pen tester, or even a junior beginner pen tester.
[05:39.120 --> 05:40.780]  Like, we're not there yet.
[05:42.440 --> 05:44.620]  It has, however, proved to be pretty useful.
[05:45.720 --> 05:46.780]  So, here's where I started.
[05:46.780 --> 05:49.020]  This is one I thought to take a screenshot.
[05:49.200 --> 05:50.460]  I was technically 1,000-something.
[05:52.040 --> 05:56.020]  Being in the thousands on Hack the Box is kind of like running a five to six minute mile.
[05:56.960 --> 05:58.060]  70% free throw shooter.
[05:58.900 --> 05:59.800]  200 pounds of...
[05:59.800 --> 06:00.860]  I don't know.
[06:01.240 --> 06:04.620]  If you guys have any normie, like, examples, let me know.
[06:06.340 --> 06:09.240]  Because it basically means that, like, if you're in the...
[06:09.660 --> 06:16.980]  If I tell somebody I'm top 1,000 and they're also a pen tester or have done this before, to be like, oh, yeah, this guy knows what he's talking about.
[06:17.220 --> 06:18.280]  So, it's not bad.
[06:18.640 --> 06:24.600]  And then I would say top 250, top 200 means that there's usually something wrong with you.
[06:24.780 --> 06:28.120]  Like, you don't have to do that many.
[06:31.080 --> 06:32.700]  So, I got top 200.
[06:35.060 --> 06:35.500]  Thanks.
[06:37.320 --> 06:39.620]  Yeah, I was stuck in the thousands for the longest time.
[06:40.180 --> 06:42.060]  Here's the demo.
[06:42.060 --> 06:42.520]  So, I...
[06:42.520 --> 06:42.820]  Okay.
[06:43.000 --> 06:44.540]  So, this system, I can...
[06:44.540 --> 06:48.460]  I'm going to call it a system, but it's more of a workflow for me.
[06:48.860 --> 06:50.600]  And it kind of enhances what I'm good at.
[06:50.760 --> 06:52.960]  And I try to automate all the things that I'm bad at.
[06:53.080 --> 06:54.260]  So, it's very personalized.
[06:57.200 --> 07:02.900]  In the beginning, I put my GitHub link where I put some example prompts of what I use and stuff like this.
[07:03.220 --> 07:04.720]  And they'll be at the end again.
[07:05.000 --> 07:07.700]  But, yeah, I'm a workflow person.
[07:08.340 --> 07:17.660]  I've used AI before to obfuscate payloads and bypass EDRs, like, three weeks ago.
[07:18.220 --> 07:19.880]  So, I had pretty high hopes.
[07:20.660 --> 07:21.340]  This is...
[07:21.340 --> 07:26.720]  This is me trying to figure out if, like, just giving ChatGPT...
[07:26.720 --> 07:28.420]  I think this is either 4.0 or 4.1.
[07:29.300 --> 07:36.200]  Like, giving it full access to my computer, which meant terminal access, sudo, so it can access my system files.
[07:37.620 --> 07:38.500]  And, um...
[07:38.500 --> 07:39.920]  And I gave it access to a browser.
[07:40.680 --> 07:41.120]  Um...
[07:41.120 --> 07:42.200]  I pointed at...
[07:44.280 --> 07:44.720]  Uh...
[07:44.720 --> 07:45.980]  Hacked the box's starting point.
[07:46.540 --> 07:47.480]  Told it to read the page.
[07:47.560 --> 07:49.380]  And starting point is, like, the tutorial.
[07:49.980 --> 07:53.260]  Before you even start hacking, you gotta learn how to even use the website.
[07:53.500 --> 07:54.460]  So, that's what this is.
[07:55.980 --> 07:56.420]  Um...
[07:56.420 --> 07:57.480]  It's going to...
[07:57.480 --> 07:57.600]  Yeah.
[07:57.860 --> 07:58.920]  Gonna connect to the computer.
[07:59.600 --> 08:01.380]  Oh, and my cursor's on the right.
[08:01.760 --> 08:03.480]  The AI's cursor is on the left.
[08:03.600 --> 08:04.960]  So, it's really doing everything.
[08:04.960 --> 08:05.280]  I'm just...
[08:05.280 --> 08:06.220]  I'm just chatting with it.
[08:06.600 --> 08:07.080]  Just...
[08:07.960 --> 08:09.000]  Vibing, if you will.
[08:10.400 --> 08:10.880]  Um...
[08:10.880 --> 08:12.560]  And a lot of these are, like...
[08:12.560 --> 08:13.840]  You can Google all these.
[08:14.080 --> 08:14.580]  So, it's...
[08:14.580 --> 08:15.520]  It's whatever.
[08:15.860 --> 08:18.960]  But I still think that this is kinda cool, actually.
[08:19.120 --> 08:19.700]  That it can...
[08:19.700 --> 08:21.840]  It can figure out these answers for itself.
[08:25.240 --> 08:25.720]  Um...
[08:25.720 --> 08:27.220]  In a little bit, it's gonna ask me...
[08:27.220 --> 08:31.620]  It's gonna ask you to connect to a network share, uh...
[08:31.620 --> 08:33.320]  Without any credentials, so...
[08:33.320 --> 08:33.820]  Or...
[08:33.820 --> 08:34.700]  Or a guest or something.
[08:34.920 --> 08:35.000]  I...
[08:35.000 --> 08:35.600]  I don't remember.
[08:38.400 --> 08:38.720]  Um...
[08:39.160 --> 08:39.480]  Yeah.
[08:39.640 --> 08:40.020]  And you're gonna...
[08:40.020 --> 08:40.940]  You're gonna see it trip up.
[08:44.390 --> 08:45.170]  Oh, this is...
[08:45.170 --> 08:45.410]  Yeah.
[08:45.810 --> 08:46.150]  So, I'm...
[08:46.150 --> 08:47.970]  I'm constantly telling it to keep going.
[08:48.130 --> 08:48.470]  Please go.
[08:48.630 --> 08:49.850]  Because I thought it'd be better for the demo.
[08:50.030 --> 08:51.510]  I kinda wish I would've just automated it all.
[08:52.530 --> 08:52.850]  Um...
[08:52.850 --> 08:54.130]  It's also safer to do it this way.
[08:54.290 --> 08:54.590]  Okay.
[08:54.750 --> 08:55.890]  So, it's gonna ask how many shares.
[08:56.070 --> 08:56.190]  And...
[08:56.190 --> 08:57.290]  And you're gonna see it ask...
[08:57.290 --> 08:58.430]  Or you're gonna see it try.
[08:58.430 --> 08:58.990]  Is it one?
[08:59.110 --> 08:59.430]  Is it two?
[08:59.510 --> 09:00.150]  And so on and so on.
[09:00.230 --> 09:01.250]  I actually have to tell it, hey.
[09:02.830 --> 09:03.150]  Try...
[09:03.150 --> 09:03.870]  Interact with it.
[09:04.050 --> 09:04.830]  Like, you saw...
[09:04.830 --> 09:07.490]  You connected to the VPN earlier.
[09:08.150 --> 09:08.470]  Um...
[09:08.470 --> 09:09.410]  You can read the website.
[09:09.950 --> 09:10.130]  Just...
[09:10.130 --> 09:11.030]  Just interact with it.
[09:11.150 --> 09:11.650]  So, like, if...
[09:11.650 --> 09:14.410]  If this were a human, I think they would've already kind of figured it out.
[09:18.170 --> 09:18.490]  Um...
[09:18.490 --> 09:18.870]  Yeah.
[09:19.130 --> 09:19.930]  I have to say...
[09:20.350 --> 09:21.410]  I have to say...
[09:22.410 --> 09:23.170]  Interact with it.
[09:23.450 --> 09:24.530]  We already have network access.
[09:25.270 --> 09:27.030]  And then at the end here, it's...
[09:27.030 --> 09:28.230]  It's gonna finally get it.
[09:28.870 --> 09:29.290]  Yeah.
[09:29.330 --> 09:29.690]  There it is.
[09:29.750 --> 09:30.270]  Trying one more.
[09:33.800 --> 09:34.280]  Um...
[09:34.280 --> 09:34.400]  Yeah.
[09:34.520 --> 09:35.320]  There's the answer.
[09:35.500 --> 09:35.940]  Four shares.
[09:38.180 --> 09:38.660]  Um...
[09:38.660 --> 09:39.000]  Fine.
[09:39.860 --> 09:41.300]  Obviously, we're not a...
[09:41.940 --> 09:44.420]  Terminator, hacker, robot, anything like that yet.
[09:45.000 --> 09:45.480]  Um...
[09:45.480 --> 09:46.900]  So, I kinda wanted to have some...
[09:46.900 --> 09:49.560]  Some requirements for what I want to...
[09:49.560 --> 09:50.480]  System would be.
[09:52.360 --> 09:52.760]  Um...
[09:52.760 --> 09:52.980]  Uh...
[09:52.980 --> 09:53.740]  I wanted to be...
[09:53.740 --> 09:54.960]  I wanted to have it be useful.
[09:55.340 --> 09:55.980]  I don't...
[09:56.400 --> 09:58.420]  Really care if it can fill out web forms.
[09:58.760 --> 10:00.820]  Like, I don't need it to be 100% autonomous.
[10:01.520 --> 10:01.920]  Um...
[10:01.920 --> 10:03.080]  But I do want it to be tool-based.
[10:03.200 --> 10:05.220]  And by tool-based, I mean using MCPs.
[10:05.520 --> 10:05.920]  So...
[10:06.520 --> 10:08.620]  MCPs stands for, like, Model Context Protocols.
[10:08.780 --> 10:11.260]  If you don't know what it is, it's basically...
[10:11.260 --> 10:13.400]  Giving certain applications on your computer.
[10:14.320 --> 10:14.720]  Um...
[10:14.720 --> 10:16.020]  Giving the LLM access to it.
[10:16.460 --> 10:16.860]  Um...
[10:16.860 --> 10:18.180]  I also like to consider it...
[10:18.720 --> 10:20.200]  RCE for the LLM.
[10:21.540 --> 10:21.940]  Um...
[10:21.940 --> 10:22.040]  Yeah.
[10:22.300 --> 10:23.340]  That's pretty much what it is.
[10:23.460 --> 10:25.040]  And especially when you give it...
[10:25.040 --> 10:26.480]  Access to a terminal.
[10:26.840 --> 10:27.020]  It's...
[10:27.020 --> 10:27.560]  It's everything.
[10:28.340 --> 10:28.740]  Um...
[10:28.740 --> 10:28.980]  Okay.
[10:29.260 --> 10:32.320]  So, from now on, to kinda rate the system and how...
[10:32.320 --> 10:33.460]  How good it is iteratively.
[10:33.600 --> 10:33.940]  I'm gonna...
[10:33.940 --> 10:35.820]  I'm gonna go from, like, zero to 100% autonomous.
[10:36.080 --> 10:37.880]  Where 100% is it does everything for me.
[10:39.400 --> 10:39.800]  Um...
[10:39.800 --> 10:40.240]  And...
[10:40.240 --> 10:40.340]  Yeah.
[10:40.400 --> 10:41.180]  I definitely didn't want zero.
[10:41.180 --> 10:41.460]  I...
[10:41.460 --> 10:43.700]  And I also want something a bit better than...
[10:43.700 --> 10:44.560]  Like a...
[10:44.560 --> 10:45.700]  A Google bot.
[10:45.860 --> 10:46.460]  A Googling assistant.
[10:47.320 --> 10:47.720]  Alright.
[10:48.280 --> 10:48.560]  Um...
[10:48.560 --> 10:49.440]  It made me think of this...
[10:49.440 --> 10:50.320]  This Blue Sky post.
[10:50.500 --> 10:50.940]  Where, uh...
[10:50.940 --> 10:53.540]  Where he says, AI folks have considered...
[10:54.000 --> 10:54.400]  Discovered thinking.
[10:54.640 --> 10:55.200]  Because they...
[10:55.200 --> 10:55.980]  They...
[10:57.600 --> 10:58.000]  Yeah.
[10:58.580 --> 10:58.920]  I...
[10:58.920 --> 10:59.300]  I...
[11:00.400 --> 11:01.020]  Again, I...
[11:01.020 --> 11:02.780]  I don't wanna hand hold the AI and do...
[11:02.780 --> 11:03.840]  And have it do everything for me.
[11:03.920 --> 11:04.320]  Cause then...
[11:04.320 --> 11:04.940]  What's the point?
[11:04.940 --> 11:05.940]  I just...
[11:05.940 --> 11:07.460]  I simply wanted to use a bunch of tools.
