How to use AI and LLMs for Offensive and Defensive Security

Explore how to run local AI models for offensive and defensive security, including local hardware, front ends like Ohyama and web interfaces, and privacy considerations.

This Ollama setup demo on a Raspberry Pi shows CLI installation, model management with Tiny Dolphin, and a web UI with a Python virtual environment, plus API usage via curl.

Explore Replicate dot com for image, speech, video, and 3D generation, adjust prompts, size, and output quality, and learn about free vs paid access, safety checks, and prompt-injection risks.

Explore Hugging Face's model hub, download models to run locally for ethical hacking and pen testing. Discover spaces, data sets, voice cloning, text-to-voice, and uncensored jailbroken models for security applications.

Study prompting basics and system prompts for llms, including context windows, tokens, memory features, and persona-driven outputs. Explore zero-shot and few-shot prompting, and how temperature and top shape deterministic results.

Explore chain-of-thought prompting and prompt engineering techniques to boost LLM accuracy. Learn to design system prompts, few-shot and zero-shot strategies, expert personas, prompt leakage risks, and step-by-step reasoning.

Learn to interact with AI models via API using curl, including headers, content type, and authorization. Discover how to craft prompts, and integrate bots with scripts and playground tools.

Learn to use the OpenAI Playground to craft system prompts, adjust temperature and top settings, view Python code, and prototype functions for OSINT tasks and weather queries.

Explore prompt leakage through a live demonstration of prompt injection that reveals the system prompt of ChatGPT and other models, illustrating how prompts can be extracted in penetration testing.

Demonstrates prompt leakage by revealing the system prompt through encoding tricks such as leetspeak, base64, HTML, and Unicode, highlighting prompt injection risks in LLMs.

Explore LLM hallucination and overreliance, showing how models fabricate information, and how lowering the temperature improves reliability for cybersecurity tasks.

Explore prompting an LLM to surface its assumptions via an assumptions_made parameter and memory updates, with examples of API calls, weather lookups, and pizza order reasoning.

Explore how agentic LLMs take actions on websites, potentially solving captchas and bypassing human verification. The lecture demonstrates image-based captcha solving and discusses the application security implications of future attacks.

Use open source tools like YOLO and Fabric to enhance AI-assisted offensive and defensive security. Apply CLI workflows and prompt patterns to streamline red teaming and bug bounty tasks.

Explore the fabric AI framework you install locally to run AI prompts, analyze malware and documents, generate prompts, logos, and reports, and automate threat modeling and security workflows.

Discover the YOLO ai cmd bot's ability to install, run commands, fetch data like robots.txt, and manage security tasks with Metasploit payloads.

Access LLMs from the command line with an open-source CLI tool, installable via pip or brew on macOS, Linux, or Windows. Set an OpenAI API key and use system prompts.

Discover how ai and LLMs enable offensive security by creating bots with system prompts for red team tasks, subdomain enumeration, nuclear templates, and Burp Suite integration.

Explore offensive security with ai and llms, learning red teaming, phishing payloads, malware obfuscation, reverse shells, and c2 frameworks, then preview defensive security applications.

Explore how AI-powered pentest bots automate penetration testing and attack surface management, including Portswigger labs results. Note the limits and the ongoing need for human expertise in AI security.

Explore how an automated AI hacking bot uses HTTP requests and LLM prompts to identify web vulnerabilities like SQL injection and cross-site scripting.

Discover Burp AI's explore issue feature in Burp Suite Pro 2025, which analyzes requests and responses to assess issues like referrer leakage and reduce manual digging in labs.

Explore Burp Suite Pro's explainer feature, which uses an LLM to explain headers and requests during active testing, integrating explanations into your workflow.

Enable Burp AI’s login sequence in Burp Suite Pro to capture login steps with URL, username, and password, reducing setup time. Avoid credential sharing with the LLM in sensitive contexts.

Discover how Burp AI enhancements find broken access control at scale by configuring crawl and audit scans, toggling AI enhancements, and testing authenticated and unauthenticated requests.

Discover how the shadow repeater extension for burp pro runs in the background to automatically generate permutations of inputs, test them, and reveal payloads like url-encoded path traversal.

Explore the ai analyzer in Burp Suite Pro, a PortSwigger tool that analyzes requests and responses to reveal vulnerabilities like file inclusion and rfi, guiding testing with an llm.

Use burp AI's report LLM extension to generate customized Burp Suite reports from findings. Install the pro feature, select items like strict transport security issues, and generate reports for leadership.

Discover how Burp's MCP server enables AI agents to issue tool actions via the Model Context Protocol, using cloud desktop integration to access APIs, databases, and repeater tasks.

Explore using ai and llms for defensive security to defend against attacks. Build incident response playbooks, tabletop exercises, and blue team templates with customizable bots and prompts.

Explore stride threat modeling with ai-powered stride gpt to automate threat modeling from a network diagram, generate threat models, attack trees, and mitigation guidance for defensive security.