PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Pentesting for AI and Large Language Models

hackerone.com | blog | #ai-security | #pentesting | #llm | #owasp | #hackerone | #ptasa | #mitre-atlas
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne's community-driven PTaaS targets AI/LLM-specific vulnerability classes, testing against OWASP Top 10 for LLM Applications, MITRE ATLAS, and NIST AI RMF with regulatory alignment.
Published
Collected

Related coverage

blog · hackerone.com
Measuring The Fix: How We Evaluate Frontier Models on Remediation Quality
HackerOne tested frontier models on security fix quality and found the judge mattered more than the model. See how CTEM remediation earns engineer trust.
blog · aikido.dev
Aikido launches external network pentesting
TL;DR: Aikido now pentests your external network. Attackers already test your perimeter every day, and with AI agents doing the grunt work, they're faster than ever. Now you can run the same test first. Give our agents one domain and they'll map the internet-facing systems you run and attack them from the outside, exactly like a malicious actor would.
blog · aikido.dev
Adding Aikido AI pentesting to your existing security stack
How to add Aikido's AI pentesting on top of the SAST, SCA and cloud tools you already run, from your first pentest through whitebox testing, continuous testing and remediation.
blog · netspi.com
Fuzzing Parameters in CSRF Resistant Applications with Burp Proxy
A NetSPI walkthrough of CSRF basics and using Burp Proxy to fuzz parameters in CSRF-resistant apps, covering attack vectors from image tags to XSS-chained requests and why token fixes are imperfect.
blog · netspi.com
Presenting at OWASP AppSec Conference
A NetSPI preview of their OWASP AppSec talk on escalating privileges through database trusts, promising three root causes, three attack scenarios, and five fixes for weak app-DB configurations.
blog · hackerone.com
Critical PHP Vulnerabilities: What Security Teams Need to Know
Learn about the critical PHP vulnerabilities, HackerOne’s response, and the rise in reports. Review patching guidance and coordinated disclosure practices.
Back