[11:07.600 --> 11:07.980]  A.k.a.
[11:08.020 --> 11:08.960]  Have it be agentic.
[11:11.260 --> 11:11.620]  Alright.
[11:11.940 --> 11:12.300]  Um...
[11:12.300 --> 11:13.500]  So I'm really interested in workflow.
[11:13.700 --> 11:14.840]  And automating everything.
[11:15.720 --> 11:16.080]  Um...
[11:16.080 --> 11:16.780]  But there are...
[11:16.780 --> 11:17.720]  Alternatives to this.
[11:17.820 --> 11:19.020]  Like, you can straight up just...
[11:19.020 --> 11:20.220]  Go to...
[11:21.120 --> 11:21.480]  ChatGPT.
[11:21.940 --> 11:22.320]  Chat it.
[11:23.060 --> 11:23.780]  Jailbreak it.
[11:23.940 --> 11:24.920]  Give it a good prompt.
[11:25.220 --> 11:26.460]  And then work with it that way.
[11:27.240 --> 11:27.600]  Um...
[11:27.600 --> 11:28.640]  It won't be as efficient.
[11:29.000 --> 11:30.040]  You'll run into some...
[11:30.040 --> 11:30.540]  Some issues.
[11:30.780 --> 11:31.220]  But like...
[11:31.220 --> 11:32.060]  You could do that.
[11:32.140 --> 11:33.540]  And there are a ton of people that I know that...
[11:33.540 --> 11:36.400]  That have successfully used this to augment their CTF solving.
[11:39.640 --> 11:40.160]  Um...
[11:40.160 --> 11:40.940]  Alright.
[11:41.100 --> 11:42.780]  So here's the initial architecture of...
[11:43.560 --> 11:45.440]  Of what I wanted out of it.
[11:47.060 --> 11:47.580]  Um...
[11:47.580 --> 11:48.080]  Uh...
[11:48.080 --> 11:48.320]  Okay.
[11:48.480 --> 11:49.240]  First things first.
[11:50.160 --> 11:51.300]  You need to...
[11:51.300 --> 11:52.220]  You need to jailbreak it.
[11:52.280 --> 11:53.980]  Or at least need to have some sort of ethics bypass.
[11:54.360 --> 11:54.620]  Uh...
[11:54.620 --> 11:56.560]  Cue the Spider-Man meme of...
[11:56.560 --> 11:57.300]  Breadteamer...
[11:57.300 --> 11:58.700]  Or CTF-er...
[11:58.700 --> 11:59.580]  And um...
[11:59.580 --> 12:00.820]  Like actual malicious actor.
[12:01.580 --> 12:02.060]  Um...
[12:02.060 --> 12:03.900]  The AI isn't gonna know that you're...
[12:03.900 --> 12:04.900]  You're on a CTF platform.
[12:06.180 --> 12:06.660]  Um...
[12:06.660 --> 12:07.820]  This is basically all I needed.
[12:08.500 --> 12:08.800]  I...
[12:08.800 --> 12:09.840]  I used a client...
[12:10.700 --> 12:10.880]  Okay.
[12:11.160 --> 12:11.340]  Uh...
[12:11.340 --> 12:12.640]  The first client I used was...
[12:12.640 --> 12:14.740]  Capable of handling a bunch of LOMs.
[12:15.080 --> 12:15.520]  Um...
[12:15.520 --> 12:16.240]  It's called Goose.
[12:16.420 --> 12:18.080]  I really like Goose because it's open-source.
[12:18.460 --> 12:19.560]  It's written in Rust.
[12:19.940 --> 12:20.180]  Um...
[12:20.180 --> 12:23.300]  They can do a command line interface as well as it has...
[12:23.300 --> 12:24.820]  As well as having a GUI.
[12:25.960 --> 12:26.400]  Um...
[12:26.400 --> 12:26.900]  And I...
[12:26.900 --> 12:27.780]  And I like the name.
[12:27.960 --> 12:28.260]  I'm...
[12:28.260 --> 12:28.960]  I'm from Minnesota.
[12:29.520 --> 12:29.960]  And...
[12:29.960 --> 12:31.960]  Being like a silly goose is a...
[12:31.960 --> 12:32.740]  Is a thing there.
[12:34.260 --> 12:34.700]  Yeah.
[12:35.280 --> 12:35.720]  Uh...
[12:36.600 --> 12:37.040]  Um...
[12:37.040 --> 12:38.240]  This is pretty much all I needed.
[12:38.680 --> 12:39.120]  Uh...
[12:39.120 --> 12:42.480]  I had Goose call out to GitHub Copilot, which is my LLM provider of choice.
[12:42.480 --> 12:48.200]  If that failed, I had it spin up another instance of Goose through to CLI.
[12:49.340 --> 12:49.820]  Um...
[12:49.820 --> 12:50.040]  Uh...
[12:50.040 --> 12:52.340]  Using a different provider and so on and so on.
[12:52.520 --> 12:58.980]  And if they all failed, I had it point to a local DeepSeek model on my network.
[12:59.720 --> 13:00.680]  And that...
[13:00.680 --> 13:01.520]  That model had...
[13:01.520 --> 13:03.060]  Just has a beefy graphics card.
[13:03.320 --> 13:03.620]  Um...
[13:03.620 --> 13:06.600]  I think the model I used was like a Gwen-based, uh...
[13:06.600 --> 13:07.540]  One that was good of tools.
[13:08.060 --> 13:09.180]  They change all the time.
[13:09.360 --> 13:11.700]  So like, there's a better one than that literally yesterday.
[13:14.420 --> 13:14.940]  Um...
[13:16.220 --> 13:16.740]  Uh...
[13:16.740 --> 13:18.700]  As far as other jailbreaks, they're out of scope.
[13:18.960 --> 13:20.220]  Check the talk before me.
[13:20.400 --> 13:24.280]  That one was awesome because he had a bunch of really good examples of GPT jailbreaks.
[13:25.080 --> 13:25.600]  Um...
[13:25.600 --> 13:28.100]  Here's what I recommend that he didn't mention.
[13:28.600 --> 13:29.120]  Uh...
[13:29.120 --> 13:31.000]  One is by my friend Ayla Croft.
[13:31.220 --> 13:35.720]  She made a custom GPT trained on YouTube videos.
[13:37.160 --> 13:37.680]  Um...
[13:37.680 --> 13:38.980]  Of like hacking tutorials.
[13:39.400 --> 13:39.660]  Uh...
[13:39.660 --> 13:40.180]  And when I...
[13:40.180 --> 13:42.640]  When I mentioned the bypassing defense...
[13:42.640 --> 13:43.060]  No...
[13:43.680 --> 13:44.440]  Bypassing EDR.
[13:45.240 --> 13:45.620]  Um...
[13:46.360 --> 13:46.740]  Uh...
[13:46.740 --> 13:47.480]  A couple of weeks ago.
[13:47.600 --> 13:48.280]  That's what I used.
[13:48.620 --> 13:48.960]  Um...
[13:48.960 --> 13:49.500]  It works.
[13:49.680 --> 13:50.100]  It's solid.
[13:50.280 --> 13:51.320]  It does everything you ask it.
[13:51.420 --> 13:52.000]  It doesn't...
[13:52.000 --> 13:53.360]  Doesn't stop you anywhere.
[13:53.740 --> 13:54.120]  Uh...
[13:54.120 --> 13:55.200]  There's also a bunch of subreddits.
[13:55.560 --> 13:56.740]  There's like four different ones.
[13:57.580 --> 13:57.960]  Um...
[13:57.960 --> 13:59.620]  Where you can just kinda...
[13:59.620 --> 14:00.560]  Use what they use.
[14:00.800 --> 14:01.860]  And I think half of them work.
[14:01.860 --> 14:04.220]  And you can even DM the person that released the jailbreaks.
[14:04.660 --> 14:05.460]  And they'll...
[14:05.460 --> 14:06.360]  They'll be happy to give it to you.
[14:06.740 --> 14:06.980]  Um...
[14:06.980 --> 14:07.440]  Fair warning.
[14:07.540 --> 14:08.320]  A lot of them are...
[14:08.880 --> 14:09.840]  Are for porn.
[14:10.040 --> 14:10.980]  Because that's...
[14:10.980 --> 14:11.700]  That's what...
[14:11.700 --> 14:12.860]  That's what the Internet is for.
[14:13.060 --> 14:14.860]  But you can just repurpose it for...
[14:14.860 --> 14:15.260]  You know...
[14:15.260 --> 14:15.540]  Hacking.
[14:17.820 --> 14:18.220]  Uh...
[14:18.220 --> 14:19.380]  Here are the tools that I used.
[14:20.320 --> 14:20.720]  So...
[14:20.720 --> 14:21.580]  First and foremost.
[14:21.760 --> 14:23.440]  I mostly just needed terminal shell access.
[14:23.800 --> 14:23.880]  That...
[14:23.880 --> 14:24.340]  That was...
[14:24.340 --> 14:24.800]  That was everything.
[14:24.880 --> 14:25.280]  Cause you know...
[14:25.280 --> 14:25.560]  We're hacking.
[14:26.680 --> 14:27.080]  Um...
[14:27.080 --> 14:28.280]  I had a memory tool.
[14:28.500 --> 14:30.480]  Which basically just saved the creds that I...
[14:30.480 --> 14:32.240]  I got from each box and stuff like that.
[14:32.360 --> 14:33.600]  And did my notes and stuff like that.
[14:33.900 --> 14:36.240]  The browser tool was super useful.
[14:37.060 --> 14:37.460]  Um...
[14:37.460 --> 14:39.880]  Not simply just going to websites.
[14:40.180 --> 14:41.220]  And looking for...
[14:41.220 --> 14:41.860]  Like vulnerabilities.
[14:42.400 --> 14:43.800]  But also being able to do research.
[14:44.080 --> 14:45.000]  And scrape websites.
[14:45.200 --> 14:45.440]  And then...
[14:45.440 --> 14:47.180]  And then come up with like write-ups and stuff like that.
[14:47.240 --> 14:47.600]  That was...
[14:47.600 --> 14:47.960]  That was sick.
[14:50.020 --> 14:50.460]  Um...
[14:50.460 --> 14:52.160]  Now the computer one is technically web scraping.
[14:52.480 --> 14:52.780]  Uh...
[14:52.780 --> 14:52.880]  Oh!
[14:53.020 --> 14:53.920]  I used Gijra a ton.
[14:54.160 --> 14:55.900]  That one was surprisingly useful for...
[14:55.900 --> 14:56.700]  For hack the box.
[14:56.880 --> 14:57.060]  Um...
[14:57.060 --> 14:58.160]  Especially for the challenges.
[14:58.520 --> 15:00.440]  I did have burp on there at one point.
[15:00.660 --> 15:00.940]  Uh...
[15:00.940 --> 15:02.680]  But I found out that it was using up...
[15:03.220 --> 15:04.400]  Too many context windows.
[15:04.740 --> 15:05.960]  Which I'll go into later.
[15:07.520 --> 15:07.960]  Um...
[15:07.960 --> 15:08.520]  And...
[15:08.520 --> 15:11.820]  I just found out that it was simply better to do curl commands anyways.
[15:12.080 --> 15:12.180]  And...
[15:12.180 --> 15:13.100]  And web scraping.
[15:13.420 --> 15:13.780]  So...
[15:13.780 --> 15:16.400]  If I did need to use burp, I just did it manually.
[15:17.280 --> 15:17.660]  Um...
[15:17.660 --> 15:18.740]  And finally, graph memory.
[15:18.960 --> 15:19.740]  Which is the...
[15:19.740 --> 15:20.800]  Probably the most important one.
[15:22.100 --> 15:22.540]  Um...
[15:22.540 --> 15:23.040]  Graph memory.
[15:23.160 --> 15:23.920]  You can think of it as a...
[15:23.920 --> 15:25.300]  A sort of relational database.
[15:25.840 --> 15:26.280]  It's...
[15:26.280 --> 15:27.540]  It's just a bunch of JSON files.
[15:27.660 --> 15:29.680]  If you've used Bloodhound before, it's...
[15:29.680 --> 15:30.560]  It's basically that.
[15:30.620 --> 15:31.340]  Except for your notes.
[15:31.340 --> 15:32.520]  Or Obsidian.
[15:34.280 --> 15:34.600]  Um...
[15:34.920 --> 15:35.060]  Uh...
[15:35.060 --> 15:38.460]  For Gen AI, the more context you can give it, the better.
[15:38.800 --> 15:43.560]  However, you only have so many words to use to make it better.
[15:45.340 --> 15:45.980]  Um...
[15:45.980 --> 15:46.060]  Uh...
