The Ultimate AI/LLM/ML Penetration Testing Training Course

The Ultimate AI/LLM/ML Penetration Testing Course

Your instructor is Martin Voelk. He is a Cyber Security veteran with 25 years of experience. Martin holds some of the highest certification incl. CISSP, OSCP, OSWP, Portswigger BSCP, CCIE, PCI ISA and PCIP. He works as a consultant for a big tech company and engages in Bug Bounty programs where he found thousands of critical and high vulnerabilities.

This course has a both theory and practical lab sections with a focus on finding and exploiting vulnerabilities in AI and LLM systems and applications. The training is aligned with the OWASP Top 10 LLM as well as the OWASP Top 10 Agentic vulnerability classes. The videos are easy to follow along and replicate.

The course features the following:

· Prompt Injection

· Sensitive Information Disclosure

· Supply Chain

· Data and Model Poisoning

· Improper Output Handling

· Excessive Agency

· System Prompt Leakage

· Vector and Embedding Weaknesses

· Misinformation

· Unbounded Consumption and DoS

· OWASP PwnzzAI Shop

· OWASP Finbot (new)

· OWASP Top 10 for Agentic Applications

· Portswigger - Agentic AI Labs

· Prompt Airlines CTF Challenge Walkthrough

· SecOps Group AI/ML Mock Exams 1 & 2 Walkthrough

· OWASP Finbot CTF (old)

· Selara Jailbreak Game CTF

· Gandalf Agent Breaker CTF

· Hack The Agent CTF

· AI Prompt Attack and Defense Game Tensortrust

· Crowdstrike AI Unlocked Challenge

· Game Arena Challenges

· Other CTFs

· Jailbreaking

· AI Browsers Attacks

· AI Coding Agents Attacks

· MCP Attacks

· Multimodal Attacks (Images, Audio and Video)

· Tooling

Notes & Disclaimer

Portswigger labs are a public and a free service from Portswigger for anyone to use to sharpen their skills. All you need is to sign up for a free account. I will to respond to questions in a reasonable time frame. Learning Pen Testing / Bug Bounty Hunting is a lengthy process, so please don’t feel frustrated if you don’t find a bug right away. Try to use Google, read Hacker One reports and research each feature in-depth. This course is for educational purposes only. This information is not to be used for malicious exploitation and must only be used on targets you have permission to attack.