La primera plataforma de recompensa por errores del mundo para IA/ML
Envía vulnerabilidades y asegura la seguridad de las aplicaciones de IA/ML
Más contacto, visite la página de contacto(https://huntr.com/contact-us)
huntr Nombre de la empresa: huntr .
Enlace de Linkedin de huntr: https://www.linkedin.com/company/huntrai/
Enlace de Twitter de huntr: https://twitter.com/huntr_ai
Por Oliver el Mayo 16 2024
¡Descubre 15 Secretos Comprobados para Detectar Errores!
Escucha en redes sociales
Get On This New Bug Bounty Platform Now And Make Easy $$$ - Huntr.com
Huntr.com Uncle rat's courses: https://thexssrat.podia.com Become a member of this channel to unlock special perks: https://www.youtube.com/channel/UCjBhClJ59W4hfUly51i11hg/join You can now Buy me a block of cheese: https://www.buymeacoffee.com/thexssrat Patreon: https://www.patreon.com/TheXSSRat Instagram: thexssrat Follow me on twitter to be notified when i release a new video: https://twitter.com/theXSSrat Come join our discord :D i hang out there often! https://discord.gg/8rUtHj9 #bugbounty #bugbountytips #bugbountyhunter
Generative AI & Security, OWASP Top 10 for LLMs
In this video, Oleksii Borysenko reviews Generative AI & Security, a list of OWASP Top 10 for LLMs with related examples, and which tools and model scanners can help with AI security. 00:00 – Intro 00:29 – LLM01: Prompt Injections 01:16 – LLM02: Insecure Output Handling 02:19 – LLM03: Training Data Poisoning 02:54 – LLM04: Model Denial of Service 03:28 – LLM05: Supply Chain Vulnerabilities 04:34 – LLM06: Sensitive Information Disclosure 05:13 – LLM07: Insecure Plugin Design 06:02 – LLM08: Excessive Agency 07:23 – LLM09: Overreliance 08:20 – LLM10: Model Theft 09:31 – Hugging Face security features 10:11 – Huntr - bug bounty platform for AI/ML OWASP Top 10 for LLM Applications https://www.llmtop10.com/ Learn more on the Cisco DevNet AI Hub: https://cs.co/ai-hub Bug bounty platform for AI/M https://huntr.com/ Oleksiis Twitter/X - https://twitter.com/alex_dev_k More information about Generative AI and how to run open-source large language models you can discover in the following DevNet Learning Lab https://developer.cisco.com/learning/labs/explore-generative-ai/explore-generative-ai-capabilities/
403 Bypass and Deserialization in BentoML Library (CVE-2024-2912) - "Summar-AI-ze" [Web Challenge]
🚩 Video walkthrough for the "Summar-AI-ze" (web) challenge I created and hosted on my NEW website (https://cryptocat.me)!! Players were required to bypass a 403 error by using the X-Forwarded-For HTTP header, allowing them to activate an internal feature and grant their account beta access. The "beta" feature was a word summarization tool, running BentoML (LLM) on the backend. Players could identify the library by changing the content-type, triggering an error. Some research would yield CVE-2024-2912; a python pickle deserialization vulnerability, discovered by PinkDraconian 💜 Players could use the supplied PoC to gain code execution and exfiltrate the flag using curl 😎 #CTF #Challenge #CryptoCat Check out the accompanying writeup here: https://book.cryptocat.me/ctf-writeups/2024/cryptocat/summaraize Join discord for source code and early access to future challenges: https://discord.cryptocat.me 🐛CryptoCat CTF Challenges🐞 https://challenge.cryptocat.me - https://discord.gg/qHbAN3wfRK 👷♂️Resources🛠 403 bypasses ( @NahamSec ): https://www.youtube.com/watch?v=PvpXRBor-Jw bento_ml CVE ( @PinkDraconian ): https://huntr.com/bounties/349a1cce-6bb5-4345-82a5-bf7041b65a68 https://cryptocat.me/resources Overview: 0:00 Intro 0:42 Burpsuite config 1:22 Explore functionality 2:25 Identify hidden/disabled endpoint 3:04 403 bypass (burp extension) 5:46 Beta panel access 6:37 Session handling rules in burp 9:33 Discover BentoML library 10:37 Pickle deserialization 13:38 Exfiltrating the flag 14:12 Automating exploit with python 14:56 Summary 16:21 Conclusion
Un total de 30 datos de redes sociales deben desbloquearse para su visualización