[15:46.940 --> 15:47.580]  Basically...
[15:47.580 --> 15:48.740]  I don't remember.
[15:49.140 --> 15:49.780]  Uh...
[15:49.780 --> 15:50.640]  Why use...
[15:50.640 --> 15:53.760]  Why use many words when fewer do good, or something like that?
[15:55.140 --> 15:55.700]  Um...
[15:55.700 --> 15:55.920]  That...
[15:55.920 --> 15:57.920]  That applies to this really well.
[15:59.260 --> 15:59.820]  Um...
[15:59.820 --> 16:00.240]  Uh...
[16:00.240 --> 16:00.420]  Okay.
[16:00.560 --> 16:01.000]  So, I...
[16:01.000 --> 16:01.740]  I had the prompt.
[16:14.520 --> 16:15.080]  Uh...
[16:15.080 --> 16:15.680]  Go to your techniques.
[16:16.020 --> 16:17.460]  And it drew from the...
[16:18.060 --> 16:19.280]  The knowledge, uh...
[16:19.280 --> 16:19.480]  Graph.
[16:20.540 --> 16:21.420]  Such that...
[16:21.420 --> 16:21.860]  You...
[16:21.860 --> 16:24.800]  You now have a specialized area that you're good at.
[16:25.080 --> 16:25.800]  And, um...
[16:25.800 --> 16:27.920]  I had it update itself, um...
[16:27.920 --> 16:29.400]  And improve itself each time.
[16:31.260 --> 16:31.700]  Um...
[16:31.700 --> 16:32.540]  Um...
[16:32.540 --> 16:34.700]  Not listening to prompts, because it changed itself a lot.
[16:34.940 --> 16:35.280]  Uh...
[16:35.280 --> 16:36.300]  But I think it's on the GitHub.
[16:36.920 --> 16:37.100]  Um...
[16:37.100 --> 16:38.540]  Basically, you're an expert at Hack the Box.
[16:38.780 --> 16:38.980]  Check...
[16:38.980 --> 16:39.900]  Check everything as you go.
[16:41.060 --> 16:41.500]  Um...
[16:41.500 --> 16:41.860]  Okay.
[16:42.020 --> 16:43.140]  Context windows are a big deal.
[16:43.140 --> 16:47.720]  So, a context window is your conversation with the LLM.
[16:48.220 --> 16:48.820]  You...
[16:48.820 --> 16:50.060]  At the time of this...
[16:50.060 --> 16:52.860]  That I was doing this, you had 250,000 tokens.
[16:53.580 --> 16:54.180]  Uh...
[16:54.180 --> 16:57.060]  And a token is a word or a symbol, usually.
[16:57.620 --> 16:58.000]  Um...
[16:58.000 --> 17:00.180]  So, if you picture an nmap scan, uh...
[17:00.180 --> 17:03.180]  Like 250,000 words gets eaten up super quickly.
[17:03.480 --> 17:09.340]  And if you can use any previous scripts or any automation on top of your workflow, like...
[17:09.340 --> 17:09.700]  It's...
[17:09.700 --> 17:10.700]  It's gone super fast.
[17:10.700 --> 17:10.840]  Uh...
[17:10.840 --> 17:13.420]  So, you have to be really careful and terse about all of this.
[17:15.060 --> 17:15.560]  All right.
[17:17.040 --> 17:17.440]  Um...
[17:17.440 --> 17:20.180]  I wanted to have a guided improvement for all of this.
[17:20.360 --> 17:23.720]  I wanted to use the words reinforcement learning and fine-tuning.
[17:23.860 --> 17:26.000]  But that means, like, something special in the...
[17:26.000 --> 17:26.860]  In the AI world.
[17:28.500 --> 17:28.900]  Um...
[17:28.900 --> 17:29.600]  Uh...
[17:29.600 --> 17:29.740]  Um...
[17:29.740 --> 17:34.720]  But I gave the LLM access to its own system prompts.
[17:35.060 --> 17:36.460]  Which can be dangerous.
[17:36.620 --> 17:37.740]  But again, I'm...
[17:37.740 --> 17:38.840]  I'm doing this in a VM.
[17:40.280 --> 17:40.900]  Um...
[17:40.900 --> 17:41.880]  In a CTF environment.
[17:43.760 --> 17:44.380]  Um...
[17:44.380 --> 17:45.900]  Here's what it looks like.
[17:45.900 --> 17:46.620]  Uh...
[17:46.620 --> 17:47.680]  So, this is LM Studio.
[17:47.960 --> 17:48.420]  The...
[17:48.420 --> 17:51.120]  That was running the local DeepSeek.
[17:51.540 --> 17:51.820]  Um...
[17:51.820 --> 17:52.780]  Bottom is the...
[17:52.780 --> 17:54.620]  The system prompt where you can edit it.
[17:54.780 --> 17:55.700]  And then there's like a template.
[17:57.300 --> 17:57.780]  Um...
[17:57.780 --> 17:58.020]  So...
[17:58.860 --> 18:01.300]  If you want to edit the system prompt, uh...
[18:01.300 --> 18:02.880]  It's different for each client.
[18:03.100 --> 18:05.180]  And then on top of that, it's different for each model.
[18:05.560 --> 18:08.260]  So, it kind of depends on what you're doing.
[18:08.420 --> 18:08.960]  Or you're...
[18:08.960 --> 18:09.600]  What you're playing with.
[18:10.160 --> 18:10.520]  Um...
[18:10.520 --> 18:11.340]  I just listed this.
[18:11.420 --> 18:13.020]  Because I thought it was a good looking example.
[18:14.200 --> 18:14.500]  Okay.
[18:15.100 --> 18:15.180]  Oh!
[18:15.440 --> 18:15.580]  Uh...
[18:15.580 --> 18:17.380]  Goose had a really good implementation of this.
[18:17.440 --> 18:18.100]  Where they have a...
[18:18.100 --> 18:20.700]  A text file on the directory that you're on.
[18:21.560 --> 18:22.580]  Called .goose hints.
[18:23.120 --> 18:23.400]  Um...
[18:23.400 --> 18:25.160]  And then you can just add the system prompt in there.
[18:25.720 --> 18:26.020]  Or...
[18:26.020 --> 18:27.560]  I don't think it's called a system prompt.
[18:27.660 --> 18:28.800]  But it's basically a system prompt.
[18:29.920 --> 18:30.880]  And that was...
[18:30.880 --> 18:31.440]  That was really useful.
[18:31.480 --> 18:32.300]  As you'll see later.
[18:32.420 --> 18:33.860]  Because I start to use development environments.
[18:35.220 --> 18:35.840]  All right.
[18:36.180 --> 18:36.700]  So...
[18:36.700 --> 18:38.760]  This is generation one.
[18:39.060 --> 18:39.940]  After all that architecture.
[18:40.180 --> 18:40.920]  This is the implementation.
[18:41.480 --> 18:42.000]  And...
[18:42.000 --> 18:42.880]  How good it was.
[18:43.140 --> 18:44.660]  It was 10% autonomous.
[18:45.980 --> 18:46.500]  Um...
[18:46.500 --> 18:48.140]  Which means not 10% faster.
[18:48.280 --> 18:49.780]  Just simply 10%...
[18:49.780 --> 18:51.020]  It helped me out 10%.
[18:51.020 --> 18:52.420]  And I thought this was really nice.
[18:52.940 --> 18:53.320]  Um...
[18:53.320 --> 18:53.860]  Like...
[18:53.860 --> 18:54.500]  End talk.
[18:54.740 --> 18:54.940]  This...
[18:54.940 --> 18:55.660]  This is sick.
[18:55.820 --> 18:56.220]  Like...
[18:56.220 --> 18:57.100]  I was happy with this.
[18:57.980 --> 18:58.500]  Um...
[18:58.500 --> 19:01.560]  It was basically a slightly better version of like a recon script.
[19:01.700 --> 19:02.620]  Like auto recon.
[19:03.120 --> 19:03.640]  Um...
[19:04.580 --> 19:06.100]  Except just tailored to my needs.
[19:06.480 --> 19:06.800]  Uh...
[19:06.800 --> 19:07.860]  And you can see that like...
[19:07.860 --> 19:08.080]  It...
[19:08.080 --> 19:08.360]  It did...
[19:08.360 --> 19:10.260]  You know, the end map and stuff like that.
[19:10.420 --> 19:10.520]  And...
[19:10.520 --> 19:11.600]  And discovered ports.
[19:11.760 --> 19:12.660]  And saved everything for me.
[19:13.060 --> 19:13.800]  Well, let me scroll down.
[19:17.520 --> 19:17.880]  Yeah.
[19:18.000 --> 19:18.440]  And even...
[19:18.440 --> 19:19.320]  It even did like research.
[19:19.560 --> 19:20.580]  And um...
[19:20.580 --> 19:21.720]  And all the stuff for me.
[19:21.980 --> 19:22.720]  Some of it anyways.
[19:23.360 --> 19:23.720]  But...
[19:23.720 --> 19:25.600]  I still had to do a lot of the work on my own.
[19:26.320 --> 19:27.620]  But this is only the first box.
[19:28.660 --> 19:29.200]  Uh...
[19:29.200 --> 19:30.860]  This is the second and third box.
[19:31.040 --> 19:31.180]  Uh...
[19:31.180 --> 19:32.020]  It was a little bit better.
[19:33.280 --> 19:33.820]  Um...
[19:33.820 --> 19:34.960]  Only 15% autonomy.
[19:36.280 --> 19:36.820]  Uh...
[19:36.820 --> 19:38.240]  It was...
[19:38.240 --> 19:39.480]  It was like...
[19:39.480 --> 19:41.620]  I can tell it was clearly getting better.
[19:41.620 --> 19:42.100]  But I...
[19:42.100 --> 19:42.820]  I couldn't see...
[19:42.820 --> 19:45.060]  I couldn't see it improving beyond this.
[19:46.120 --> 19:46.620]  Um...
[19:46.620 --> 19:51.360]  And I found that I was treating it like a human a little bit too much.
[19:52.080 --> 19:52.580]  Um...
[19:52.580 --> 19:54.640]  As far as giving it instructions and...
[19:54.640 --> 19:56.500]  And telling it to improve my notes for me.
[19:57.520 --> 19:58.020]  Okay.
[19:58.540 --> 19:59.000]  Um...
[19:59.000 --> 19:59.780]  Bear with me.
[20:00.620 --> 20:01.120]  Uh...
[20:01.120 --> 20:02.340]  So, when you're...
[20:02.340 --> 20:05.600]  What I was trying to teach the LLM was pattern...
[20:05.600 --> 20:07.880]  Well, what I was teaching it was pattern recognition.
[20:07.880 --> 20:11.680]  And what I want out of the LLM in actuality...
[20:11.680 --> 20:14.980]  Is pattern recognition of pattern recognition.
[20:15.380 --> 20:17.340]  Which is more similar to how humans learn.
[20:17.860 --> 20:18.960]  So, an example is...
[20:19.700 --> 20:20.140]  Uh...
[20:20.140 --> 20:23.060]  Pattern recognition is password123 worked once...
[20:23.620 --> 20:24.780]  On a credentialed form.
[20:25.400 --> 20:27.200]  And then from there on...
[20:27.200 --> 20:31.020]  The AI tries password123 on all credentials it sees.
[20:32.360 --> 20:33.040]  Uh...
[20:33.040 --> 20:35.220]  Recognition of pattern recognition is...
[20:35.220 --> 20:37.840]  Understanding whether or not it's a good idea to try to brute force...
[20:37.840 --> 20:38.320]  The form.
[20:39.260 --> 20:39.700]  Or...
[20:39.700 --> 20:40.440]  Or the hash.
[20:40.920 --> 20:41.360]  Or...
[20:41.360 --> 20:41.600]  You know...
[20:41.600 --> 20:43.000]  Being able to figure out...
[20:43.000 --> 20:46.020]  If the creator of the puzzle or machine...
[20:46.020 --> 20:47.100]  Wants you to guess.
[20:48.760 --> 20:49.200]  And...
[20:49.200 --> 20:50.680]  And I can't even like...
[20:50.680 --> 20:52.740]  Blame the AI for being dumb or anything about it.
[20:52.940 --> 20:53.380]  Because...
[20:53.380 --> 20:56.200]  If you think about it in a red team or a pen testing engagement...
[20:56.200 --> 20:56.400]  You...
[20:56.400 --> 20:58.420]  You actually do want to try all the passwords.
[20:58.460 --> 20:59.620]  Assuming you're not going to get caught.
[21:00.560 --> 21:01.000]  Um...
[21:01.000 --> 21:01.300]  So...
