Comment by Retr0id
1 day ago
Using LLMs for RE and bug hunting is a lot of fun. Today I reported an absolute doozy of a bug to Google's VRP. The vuln was in an HTTP API endpoint I don't have the source for, only RE'd client logic.
The idea behind the bug was mine, it was of the "surely they weren't stupid enough to forget to do xyz" variety. Writing the code to probe for the vulnerability by hand would've taken a few hours of grunt work, including reconstructing protobuf schemas etc. In the past I just wouldn't have bothered, because in my view the odds of success were too low to be worth it. But it was a one-sentence prompt so why the hell not. And it worked!
I find whenever I do this I run into the bullshit cyber guardrails. What model are you using and how are you prompting it?
Opus 5 with CVP, no special prompting. In this instance just about any larger model from the last 12 months would have done the trick.
>with CVP
Ah, there's the rub.
1 reply →