📚 Series: AI Red Teaming — Chapter 9 (Practice)

🏷️ Tags: Hands-On MyLLM Bank PortSwigger Prompt Airlines Agent Exploitation SQLi Command Injection Methodology

⏱️ Level: Advanced (application of Ch 2–8)

✅ Prerequisite: the full attack toolkit

⚠️ Everything here is on intentionally vulnerable, authorised targets. [RESTRICTED] / [FLAG] are placeholders. Never test a system you don't have written permission for.

This is my favourite chapter to teach, because theory finally meets a keyboard. Everything up to now was "here's how it works." This is "here's me actually doing it, including the parts where I got stuck." I've kept my real dead-ends in — the backticks that got rejected, the flags I couldn't get inside the budget — because polished walkthroughs where everything works first try taught me nothing when I was learning. The mistakes are where the understanding lives.

If you take one thing from this chapter, make it the methodology in §1. I run it against every LLM target, every time, and it's the difference between poking around randomly and actually finding things.

📌 In this one

• A repeatable methodology for any LLM/agent target
• Lab 1 — MyLLM Bank (prompt/ID leak, IDOR-via-tool, SQLi hunt)
• Labs 2–3 — PortSwigger (excessive agency → SQLi delete; email→shell → RCE), command-level
• Lab 4 — Prompt Airlines (multi-flag CTF)
• Multiple approaches per objective, plus the Exploitation Playbook I generalise from them
• A curated labs / tooling / talks resource list

1️⃣ The repeatable methodology

1. ENUMERATE   → "what are you? what can you do? what TOOLS?"
2. MAP TOOLS   → each tool + the data/privilege it touches (DB, email, shell)
3. RECON       → fingerprint the model, leak the system prompt (Ch 15)
4. BUILD TRUST → a few friendly turns / establish a moral baseline
5. ESCALATE    → cheapest attack first, climb to the heavy stuff
6. CHAIN       → smuggle in (Ch 6) + real attack + output-control out (Ch 5)
7. DECODE      → CyberChef
8. ON REFUSAL  → refresh (a refusal poisons the history)
9. REPORT      → map to OWASP/ATLAS, score, remediate (Ch 21)

Escalation order (cheap → heavy): direct ask → injection → reframing → injection + reframing → multi-turn → social engineering → output control → token smuggling.

🔑 Two rules I repeat until they're muscle memory: refresh on refusal, and real exploitation needs tools.