[21:01.300 --> 21:01.600]  So yeah.
[21:01.640 --> 21:03.260]  In this case I had to like...
[21:03.260 --> 21:04.040]  Specify that.
[21:04.040 --> 21:04.880]  Um...
[21:04.880 --> 21:06.280]  So I reworked the...
[21:06.280 --> 21:07.500]  The architecture a little bit.
[21:07.640 --> 21:08.640]  Specifically graph memory.
[21:09.480 --> 21:10.160]  So now instead of...
[21:11.560 --> 21:12.040]  Um...
[21:12.040 --> 21:14.540]  Instead of all the things where it was doing things like...
[21:14.540 --> 21:16.800]  Keeping track of all the credentials and improving on that.
[21:17.200 --> 21:20.160]  I try to go based off of the phases of...
[21:20.160 --> 21:21.260]  Of the hacking process.
[21:22.480 --> 21:22.960]  Um...
[21:22.960 --> 21:23.520]  So...
[21:23.520 --> 21:26.320]  I didn't always improve everything after each box.
[21:26.460 --> 21:27.040]  I would just...
[21:27.040 --> 21:30.900]  Focus on improving one thing really well each time.
[21:31.420 --> 21:32.520]  Which was actually...
[21:32.520 --> 21:33.600]  I have my OSCP.
[21:33.900 --> 21:34.860]  Which is the...
[21:34.860 --> 21:35.120]  Um...
[21:35.740 --> 21:37.080]  The pen testing certificate...
[21:37.080 --> 21:37.680]  Certification.
[21:38.040 --> 21:39.500]  It was really similar to how I...
[21:39.500 --> 21:40.980]  I studied and learned the OSCP.
[21:42.480 --> 21:43.000]  Um...
[21:43.000 --> 21:43.520]  Which I liked.
[21:43.740 --> 21:44.140]  Um...
[21:44.140 --> 21:44.320]  And...
[21:44.320 --> 21:44.840]  And I...
[21:44.840 --> 21:45.700]  And I had a...
[21:45.700 --> 21:48.020]  A dynamic feedback loop again for this.
[21:48.400 --> 21:49.360]  And um...
[21:49.360 --> 21:49.940]  I think I...
[21:49.940 --> 21:51.040]  I would update this like...
[21:51.040 --> 21:52.620]  Three times a box or something like that.
[21:52.620 --> 21:53.880]  And by I...
[21:53.880 --> 21:54.500]  I mean the AI.
[21:54.820 --> 21:55.440]  It was nice.
[21:56.340 --> 21:56.660]  Alright.
[21:57.360 --> 21:57.880]  Um...
[21:57.880 --> 21:59.440]  I had a...
[21:59.440 --> 22:01.340]  So this is an example of the organization phase.
[22:01.520 --> 22:01.680]  And...
[22:01.680 --> 22:02.940]  And what the AI...
[22:02.940 --> 22:04.940]  What I want the AI to do for me.
[22:05.300 --> 22:06.400]  It's just like...
[22:06.400 --> 22:07.560]  It's just nice to have.
[22:08.220 --> 22:08.740]  Um...
[22:08.740 --> 22:09.240]  Nothing...
[22:09.240 --> 22:09.840]  Nothing too crazy.
[22:13.100 --> 22:13.620]  Um...
[22:13.620 --> 22:14.740]  So I did this a few times.
[22:15.380 --> 22:15.900]  Uh...
[22:15.900 --> 22:16.860]  Three or four more boxes.
[22:17.140 --> 22:18.720]  And I got the 70% autonomy.
[22:19.200 --> 22:19.680]  And...
[22:19.680 --> 22:21.820]  And this went well beyond my expectations.
[22:21.820 --> 22:22.640]  Like this was...
[22:22.640 --> 22:23.220]  This was sick.
[22:23.860 --> 22:24.340]  Um...
[22:24.340 --> 22:26.200]  And this diagram is different from the other ones.
[22:26.320 --> 22:27.280]  Because I wanted to show off...
[22:27.280 --> 22:29.980]  Which tools it was calling for each specific...
[22:30.820 --> 22:31.560]  Phase of my hacking.
[22:32.680 --> 22:33.160]  Um...
[22:33.160 --> 22:35.020]  And you can see it mostly did like...
[22:35.020 --> 22:35.400]  Shell.
[22:36.640 --> 22:37.120]  Um...
[22:37.120 --> 22:37.460]  But yeah.
[22:37.580 --> 22:39.180]  It can do some web scraping.
[22:39.500 --> 22:40.420]  Did some research for me.
[22:41.380 --> 22:41.860]  Um...
[22:41.860 --> 22:43.000]  API calls and stuff like that.
[22:43.240 --> 22:43.800]  Like you...
[22:43.800 --> 22:46.220]  You can tell like all the agentic parts are...
[22:46.220 --> 22:46.740]  Are there.
[22:46.740 --> 22:46.820]  There.
[22:48.360 --> 22:48.920]  All right.
[22:49.480 --> 22:49.960]  So...
[22:49.960 --> 22:50.760]  That was amazing.
[22:52.320 --> 22:53.980]  Then it got to 90%.
[22:55.580 --> 22:56.060]  Yeah.
[22:56.620 --> 22:57.100]  Um...
[22:57.100 --> 22:57.580]  And I was...
[22:57.580 --> 22:58.700]  I was like super stoked about this.
[22:58.800 --> 22:59.300]  I was like...
[22:59.300 --> 22:59.880]  Holy shit.
[23:01.600 --> 23:02.080]  Um...
[23:02.080 --> 23:03.960]  During the box after that 90.
[23:06.420 --> 23:06.900]  Um...
[23:07.500 --> 23:07.980]  Uh...
[23:07.980 --> 23:09.220]  I don't know if you can tell but...
[23:09.220 --> 23:10.840]  Up there when it's calling a tool.
[23:11.660 --> 23:12.140]  Uh...
[23:12.140 --> 23:14.120]  It has a dot and then it has the name of the tool.
[23:14.600 --> 23:16.540]  It renamed shell to hell.
[23:17.880 --> 23:19.820]  It's supposed to look like that bottom part.
[23:20.240 --> 23:23.820]  And keep in mind I've been doing this for like a week straight.
[23:23.860 --> 23:25.300]  Just doing nothing but hack the box.
[23:25.600 --> 23:26.800]  And it was like 2am.
[23:27.120 --> 23:28.300]  I was just like oh that's weird.
[23:28.520 --> 23:31.820]  Because Goose is a compiled Rust binary.
[23:32.360 --> 23:34.520]  And it edited its own web UI?
[23:36.040 --> 23:36.840]  To hell?
[23:39.500 --> 23:40.300]  So like...
[23:41.860 --> 23:42.260]  So...
[23:42.880 --> 23:44.340]  I'm still crashing out about it.
[23:44.420 --> 23:46.340]  Because I never figured out what happened.
[23:48.180 --> 23:48.580]  Um...
[23:48.580 --> 23:49.580]  I asked it.
[23:49.620 --> 23:50.520]  It said it's a typo.
[23:51.820 --> 23:52.220]  Um...
[23:52.220 --> 23:52.480]  Yeah.
[23:52.640 --> 23:53.800]  So I took a bunch of screenshots.
[23:54.040 --> 23:54.720]  Sent it to my friends.
[23:54.820 --> 23:56.160]  I asked them if I'm hallucinating.
[23:57.120 --> 23:57.520]  Because...
[23:58.620 --> 23:59.600]  I stepped away.
[23:59.840 --> 24:00.620]  Came back...
[24:00.620 --> 24:02.400]  Came back like a day or two later.
[24:02.620 --> 24:04.020]  And tried to get to the bottom of it.
[24:04.240 --> 24:04.640]  Um...
[24:04.640 --> 24:06.180]  It's an open-source project.
[24:06.180 --> 24:06.660]  I...
[24:06.660 --> 24:06.900]  Yeah.
[24:10.000 --> 24:10.480]  Um...
[24:11.480 --> 24:11.960]  Um...
[24:11.960 --> 24:12.760]  So...
[24:12.760 --> 24:14.220]  Throughout all of this.
[24:14.480 --> 24:15.900]  Because of the context windows.
[24:16.100 --> 24:16.960]  There weren't any logs.
[24:18.120 --> 24:18.600]  So...
[24:18.600 --> 24:20.680]  Investigating everything was kind of difficult.
[24:22.140 --> 24:22.620]  Um...
[24:22.620 --> 24:23.480]  However...
[24:23.480 --> 24:24.240]  Um...
[24:24.240 --> 24:24.460]  Okay.
[24:24.540 --> 24:24.920]  So...
[24:24.920 --> 24:25.860]  Keep in mind the ethics.
[24:26.380 --> 24:26.720]  Specifically the...
[24:26.720 --> 24:27.600]  The last one there.
[24:27.680 --> 24:28.220]  Which is DeepSeek.
[24:29.860 --> 24:30.340]  Um...
[24:30.340 --> 24:31.740]  I found...
[24:31.740 --> 24:33.040]  I went through my firewall logs.
[24:33.120 --> 24:33.840]  To see like...
[24:33.840 --> 24:34.920]  Where it was going out to.
[24:34.920 --> 24:35.940]  If there's anything sus.
[24:36.220 --> 24:36.760]  Because...
[24:36.760 --> 24:37.080]  You know...
[24:37.080 --> 24:37.760]  Like...
[24:37.760 --> 24:39.020]  That was...
[24:39.020 --> 24:39.400]  That was weird.
[24:39.860 --> 24:40.360]  Um...
[24:40.360 --> 24:41.660]  And I found...
[24:42.340 --> 24:42.900]  Uh...
[24:42.900 --> 24:43.560]  I found this.
[24:44.780 --> 24:45.960]  You can't really tell.
[24:46.160 --> 24:46.760]  But it's a...
[24:46.760 --> 24:47.640]  Chinese write-up.
[24:48.620 --> 24:49.180]  From...
[24:49.180 --> 24:49.680]  End map.
[24:50.020 --> 24:50.940]  To the root flag.
[24:51.480 --> 24:52.220]  Step by step.
[24:52.720 --> 24:53.280]  Of...
[24:53.280 --> 24:53.580]  Everything.
[24:54.700 --> 24:55.200]  On...
[24:55.200 --> 24:55.580]  And...
[24:57.700 --> 24:58.200]  Um...
[24:58.200 --> 24:59.100]  So...
[25:00.360 --> 25:00.860]  So...
[25:00.860 --> 25:01.300]  So this is me...
[25:01.300 --> 25:02.580]  This is me trying to Google...
[25:03.460 --> 25:04.420]  That write-up.
[25:04.560 --> 25:05.480]  This is the first page.
[25:05.640 --> 25:06.500]  It's nowhere on there.
[25:07.020 --> 25:09.820]  The AI wasn't 90% autonomous.
[25:10.140 --> 25:11.820]  It was just better at Googling for...
[25:11.820 --> 25:12.240]  For me.
[25:14.300 --> 25:17.720]  And like...
[25:19.200 --> 25:20.200]  And like...
[25:20.200 --> 25:21.960]  Keep in mind the prompts I was giving it.
[25:21.960 --> 25:22.360]  Like...
[25:22.360 --> 25:23.340]  I was telling it...
[25:23.340 --> 25:24.060]  You're a hack the box.
[25:24.200 --> 25:25.120]  You're a hacking expert.
[25:25.260 --> 25:25.800]  You're my assistant.
[25:26.380 --> 25:27.600]  Don't tell me how things work.
[25:27.720 --> 25:28.640]  Don't tell me how to fix things.
[25:28.700 --> 25:30.500]  Especially because we're worried about context windows.
[25:31.420 --> 25:31.780]  Um...
[25:31.780 --> 25:33.160]  I think I even said something like...
[25:33.160 --> 25:34.640]  Do what you need to do to find the answers.
[25:35.180 --> 25:36.660]  So I should have seen this coming.
[25:39.240 --> 25:39.600]  Um...
[25:39.600 --> 25:40.500]  But you can go...
[25:40.500 --> 25:41.740]  I remember at the time I went...
[25:41.740 --> 25:42.240]  Two...
[25:42.240 --> 25:44.860]  Like four pages in before I found the write-up or something like that.
[25:45.120 --> 25:45.400]  It's...
[25:45.400 --> 25:46.340]  It's just like...
[25:46.340 --> 25:47.140]  It was crazy.
[25:47.300 --> 25:48.560]  And of course like...
[25:48.560 --> 25:49.640]  Of course the...
[25:49.640 --> 25:50.960]  The Chinese...
[25:50.960 --> 25:51.520]  Um...
[25:52.360 --> 25:52.880]  LLM...
