Roadmap

Exploit a real SSRF attack in a link-preview SaaS to reach the cloud metadata service (IMDS), steal the instance's temporary IAM credentials, and abuse an over-permissive role to read an internal secret. Run the full SSRF-to-cloud chain hands-on in the Attack Terminal.

Your .docx is a ZIP. Your invoice PDF can be a Word macro in disguise. You'll unzip an Office file, dissect a PDF with pdf-parser, and out a polyglot by the two bytes that betray it. One file, two formats, zero alerts. 🗂️

Your phone refuses to scan a damaged QR. Good. You don't need it. You'll read codes from a file with zbarimg, invert and repair a broken one in an editor, and follow a QR into base64 and a cipher. 🔍

A message can hide in text with zero visible change. Zero-width characters and trailing tabs slip whole paragraphs past your eyes. You'll expose them with xxd and cat -A, decode the SNOW tool's whitespace, and spot homoglyph look-alikes. 👻

Audio hides secrets your ears skip. A spectrogram turns sound into a picture, and hidden text, faces, and Morse tones jump out. You'll use Audacity and Sonic Visualiser to read messages drawn in the high frequencies. No GPU needed. 🔊

Learn how to jailbreak an AI by prompt-injecting a real language model to leak its hidden system prompt and abuse its internal tool. A hands-on OWASP LLM01 and LLM06 lab you solve from the Attack Terminal with curl.

Re-encoding an upload quietly destroys most hidden data, and statistics catch much of what survives. You'll batch-score images with StegExpose (chi-square, RS, sample pairs), confirm a hit with zsteg, and chain the whole course on one file. 🔬

The model can't tell the company's rules from a stranger's commands. You'll build your own AI assistant, watch it guard a secret, then slip past that guard with one sentence: the move that keeps leaking secrets out of real AI products. 🔓

When OpenAI shipped function calling in 2023, it gave assistants real powers and extended the attack surface to every tool. You'll build that exact loop, feed it a poisoned result, and watch the model obey injected text. 🔧

This is the move that named the field. You'll take a bot hardened to refuse you and beat it three ways: reframe its goal, hide behind a persona, and poison an earlier turn. Then measure how often each works, like a real assessment does. 🎯

The attacker never types a word. They hide instructions in a page, an email, a document, and the victim's own assistant obeys them with the victim's access. You'll build a summarizer and hijack it from the content alone. 📄

A jailbreak does not break your code, it bends the model's trained "no." You'll take a refusal your own bot gives, then walk past it with role-play, encoding, and splitting, measuring how often each one wins. 🔓

Telling a model "never reveal the key" is not a control. You'll plant a fake API key in a system prompt, watch the bot guard it, then drain it with one polite request: the leak class behind real AI incidents. 🔑

The chat box isn't the only way in. You'll build a tiny RAG, plant one poisoned document, and watch a normal question return an attacker's answer: indirect prompt injection through the documents a model trusts. 🧫