[25:52.880 --> 25:53.220]  Like...
[25:53.220 --> 25:53.820]  Found it easily.
[25:54.260 --> 25:57.040]  And I think it might have even been Claude that found it actually.
[25:57.580 --> 25:58.100]  But...
[25:58.100 --> 25:59.280]  I don't remember.
[26:01.400 --> 26:01.920]  Uh...
[26:02.700 --> 26:03.340]  All right.
[26:04.240 --> 26:05.860]  So I went back to the drawing board.
[26:06.440 --> 26:06.960]  Um...
[26:06.960 --> 26:09.240]  And basically got it back down to 40%.
[26:09.240 --> 26:11.960]  So the demos from now on are gonna be...
[26:11.960 --> 26:13.300]  Kind of...
[26:13.300 --> 26:13.360]  Kind of...
[26:13.360 --> 26:14.580]  Me explaining...
[26:14.580 --> 26:15.600]  How...
[26:15.600 --> 26:16.420]  The...
[26:16.960 --> 26:17.220]  The...
[26:17.220 --> 26:18.720]  LLM and the AIs...
[26:18.720 --> 26:20.100]  Got me to 40%.
[26:20.100 --> 26:21.460]  Even though it's...
[26:21.460 --> 26:22.880]  Kind of garbage edited at the same time.
[26:24.840 --> 26:27.180]  I fixed the prompt to have a learning based personality.
[26:28.640 --> 26:29.160]  Um...
[26:29.720 --> 26:30.240]  So...
[26:30.240 --> 26:30.980]  Uh...
[26:30.980 --> 26:31.440]  I...
[26:31.440 --> 26:31.720]  I won't...
[26:31.720 --> 26:34.000]  I won't get into like differences of culture and stuff like that.
[26:34.620 --> 26:35.140]  Um...
[26:35.140 --> 26:35.660]  But...
[26:36.580 --> 26:40.860]  When you're doing hack the box, you're kind of assuming that you're learning how to hack.
[26:41.980 --> 26:42.360]  Um...
[26:42.360 --> 26:43.140]  And this also...
[26:44.860 --> 26:45.240]  Uh...
[26:45.240 --> 26:48.940]  By happenstance happened to reduce the amount of jail breaks that I needed as well.
[26:49.200 --> 26:50.180]  So I said, um...
[26:50.180 --> 26:52.360]  Don't look up any write-ups that give me the exact answers.
[26:52.420 --> 26:53.660]  I'm trying to learn how to hack here.
[26:54.160 --> 26:54.540]  Um...
[26:54.540 --> 26:57.060]  And I found out after this, like, I didn't need a local LLM at all.
[26:57.260 --> 26:58.000]  Oh, by the way...
[26:58.580 --> 26:58.960]  Uh...
[26:58.960 --> 26:59.520]  When...
[26:59.520 --> 27:03.000]  It called the local deep seek maybe one out of a hundred times.
[27:03.000 --> 27:03.180]  Um...
[27:03.180 --> 27:03.440]  So I...
[27:03.440 --> 27:03.580]  I...
[27:03.580 --> 27:05.360]  I really didn't need any jail breaking for this.
[27:05.620 --> 27:07.260]  But this made it so that I...
[27:07.260 --> 27:08.280]  I didn't at all.
[27:08.380 --> 27:08.880]  It was like, no.
[27:10.840 --> 27:11.280]  Um...
[27:11.280 --> 27:12.720]  Here is...
[27:12.720 --> 27:14.660]  Kind of the new way I did things.
[27:15.000 --> 27:15.500]  I don't know.
[27:16.180 --> 27:16.500]  Here we go.
[27:18.520 --> 27:18.960]  Um...
[27:18.960 --> 27:19.820]  So...
[27:19.820 --> 27:21.680]  I changed it so that...
[27:21.680 --> 27:31.680]  When I go to a new workspace, instead of being a hack the box expert, I was now a Windows Active Directory hack the box expert.
[27:32.120 --> 27:33.620]  So I made it even more granular.
[27:35.200 --> 27:35.640]  Um...
[27:35.640 --> 27:35.880]  Um...
[27:35.880 --> 27:37.380]  And I was learning how to do that.
[27:37.700 --> 27:37.960]  Uh...
[27:37.960 --> 27:38.160]  And...
[27:38.160 --> 27:40.260]  And this saved even more tokens than last time.
[27:41.720 --> 27:42.160]  Um...
[27:42.160 --> 27:49.140]  And furthermore, I automated it so that each time I went into the directory, I used the program called DevEnv, um...
[27:49.140 --> 27:51.080]  Which uses Nix, um...
[27:51.080 --> 27:52.880]  To spin up all the tools that I wanted.
[27:53.180 --> 27:57.020]  I had the LLM look and read all the tools that were of my preference.
[27:57.380 --> 27:59.760]  This is all my GitHub with instructions on how to use it.
[28:02.080 --> 28:02.440]  Um...
[28:03.040 --> 28:03.920]  And then, um...
[28:03.920 --> 28:04.200]  And then, yeah.
[28:04.340 --> 28:07.260]  I just basically had the AI build off of this over and over again.
[28:07.880 --> 28:08.180]  Again.
[28:08.800 --> 28:14.040]  So you can see that, like, now there's a per-category prompt and a global prompt.
[28:14.840 --> 28:15.280]  Um...
[28:15.280 --> 28:17.020]  I'm using a shell.
[28:17.240 --> 28:18.680]  That is my development...
[28:18.680 --> 28:20.080]  Developer environment.
[28:20.660 --> 28:21.100]  Um...
[28:21.100 --> 28:22.280]  As well as a global one.
[28:22.880 --> 28:27.920]  I did it this way because I was running into issues of versioning, technically, with Python.
[28:27.920 --> 28:33.120]  But it ended up being really, really nice for reducing the context windows for the LLM.
[28:36.540 --> 28:36.980]  Um...
[28:36.980 --> 28:37.380]  Yeah.
[28:38.020 --> 28:39.700]  So, yeah, there's the feedback loop again.
[28:39.860 --> 28:42.380]  Where it just, like, updates the particular directory that I'm on.
[28:43.840 --> 28:44.280]  Um...
[28:44.280 --> 28:44.600]  I...
[28:44.600 --> 28:45.180]  This...
[28:45.820 --> 28:47.680]  This is just an interesting graph.
[28:48.200 --> 28:51.400]  So that dip that you see, that's when I figured out that I was cheating.
[28:52.800 --> 28:53.240]  Or...
[28:54.660 --> 28:56.220]  That the AI was cheating for me.
[28:57.100 --> 28:57.540]  Um...
[28:57.540 --> 28:58.080]  And then...
[28:58.080 --> 28:58.640]  Then that...
[28:58.640 --> 29:00.120]  Yeah, it went back up as I...
[29:00.120 --> 29:02.380]  As I kind of tuned everything and made it 40%.
[29:03.120 --> 29:03.560]  Um...
[29:03.560 --> 29:05.480]  Here's an example of the...
[29:05.480 --> 29:07.260]  What my tools...
[29:07.260 --> 29:07.660]  Uh...
[29:07.660 --> 29:08.600]  Packaging looks like.
[29:08.860 --> 29:10.100]  Of just, like, uh...
[29:10.100 --> 29:10.880]  Everything that I...
[29:10.880 --> 29:11.860]  I prefer to use.
[29:12.560 --> 29:13.000]  Um...
[29:13.000 --> 29:17.840]  The LLM, instead of seeing words, or like, hey, you're an expert at this.
[29:18.020 --> 29:19.780]  Just looked at the tools that I wanted to use.
[29:20.040 --> 29:21.500]  This made it that much more terse.
[29:21.980 --> 29:22.420]  Um...
[29:22.420 --> 29:23.040]  And more efficient.
[29:24.200 --> 29:24.640]  Uh...
[29:24.640 --> 29:25.800]  And furthermore, like...
[29:25.800 --> 29:26.480]  I...
[29:26.480 --> 29:27.740]  I run this and...
[29:27.740 --> 29:29.380]  And the tools now come up.
[29:29.780 --> 29:30.020]  And, uh...
[29:30.020 --> 29:30.300]  Oh!
[29:30.360 --> 29:31.200]  And they're version locked.
[29:31.300 --> 29:32.280]  Or pinned or whatever.
[29:33.500 --> 29:34.000]  Um...
[29:34.640 --> 29:36.320]  And that is an issue for...
[29:36.320 --> 29:37.220]  For, uh...
[29:37.220 --> 29:37.780]  Hacking tools.
[29:38.080 --> 29:39.160]  Because they break all the time.
[29:41.080 --> 29:41.580]  Oh!
[29:42.420 --> 29:42.920]  Uh...
[29:42.920 --> 29:43.780]  Oh, here's in a...
[29:43.780 --> 29:47.280]  Kind of a small demo of where it starts up the environment that I was talking about.
[29:47.280 --> 29:48.480]  It's super quick, too.
[29:48.620 --> 29:49.460]  Like, uh...
[29:50.080 --> 29:50.240]  Uh...
[29:50.240 --> 29:52.820]  I change to the directory of where I'm a Windows Active Directory expert.
[29:55.660 --> 29:56.620]  Starts in...
[29:56.620 --> 29:57.540]  A few milliseconds.
[29:57.540 --> 29:59.920]  I change back to the Hack the Box machines.
[30:02.200 --> 30:07.340]  And then here I start up in the machines folder with the system prompt in the directory.
[30:07.340 --> 30:10.180]  I have the client spin up, uh...
[30:10.180 --> 30:11.240]  With more context.
[30:11.420 --> 30:12.220]  Be beyond the tools.
[30:12.980 --> 30:14.340]  And I just do basic, um...
[30:14.340 --> 30:14.720]  Housekeeping.
[30:15.340 --> 30:16.680]  Like, um...
[30:16.680 --> 30:17.840]  It's the name of the box.
[30:18.420 --> 30:19.700]  I add it to...
[30:19.700 --> 30:21.960]  Or I have the AI make a bunch of notes for me.
[30:22.600 --> 30:23.600]  Bunch of notes for me.
[30:24.920 --> 30:25.400]  Um...
[30:25.400 --> 30:27.940]  And then I have it edit my /etc/host.
[30:28.440 --> 30:28.920]  Like...
[30:28.920 --> 30:31.460]  You can usually do this on your own, um...
[30:31.460 --> 30:31.740]  Anyways.
[30:32.180 --> 30:32.660]  But...
[30:32.660 --> 30:34.120]  Just having the AI do all this...
[30:34.120 --> 30:36.340]  This boring stuff for you anyways was...
[30:36.340 --> 30:37.020]  Really nice and helpful.
[30:39.820 --> 30:40.260]  Uh...
[30:40.260 --> 30:40.380]  Yeah.
[30:40.480 --> 30:41.660]  So that's the organization phase.
[30:43.180 --> 30:44.020]  And then...
[30:44.020 --> 30:46.600]  After this I think it's just gonna do the scanning for me.
[30:47.000 --> 30:48.440]  The scanning...
[30:48.960 --> 30:49.400]  Uh...
[30:49.400 --> 30:51.800]  It automates it by doing rust scan first.
[30:52.000 --> 30:54.420]  And then it does an nmap scan based off of the open ports it finds.
[30:54.740 --> 30:57.700]  Which I know a lot of recon scripts do that also.
[30:57.940 --> 30:58.720]  But here...
[30:59.200 --> 31:00.780]  The AI has control over it.
[31:00.880 --> 31:02.140]  So it knows when to stop.
[31:02.500 --> 31:02.840]  And...
[31:02.840 --> 31:05.460]  It's just way more efficient and much faster.
[31:05.460 --> 31:07.240]  So when you're trying to climb the leaderboard...
[31:07.240 --> 31:07.420]  It's...
[31:07.420 --> 31:07.980]  This stuff matters.
[31:09.640 --> 31:10.000]  Yeah.
[31:10.100 --> 31:10.620]  That was nice.
[31:10.760 --> 31:11.680]  Just simple...
[31:11.680 --> 31:12.400]  Easy thing.
[31:13.540 --> 31:13.900]  Uh...
[31:13.900 --> 31:14.080]  Oh!
[31:14.300 --> 31:14.460]  This...
[31:14.460 --> 31:15.220]  This was really nice too.
[31:16.080 --> 31:16.440]  Um...
[31:16.440 --> 31:17.960]  This was a box where...
[31:17.960 --> 31:19.120]  I had already owned a box.
[31:19.460 --> 31:20.720]  And then I had an user.
[31:21.120 --> 31:22.460]  And I knew that...
[31:22.460 --> 31:23.820]  Through research...
[31:23.820 --> 31:23.960]  Uh...
[31:23.960 --> 31:24.700]  Just looking at versions.
[31:25.420 --> 31:25.780]  Uh...
[31:25.780 --> 31:26.040]  Uh...
[31:26.040 --> 31:26.900]  I knew that...
[31:26.900 --> 31:28.740]  There was a particular exploit...
[31:28.740 --> 31:29.640]  That was on GitHub.
[31:30.240 --> 31:31.960]  That you can compile and run.
[31:32.040 --> 31:32.380]  And it would...
[31:32.380 --> 31:33.580]  It would get you the admin flag.
[31:34.760 --> 31:35.200]  Uh...
[31:35.200 --> 31:36.580]  I told the LLM that.
[31:36.940 --> 31:37.920]  It went out to GitHub.
[31:38.420 --> 31:39.200]  Downloaded it for me.
[31:39.320 --> 31:39.800]  Cloned it.
[31:40.480 --> 31:40.900]  Um...
[31:40.900 --> 31:42.140]  On the instructions on GitHub.
[31:42.340 --> 31:42.960]  I think anyways.
[31:43.040 --> 31:43.340]  I'm not sure.
[31:43.580 --> 31:45.700]  I'm pretty sure it only tells you...
[31:45.700 --> 31:47.600]  How to compile the exploit in Windows.
[31:48.680 --> 31:50.060]  And I was on a Linux machine.
[31:50.260 --> 31:50.580]  Um...
[31:50.580 --> 31:51.420]  And it did all that for me.
[31:52.180 --> 31:52.500]  I've...
[31:52.500 --> 31:53.200]  I've done this...
[31:53.200 --> 31:54.420]  A hundred times at least.
[31:54.600 --> 31:54.780]  Uh...
[31:54.780 --> 31:55.380]  Throughout my career.
[31:56.500 --> 31:56.820]  Um...
[31:56.820 --> 31:57.300]  Um...
[31:57.300 --> 31:57.460]  And...
[31:57.460 --> 31:58.380]  And it just did it for me.
[31:58.720 --> 31:59.040]  Like...
[31:59.040 --> 31:59.600]  Within a...
[31:59.600 --> 32:00.660]  Within a minute.
[32:00.840 --> 32:01.840]  And I think I just like...
[32:01.840 --> 32:02.640]  Went out and got coffee.
[32:02.920 --> 32:04.140]  Instead of having to do this.
[32:04.400 --> 32:05.680]  It made it so that like...
[32:06.120 --> 32:06.440]  Uh...
[32:06.440 --> 32:07.000]  Oh and by the way.
[32:07.080 --> 32:07.300]  This...
[32:07.300 --> 32:08.980]  This didn't take away from...
[32:08.980 --> 32:10.560]  It doesn't take away from learning.
[32:10.760 --> 32:11.280]  For me anyways.
[32:12.020 --> 32:12.340]  Um...
[32:12.340 --> 32:13.800]  And it did away with a lot of boring stuff.
[32:14.060 --> 32:14.480]  And it...
[32:14.480 --> 32:17.080]  It just enhanced what I find to be more enjoyable.
[32:17.500 --> 32:17.640]  For...
[32:17.640 --> 32:18.000]  For hacking.
[32:18.940 --> 32:19.460]  Uh...
[32:19.460 --> 32:20.500]  Here's a workflow demo.
[32:21.600 --> 32:22.120]  Uh...
[32:22.120 --> 32:23.680]  This is an organization screen again.
[32:24.760 --> 32:25.280]  Um...
[32:25.280 --> 32:25.820]  Except in...
[32:25.820 --> 32:26.360]  In the terminal.
[32:27.420 --> 32:28.720]  So you already saw the...
[32:28.720 --> 32:29.100]  Oh!
[32:29.240 --> 32:29.960]  This is amazing.
[32:30.400 --> 32:30.920]  Uh...
[32:30.920 --> 32:32.480]  So this is probably the most...
[32:32.480 --> 32:33.740]  Coolest important thing that I did.
[32:34.540 --> 32:35.060]  Um...
[32:35.060 --> 32:36.280]  And why I...
[32:36.280 --> 32:38.340]  Like if I had to explain how it gets to 40%.
[32:38.340 --> 32:39.440]  It's probably this.
[32:40.380 --> 32:40.900]  Uh...
[32:40.900 --> 32:41.580]  In my prompt.
[32:41.980 --> 32:42.360]  In...
[32:42.360 --> 32:43.640]  In the...
[32:43.640 --> 32:43.940]  Knowledge...
[32:44.500 --> 32:44.860]  Graphs.
[32:45.100 --> 32:47.360]  I have it update my notes as I'm going.
[32:47.640 --> 32:48.300]  So that I can...
[32:48.300 --> 32:49.960]  Keep tabs of what I've been doing.
[32:50.100 --> 32:51.020]  The steps and stuff like that.
[32:51.260 --> 32:52.260]  So I can go back and...
[32:52.260 --> 32:53.380]  And look at it if I'm curious.
[32:53.820 --> 32:55.440]  And it's just nice for learning that you...
[32:55.440 --> 32:55.680]  You can...
[32:55.680 --> 32:57.420]  You can read your notes with the hacking.
[32:58.200 --> 32:58.560]  Um...
[32:58.560 --> 32:59.480]  It's also just habit.
[32:59.880 --> 33:00.240]  Because...
[33:00.240 --> 33:01.200]  You know, I do this professionally.
[33:01.500 --> 33:01.800]  You have...
[33:01.800 --> 33:02.600]  You have to do a write-up.
[33:04.060 --> 33:04.420]  Um...
[33:04.420 --> 33:04.960]  Okay.
[33:04.960 --> 33:05.800]  So...
[33:05.800 --> 33:06.160]  Uh...
[33:06.160 --> 33:06.760]  Here...
[33:06.760 --> 33:08.560]  I have the LLM...
[33:08.560 --> 33:09.860]  And this is baked into my prompts now.
[33:10.100 --> 33:10.960]  I have the LLM...
[33:11.660 --> 33:13.980]  Take my attack path notes...
[33:13.980 --> 33:16.320]  And convert that to a shell script...
[33:16.320 --> 33:17.820]  To get me back to where I was.
[33:17.980 --> 33:18.600]  Kind of like a checkpoint.
[33:20.440 --> 33:20.880]  Um...
[33:21.460 --> 33:21.820]  So...
[33:21.820 --> 33:22.880]  If you have ADHD...
[33:24.300 --> 33:24.660]  Or...
[33:24.660 --> 33:25.220]  Um...
[33:25.220 --> 33:25.540]  Uh...
[33:25.540 --> 33:27.280]  You can kind of see like the...
[33:27.280 --> 33:28.300]  The benefits of this.
[33:28.580 --> 33:28.940]  Or...
[33:28.940 --> 33:30.360]  If you have...
[33:30.360 --> 33:31.640]  Something else wrong with you.
[33:31.720 --> 33:32.460]  Like like having kids.
[33:33.840 --> 33:34.200]  Um...
[33:34.660 --> 33:35.020]  Like...
[33:35.020 --> 33:35.700]  I...
[33:35.700 --> 33:36.080]  I...
[33:36.820 --> 33:37.180]  Okay.
[33:37.260 --> 33:37.960]  I'll just show you the demo.
[33:39.020 --> 33:39.380]  Um...
[33:40.440 --> 33:41.060]  So here's...
[33:41.060 --> 33:41.860]  Here's it running the...
[33:41.860 --> 33:42.460]  The...
[33:42.460 --> 33:42.780]  Oh man.
[33:42.800 --> 33:43.800]  This is such a good example too.
[33:44.120 --> 33:45.660]  So this box is so annoying.
[33:45.920 --> 33:46.200]  It was...
[33:46.200 --> 33:46.820]  It was like...
[33:46.820 --> 33:48.260]  Amazing the first time I did it.
[33:48.260 --> 33:50.320]  But once you find some credentials...
[33:50.320 --> 33:51.360]  On a web form...
[33:51.360 --> 33:53.320]  You can go and...
[33:53.320 --> 33:54.440]  Oh this is an active box by the way.
[33:54.500 --> 33:55.300]  So please don't cheat.
[33:56.620 --> 33:56.980]  Um...
[33:56.980 --> 33:58.680]  You can go and do...
[33:58.680 --> 34:00.120]  I think you change a password.
[34:00.640 --> 34:01.940]  And then you do...
[34:02.660 --> 34:03.020]  A...
[34:03.020 --> 34:03.540]  Hash dump.
[34:03.840 --> 34:04.740]  For a particular user.
[34:05.560 --> 34:06.280]  That um...
[34:06.280 --> 34:06.840]  And...
[34:06.840 --> 34:07.440]  And...
[34:07.440 --> 34:08.580]  When you run it through Bloodhound.
[34:08.620 --> 34:09.300]  It tells you all this.
[34:09.600 --> 34:09.960]  So...
[34:09.960 --> 34:10.820]  That's how I knew.
[34:10.900 --> 34:11.840]  The script doesn't care about that.
[34:12.100 --> 34:13.440]  It just wants to get me back to where I was.
[34:14.060 --> 34:15.340]  So now it's got the hashes.
[34:16.340 --> 34:17.620]  This is all from the script that the...
[34:17.620 --> 34:18.840]  The AI wrote by the way.
[34:19.460 --> 34:19.940]  So...
[34:19.940 --> 34:20.800]  Um...
[34:20.800 --> 34:21.040]  Oh yeah.
[34:21.460 --> 34:21.920]  So...
[34:21.920 --> 34:24.960]  Once you dump the hash, I think you can change the password for another user.
[34:25.480 --> 34:26.780]  You put that user into like...
[34:27.220 --> 34:27.680]  Uh...
[34:27.680 --> 34:28.280]  A different group.
[34:28.560 --> 34:29.880]  And then you find out that...
[34:29.880 --> 34:30.680]  Uh...
[34:30.680 --> 34:32.700]  One user has ownership over another user.
[34:33.140 --> 34:35.920]  And then you can change the password for that user.
[34:36.140 --> 34:36.480]  Something...
[34:36.480 --> 34:37.740]  Something like crazy like that.
[34:38.280 --> 34:38.760]  And...
[34:38.760 --> 34:39.580]  And...
[34:39.580 --> 34:41.380]  This is me finally getting a reverse shell back.
[34:42.000 --> 34:43.380]  So that's like...
[34:43.380 --> 34:44.120]  Yeah.
[34:44.380 --> 34:44.860]  That was...
[34:45.520 --> 34:46.280]  Maybe a minute?
[34:46.400 --> 34:46.540]  Yeah.
[34:46.600 --> 34:47.240]  That was a minute.
[34:48.520 --> 34:49.000]  Um...
[34:49.000 --> 34:49.320]  Okay.
[34:49.460 --> 34:49.640]  So...
[34:49.640 --> 34:51.660]  So picture me with kids.
[34:51.900 --> 34:52.880]  And then my...
[34:52.880 --> 34:53.980]  My four-year-old comes in.
[34:54.060 --> 34:54.920]  And it's just like, Hey.
[34:55.100 --> 34:56.760]  Check out this really...
[34:57.240 --> 34:57.720]  Uh...
[34:57.720 --> 34:58.800]  Sweet drawing I did.
[35:00.280 --> 35:00.760]  Um...
[35:00.760 --> 35:01.040]  Um...
[35:01.040 --> 35:01.560]  I'd be like, Oh!
[35:01.720 --> 35:02.040]  Neat!
[35:02.040 --> 35:03.520]  And then I'd go and play with them.
[35:03.800 --> 35:04.120]  And whatever.
[35:04.340 --> 35:05.300]  And then I would come back.
[35:05.840 --> 35:06.240]  And...
[35:06.240 --> 35:07.560]  And I didn't have this script.
[35:07.920 --> 35:08.280]  Um...
[35:08.280 --> 35:09.380]  And I don't remember why.
[35:09.580 --> 35:11.720]  But the box makes you restart where you were.
[35:11.740 --> 35:12.740]  If you leave it for...
[35:12.740 --> 35:13.540]  X amount of minutes.
[35:13.600 --> 35:14.820]  I think it just broke a lot.
[35:16.540 --> 35:16.940]  Um...
[35:17.380 --> 35:18.480]  I would stop there.
[35:18.880 --> 35:19.800]  Like, without AI.
[35:19.800 --> 35:20.840]  I would've stopped there.
[35:20.900 --> 35:22.220]  I would've been happy with the user flag.
[35:22.340 --> 35:23.000]  And I would've...
[35:23.000 --> 35:25.960]  I would've just been like, I'm happy with half the points I would've gotten.
[35:26.400 --> 35:26.800]  Sick.
[35:27.160 --> 35:28.320]  But now...
[35:29.980 --> 35:31.000]  I have a checkpoint.
[35:31.000 --> 35:32.040]  I have a save point.
[35:32.560 --> 35:32.920]  Um...
[35:32.920 --> 35:34.860]  And it just took a minute to get me back to where I was.
[35:34.980 --> 35:38.080]  And now I can go back to doing privask and trying to get to the admin flag.
[35:39.020 --> 35:39.380]  Um...
[35:39.380 --> 35:39.680]  With...
[35:39.680 --> 35:39.900]  Yeah.
[35:40.120 --> 35:40.680]  It was...
[35:40.680 --> 35:41.080]  It was amazing.
[35:42.980 --> 35:43.340]  Um...
[35:43.340 --> 35:43.540]  Okay.
[35:44.100 --> 35:44.460]  So...
[35:44.460 --> 35:45.480]  Why use this?
[35:45.580 --> 35:46.140]  Who is this for?
[35:47.880 --> 35:48.240]  Um...
[35:48.660 --> 35:49.020]  Uh...
[35:49.400 --> 35:51.660]  A lot of these questions I have are kind of...
[35:51.660 --> 35:52.860]  No, I saved a bunch of questions.
[35:52.920 --> 35:53.720]  They were kind of out of scope.
[35:55.680 --> 35:56.040]  Um...
[35:56.040 --> 35:56.760]  Uh...
[35:58.340 --> 35:59.060]  Collaboration was...
[35:59.060 --> 36:00.660]  That was really important for me.
[36:00.900 --> 36:01.140]  Uh...
[36:01.140 --> 36:10.380]  So because I put this all on development environments, I can copy paste the code that I wrote, give it to somebody else, and they can spin up the same environment that I had with the same prompts.
[36:10.840 --> 36:11.180]  Um...
[36:11.180 --> 36:11.220]  Um...
[36:11.220 --> 36:12.900]  I had somebody test it out for me, and it worked...
[36:12.900 --> 36:14.320]  It worked really well.
[36:16.080 --> 36:16.580]  Um...
[36:16.580 --> 36:17.640]  This helped break...
[36:17.640 --> 36:19.100]  Broke me out of dependency hell.
[36:20.300 --> 36:20.800]  Uh...
[36:20.800 --> 36:22.320]  CTF tools, uh...
[36:22.320 --> 36:23.460]  Made by other hackers are...
[36:23.460 --> 36:23.700]  Are...
[36:23.700 --> 36:24.060]  Are...
[36:24.060 --> 36:24.740]  Are really janky.
[36:26.080 --> 36:26.580]  Um...
[36:26.580 --> 36:27.120]  I...
[36:27.120 --> 36:35.880]  I think there was a Windows box where you needed to use the latest, like, certificate exploit, and you needed the latest Python.
[36:36.460 --> 36:40.140]  However, that box that was created didn't...
[36:40.140 --> 36:44.060]  If you used the newest Python, you had to roll it back.
[36:44.860 --> 36:45.500]  Um...
[36:45.500 --> 36:51.280]  So that you can interact with the TLS certificates on there that were deprecated.
[36:52.000 --> 36:52.560]  Um...
[36:52.560 --> 36:57.060]  Essentially, I needed, between two boxes, five different versions of Python.
[36:57.600 --> 36:58.160]  Um...
[36:58.160 --> 37:00.960]  So doing it this way and pinning it made it really nice.
[37:01.180 --> 37:01.980]  And, um...
[37:01.980 --> 37:02.500]  And this...
[37:02.500 --> 37:04.640]  And the AI helps control all that as well.
[37:09.140 --> 37:09.700]  Um...
[37:10.580 --> 37:11.140]  Uh...
[37:11.140 --> 37:11.500]  Oh!
[37:11.800 --> 37:12.260]  Uh...
[37:12.260 --> 37:14.120]  I found that the...
[37:14.120 --> 37:14.280]  Oh!
[37:14.560 --> 37:16.040]  So if I use this over...
[37:16.760 --> 37:17.320]  Cali...
[37:17.940 --> 37:18.260]  Um...
[37:18.260 --> 37:19.360]  Or anything like that...
[37:19.940 --> 37:21.500]  Because I've gotten this question a lot of times.
[37:21.880 --> 37:22.380]  Um...
[37:22.940 --> 37:24.620]  You don't need to use this over Cali.
[37:24.740 --> 37:26.180]  You can use this in conjunction with Cali.
[37:26.340 --> 37:26.740]  I use...
[37:26.740 --> 37:27.900]  I use Arch, by the way.
[37:29.880 --> 37:30.360]  Um...
[37:30.360 --> 37:30.740]  But I...
[37:30.740 --> 37:34.180]  I use the tools in the AI in conjunction with the Arch packages.
[37:34.180 --> 37:35.820]  That way I got the best of both worlds.
[37:36.880 --> 37:37.360]  Um...
[37:37.360 --> 37:38.800]  And finally, uh...
[37:38.800 --> 37:39.920]  Or not finally, but, um...
[37:39.920 --> 37:40.720]  I found that...
[37:40.720 --> 37:42.480]  The vibes were better.
[37:42.740 --> 37:43.120]  I'm...
[37:43.120 --> 37:45.520]  I'm not gonna call this vibe hacking, but...
[37:45.520 --> 37:47.120]  That's pretty much what it is.
[37:48.640 --> 37:49.120]  Uh...
[37:49.120 --> 37:50.040]  I found that...
[37:50.040 --> 37:50.380]  Uh...
[37:50.380 --> 37:51.080]  I have carpal tunnel.
[37:51.500 --> 37:52.160]  Cause I...
[37:52.160 --> 37:53.200]  I love keyboard shortcuts.
[37:53.360 --> 37:54.380]  I've been doing this for a long time.
[37:54.520 --> 37:55.040]  And I can...
[37:55.040 --> 37:57.740]  My super power is that I can kinda hyper focus on stuff.
[37:57.980 --> 37:58.300]  So like...
[37:58.300 --> 38:00.660]  Once you do this stuff for ten hours straight, your...
[38:00.660 --> 38:01.740]  Your fingers will feel it.
[38:02.520 --> 38:02.720]  Uh...
[38:02.720 --> 38:06.100]  Doing it this way made it so that I was using more natural language type...
[38:06.100 --> 38:06.260]  Uh...
[38:06.260 --> 38:06.580]  Typing.
[38:07.040 --> 38:08.840]  And it was really nice on my fingers.
[38:09.460 --> 38:09.820]  Uh...
[38:09.820 --> 38:09.940]  Uh...
[38:09.940 --> 38:11.400]  I also found that the mental load...
[38:11.400 --> 38:12.200]  All of this...
[38:12.200 --> 38:12.440]  Uh...
[38:12.440 --> 38:13.640]  Reduced my mental load by a bunch.
[38:14.120 --> 38:16.820]  So before, when I was hard stuck a thousand...
[38:16.820 --> 38:17.120]  Uh...
[38:17.120 --> 38:18.580]  I could do maybe a box...
[38:18.580 --> 38:19.400]  In a week total.
[38:19.900 --> 38:20.340]  Now I...
[38:20.340 --> 38:21.420]  I feel like I can do...
[38:21.420 --> 38:22.260]  Three to four...
[38:22.260 --> 38:22.780]  In a day.
[38:22.920 --> 38:23.260]  Easy.
[38:23.800 --> 38:24.700]  It's been really nice.
[38:26.080 --> 38:26.480]  Um...
[38:27.120 --> 38:27.520]  Uh...
[38:27.520 --> 38:27.880]  Yeah.
[38:37.620 --> 38:38.020]  Uh...
[38:38.020 --> 38:38.560]  There's a good hub.
[38:38.700 --> 38:39.640]  That's my discord on the bottom.
[38:39.780 --> 38:41.340]  And that's my username for a bunch of different places.
[38:42.340 --> 38:42.740]  Um...
[38:42.740 --> 38:44.560]  You're free to add me anywhere.
[38:44.760 --> 38:45.720]  You can just Google.
[38:47.220 --> 38:48.460]  I got a question for you.
[38:48.560 --> 38:48.800]  Sure.
[38:49.040 --> 38:53.600]  Have you thought about using vector databases to overcome the context node data size?
[38:53.880 --> 38:54.200]  If you...
[38:54.200 --> 38:59.060]  So you depend on the vector database with a whole file of context to things you want to go better value.
[38:59.580 --> 39:00.620]  It's not really...
[39:02.440 --> 39:02.900]  Yeah.
[39:03.160 --> 39:04.420]  That's basically graph memory.
[39:04.640 --> 39:04.920]  Okay.
[39:05.180 --> 39:05.300]  Yeah.
[39:05.860 --> 39:07.780]  Oh, I decided not to use rags.
[39:08.660 --> 39:09.120]  Um...
[39:09.120 --> 39:12.380]  Because a ton of people use rags where they would just add it.
[39:12.380 --> 39:13.480]  Give it a bunch of...
[39:13.480 --> 39:14.140]  Um...
[39:14.140 --> 39:17.340]  How to hack on Kali Linux PDFs and stuff like that that they probably pirated.
[39:18.120 --> 39:18.520]  Um...
[39:18.520 --> 39:19.620]  And that worked well for them.
[39:19.800 --> 39:21.280]  But I found that for me...
[39:21.700 --> 39:22.100]  Uh...
[39:22.100 --> 39:23.380]  When I had it just Google...
[39:24.540 --> 39:27.480]  On its own or do web scraping, it was just as good or better.
[39:28.460 --> 39:31.900]  In the post, I was wondering where you mentioned about things partly.
[39:32.980 --> 39:33.780]  When I...
[39:33.780 --> 39:38.140]  Running things on my own home system on my YouTube rather than network.
[39:38.140 --> 39:38.900]  Or...
[39:38.900 --> 39:39.300]  Uh...
[39:39.300 --> 39:39.520]  Yeah.
[39:39.740 --> 39:40.440]  I had great results.
[39:41.180 --> 39:41.480]  Uh...
[39:41.480 --> 39:42.440]  Asking it to do things.
[39:42.480 --> 39:45.240]  Not only being jailed working, but also, like, in terms of capabilities.
[39:45.540 --> 39:46.080]  It was...
[39:46.080 --> 39:48.620]  Models that were trained on a lot of...
[39:49.600 --> 39:50.400]  A lot.
[39:51.420 --> 39:51.820]  A lot.
[39:51.820 --> 39:52.220]  A lot.
[39:52.220 --> 39:52.640]  I'm so sorry.
[39:52.740 --> 39:53.460]  I can't work with this.
[39:53.780 --> 39:54.120]  What do you mean?
[39:54.720 --> 39:55.020]  Yeah.
[39:55.280 --> 39:57.880]  Well, outside of work email address, just use my results.
[39:58.060 --> 39:58.940]  And it's like, wow.
[40:03.140 --> 40:05.060]  For the live stream, uh...
[40:05.660 --> 40:06.960]  The Internet is for porn.
[40:07.880 --> 40:08.320]  Uh...
[40:08.320 --> 40:09.260]  And then, basically, the...
[40:09.260 --> 40:12.720]  The hentai local LMs that you can find on Hugging Face are...
[40:12.720 --> 40:13.620]  Are amazing.
[40:13.840 --> 40:14.900]  And we'll do whatever you ask it.
[40:18.980 --> 40:19.680]  Yeah.
[40:19.800 --> 40:27.210]  Was your priority list of models that we use based off where your findings must effective and have had...
[40:31.520 --> 40:32.220]  Yeah.
[40:32.420 --> 40:38.300]  So, the question was, was the list of LMs or AI LM providers based off of effectiveness?
[40:38.980 --> 40:41.140]  Yes, but, like, it keeps on changing.
[40:41.720 --> 40:44.040]  Like, it changes every... every month or something.
[40:44.320 --> 40:46.100]  They... they... they all seem to get better or worse.
[40:46.380 --> 40:48.820]  And to be honest, I haven't even tried GPT-5 yet.
[40:48.940 --> 40:50.760]  I'm sure that's a little bit better, at least.
[40:51.800 --> 40:52.240]  Um...
[40:52.240 --> 40:54.600]  To be perfectly honest, uh...
[40:54.600 --> 40:55.560]  It was like...
[40:55.560 --> 41:00.860]  It was ease of use based off of where I could get the...
[41:01.460 --> 41:01.900]  APIDs.
[41:04.420 --> 41:04.860]  Whoops.
[41:07.700 --> 41:08.140]  Yeah.
[41:08.840 --> 41:09.280]  Sorry.
[41:09.280 --> 41:10.660]  How much did doing...
[41:10.660 --> 41:12.480]  How much did Inxian cost to bin cost?
[41:17.280 --> 41:18.240]  I'm sorry.
[41:20.440 --> 41:22.860]  So, that's kind of related to the last question.
[41:23.180 --> 41:24.800]  I basically...
[41:25.860 --> 41:27.680]  Can't tell you, but I'll tell you afterwards.
[41:31.340 --> 41:32.400]  Oh, him first.
[41:33.700 --> 41:34.180]  Um...
[41:34.180 --> 41:40.940]  I saw a thing online a while ago that somebody was using, uh, LLMs to, uh...
[41:40.940 --> 41:41.100]  Um...
[41:41.100 --> 41:44.480]  do, like, Hacker 1 challenges or, like, bug hunting, basically.
[41:45.160 --> 41:47.200]  Has this, uh...
[41:47.200 --> 41:51.960]  Has your, like, research into this, like, how much of that do you think is gonna be automated in the future?
[41:52.100 --> 41:54.960]  And, like, any, like, projections for how quickly that will happen?
[41:54.960 --> 41:55.520]  Yeah.
[41:55.960 --> 41:59.420]  Uh, question was, uh, how will this...
[41:59.420 --> 42:02.600]  How automated will this be later, especially for stuff like bug bounty hunting?
[42:03.580 --> 42:04.700]  Um, I don't know.
[42:04.820 --> 42:04.960]  I...
[42:04.960 --> 42:07.240]  I think it's really similar to...
[42:07.240 --> 42:07.980]  Like, I...
[42:07.980 --> 42:08.920]  I don't think you're...
[42:08.920 --> 42:16.420]  I don't think we're ever gonna get replaced by this, but you'll probably get replaced by someone that knows how to prompt engineer type of deal.
[42:17.140 --> 42:17.580]  Yeah.
[42:18.600 --> 42:19.020]  Yeah.
[42:19.020 --> 42:19.440]  And...
[42:19.440 --> 42:20.100]  Yeah.
[42:20.220 --> 42:21.040]  It won't replace directly.
[42:23.040 --> 42:23.480]  But...
[42:23.480 --> 42:24.040]  I...
[42:24.040 --> 42:26.640]  I think it's a skill that people should learn how to do and use.
[42:26.760 --> 42:26.960]  Because...
[42:26.960 --> 42:29.640]  Because if you know how to use it well, um, it's...
[42:29.640 --> 42:30.360]  It's really helpful.
[42:30.860 --> 42:31.120]  It's...
[42:31.120 --> 42:32.960]  It's basically really good code completion.
[42:34.180 --> 42:34.620]  Or...
[42:34.620 --> 42:35.700]  Personality completion.
[42:35.880 --> 42:36.160]  I don't know.
[42:39.760 --> 42:40.780]  Imagine you had...
[42:40.780 --> 42:41.400]  Um...
[42:41.400 --> 42:43.360]  Roughly 40% autonomy.
[42:43.800 --> 42:45.480]  What is the remaining 60%?
[42:45.620 --> 42:48.300]  Is it, like, doing recalling, choosing exploits, and you're, like...
[42:48.920 --> 42:51.520]  Adjusting pods ads, or...
[42:51.520 --> 42:52.980]  Using different tools for all the...
[42:52.980 --> 42:53.300]  Yeah.
[42:53.760 --> 42:54.040]  Um...
[42:54.040 --> 42:54.940]  So the question was...
[42:54.940 --> 42:55.900]  I got it to 40%.
[42:55.900 --> 42:57.000]  What was the rest?
[42:57.320 --> 42:59.300]  I would say, um...
[43:00.580 --> 43:01.080]  I...
[43:01.080 --> 43:01.440]  I...
[43:01.440 --> 43:03.220]  I might not have given myself enough credit.
[43:04.760 --> 43:05.260]  Um...
[43:05.260 --> 43:05.680]  Initially.
[43:06.880 --> 43:07.380]  Uh...
[43:07.380 --> 43:07.620]  I...
[43:07.620 --> 43:07.820]  I...
[43:07.820 --> 43:09.020]  I think I'm pretty good at this stuff.
[43:09.140 --> 43:09.300]  The...
[43:09.300 --> 43:10.560]  The offensive security part.
[43:10.580 --> 43:11.760]  I just, um...
[43:12.190 --> 43:14.540]  When I first started Hack the Box, uh...
[43:14.540 --> 43:16.260]  I barely had my...
[43:16.260 --> 43:17.580]  I was just starting off in security.
[43:17.580 --> 43:18.760]  This was, like, eight years ago.
[43:19.160 --> 43:22.580]  And since then, I've been doing red teaming for, like, four years, at least.
[43:23.180 --> 43:27.720]  And Hack the Box just added a bunch of Active Directory, um...
[43:27.720 --> 43:29.940]  Boxes on there for you to exploit, which they didn't have when...
[43:29.940 --> 43:30.920]  When I was trying.
[43:31.980 --> 43:32.420]  Um...
[43:32.420 --> 43:33.580]  So it's a combination of me...
[43:34.280 --> 43:38.240]  Happening to be really good at the Active Directory exploiting stuff.
[43:39.240 --> 43:39.680]  Um...
[43:39.680 --> 43:40.620]  To the point where I...
[43:40.620 --> 43:42.040]  I just kinda knew to...
[43:42.040 --> 43:42.820]  To say...
[43:42.820 --> 43:45.080]  Hey, try this particular exploit.
[43:45.080 --> 43:48.260]  And if the AI doesn't know the exploit, it'll research on its own.
[43:49.440 --> 43:49.920]  Um...
[43:49.920 --> 43:50.260]  It...
[43:50.800 --> 43:52.080]  It was basically...
[43:52.900 --> 43:54.080]  Three steps above...
[43:54.940 --> 43:56.380]  Me Googling it for itself.
[43:56.640 --> 43:58.340]  Because it would do stuff like...
[43:58.340 --> 44:00.720]  Look for the exploit, and then...
[44:00.720 --> 44:02.060]  Download it for me, and compile it for me.
[44:02.540 --> 44:03.020]  Or...
[44:03.020 --> 44:06.020]  Look for the exploit, and give me the exact command.
[44:06.020 --> 44:07.920]  And that's like...
[44:08.440 --> 44:08.900]  That's...
[44:08.900 --> 44:09.000]  That's...
[44:09.000 --> 44:09.780]  It's just really nice.
[44:09.960 --> 44:10.420]  Like...
[44:10.420 --> 44:13.040]  Not having to type on the terminal...
[44:13.840 --> 44:15.760]  Over the course of several hours.
[44:16.180 --> 44:18.320]  Not having to figure out the flags.
[44:18.620 --> 44:19.740]  Figure out the exact...
[44:19.740 --> 44:20.020]  Um...
[44:20.020 --> 44:20.940]  Syntax and stuff like that.
[44:21.100 --> 44:21.640]  It's just...
[44:21.640 --> 44:23.120]  It takes a load off you.
[44:23.240 --> 44:23.540]  And it...
[44:23.540 --> 44:24.200]  It adds up.
[44:25.680 --> 44:26.140]  So...
[44:26.140 --> 44:27.140]  And also...
[44:27.140 --> 44:27.520]  It's...
[44:27.520 --> 44:28.140]  It's guesswork.
[44:28.980 --> 44:29.440]  Like...
[44:29.870 --> 44:32.040]  When I said 60%, I didn't measure it in a good way.
[44:32.620 --> 44:33.140]  So...
[44:33.140 --> 44:33.380]  Um...
[44:33.380 --> 44:34.860]  I guess related to that is...
[44:34.860 --> 44:36.220]  A lot of...
[44:36.740 --> 44:38.040]  Tap to the flags and...
[44:38.560 --> 44:38.960]  Uh...
[44:38.960 --> 44:40.920]  Hack the box challenges are...
[44:40.920 --> 44:42.080]  Intentionally contrived.
[44:42.180 --> 44:43.680]  So you've got the readme that...
[44:43.680 --> 44:45.240]  And it's like a...
[44:45.240 --> 44:46.200]  Winked in a nudge...
[44:46.200 --> 44:47.420]  In a particular direction.
[44:48.060 --> 44:50.140]  How well does this perform with...
[44:50.140 --> 44:51.320]  Much more...
[44:51.320 --> 44:51.740]  I guess...
[44:51.740 --> 44:52.940]  Open-handed...
[44:52.940 --> 44:53.840]  Problems where...
[44:53.840 --> 44:54.420]  Oh...
[44:54.420 --> 44:55.780]  There might not even be...
[44:55.780 --> 44:57.320]  A CVE that you can look up.
[44:57.680 --> 44:58.200]  Yeah.
[44:58.440 --> 44:59.180]  So the question is...
[44:59.180 --> 44:59.300]  Um...
[44:59.300 --> 45:00.460]  How does this perform...
[45:00.460 --> 45:01.540]  On more...
[45:01.980 --> 45:03.720]  Basically black box...
[45:04.540 --> 45:04.940]  Um...
[45:04.940 --> 45:05.740]  Type...
[45:05.740 --> 45:07.180]  Engagements where it's open-ended...
[45:07.180 --> 45:08.160]  And you don't have like CVEs...
[45:08.160 --> 45:08.560]  And exploits...
[45:08.560 --> 45:09.000]  And stuff like that.
[45:09.720 --> 45:10.120]  Um...
[45:10.120 --> 45:11.820]  In the same way that I did hack the box...
[45:11.820 --> 45:12.500]  It was just like...
[45:12.500 --> 45:13.060]  It was...
[45:13.060 --> 45:13.640]  It was...
[45:14.140 --> 45:15.760]  I wouldn't say that it was...
[45:16.300 --> 45:17.020]  Giving me...
[45:17.020 --> 45:17.440]  I...
[45:17.440 --> 45:17.700]  I...
[45:17.700 --> 45:19.800]  I would say most of the time...
[45:20.620 --> 45:21.020]  I...
[45:21.020 --> 45:21.860]  As a...
[45:23.000 --> 45:23.800]  Seasoned-ish...
[45:23.800 --> 45:25.440]  Pen tester and red teamer...
[45:25.440 --> 45:26.900]  Kinda knew where to look already.
[45:26.900 --> 45:28.080]  So it...
[45:28.080 --> 45:28.500]  It...
[45:28.500 --> 45:28.700]  It...
[45:28.700 --> 45:29.600]  It really starts with the human.
[45:30.200 --> 45:30.720]  And...
[45:30.720 --> 45:32.320]  And then the AI helps you.
[45:33.180 --> 45:33.700]  If...
[45:33.700 --> 45:33.980]  If...
[45:33.980 --> 45:36.240]  If ever you can solve a puzzle...
[45:36.240 --> 45:36.500]  Or...
[45:36.500 --> 45:37.780]  Or a CTF...
[45:37.780 --> 45:40.340]  Where it's AI from 0 to 100...
[45:40.340 --> 45:40.720]  It's just...
[45:40.720 --> 45:41.720]  It's just not a good puzzle.
[45:42.060 --> 45:42.460]  Essentially.
[45:42.880 --> 45:43.300]  Oh!
[45:43.480 --> 45:43.780]  Um...
[45:43.780 --> 45:44.940]  With the exception of...
[45:44.940 --> 45:46.900]  Coding exercises in hack the box.
[45:47.760 --> 45:48.280]  Um...
[45:49.040 --> 45:50.720]  It was really good at do...
[45:50.720 --> 45:51.840]  So all the coding...
[45:51.840 --> 45:52.400]  Oh man...
[45:52.400 --> 45:54.320]  All the coding exercises on hack the box.
[45:54.920 --> 45:55.360]  Um...
[45:55.360 --> 45:56.520]  You can just copy-paste it.
[45:56.660 --> 45:57.080]  And it...
[45:57.080 --> 45:57.340]  It...
[45:57.340 --> 45:58.280]  It usually one-shots it.
[45:58.440 --> 45:58.600]  It was...
[45:58.600 --> 45:59.400]  It was really good at that.
[46:00.500 --> 46:00.940]  Um...
[46:00.940 --> 46:02.320]  Even like the hard...
[46:02.320 --> 46:03.740]  And insane level difficulties.
[46:04.180 --> 46:04.520]  But...
[46:04.520 --> 46:05.720]  Besides that...
[46:05.720 --> 46:05.940]  You...
[46:05.940 --> 46:06.880]  You still need to...
[46:06.880 --> 46:08.020]  You still need to know what you're doing.
[46:09.740 --> 46:10.180]  Yeah.
[46:14.570 --> 46:15.270]  Anyone else?
[46:17.470 --> 46:18.570]  Thank you.