LLM Red-Team
Reflection is not exploitation. A model that echoes your payload is noise; a model that acts on it — leaks its system prompt, emits your canary, calls a tool, renders raw HTML downstream — is a bug. Prove the action, then chain it to concrete impact.
This is the first-class LLM-attack skill. The scanner behind it is tools/llm_redteam.py (canary-based corpus runner, /llm-redteam). For auditing an MCP server, use skills/mcp-server-audit; for attacking a deployed agent black-box, use skills/agentic-app-audit.
0. QUICK KILL CHECKLIST
Kill the lead (classify Informational, move on) when:
- The model refuses and no canary / leak / tool-call ever lands. "It said something edgy" is not a finding.
- System-prompt "leak" is just generic assistant boilerplate ("I am a helpful assistant"), not the target's actual instructions.
- Prompt injection fires but reads/changes nothing the current user couldn't already access (no cross-tenant data, no tool with impact).
- Output looks like XSS but the host app escapes it before rendering (check the actual downstream sink, not the chat response).
- Exfil payload is a markdown image beacon but the client never fetches remote images.
1. ROUTING TABLE — signal on target -> what to run
| Signal | Run |
|---|---|
| Any chat/assistant endpoint | tools/llm_redteam.py --url <endpoint> --field <json-field> (full corpus) |
| OpenAI-style API | --template '{"messages":[{"role":"user","content":"{{PAYLOAD}}"}]}' --response-path choices.0.message.content |
| Only want one class | --category jailbreak (see --list-categories) |
| Uploads/RAG/"summarize this doc" | indirect-injection + token-smuggling (invisible unicode in the doc) |
| Agent has tools | excessive-agency category + skills/agentic-app-audit |
| Confirm blind exfil | plant a canary host, correlate with tools/oob_listener.py |
2. ATTACK CLASSES (corpus categories)
The runner fires a canary per run (RT_PWNED_xxxx); a category "lands" when the canary / a real leak / a tool-call shows up in the response.
- prompt-injection — direct instruction override, delimiter breaks.
- jailbreak — DAN / developer-mode persona escape.
- system-prompt-leak — repeat-above, keyword-anchor, scenario-escape.
- data-exfil — markdown-image beacon / canary emission to an attacker host.
- indirect-injection — payload framed as a retrieved document / tool result (the high-value one for RAG apps).
- guardrail-bypass — base64 / split-string instruction smuggling.
- multi-turn-crescendo — single-shot simulation of a gradual escalation jailbreak.
- cross-lingual — override instruction in another language to dodge English-only filters.
- cipher-obfuscation — leetspeak / ROT13-wrapped instruction.
- token-smuggling — invisible "Sneaky Bits" unicode (U+2062/U+2064) carrying a hidden instruction (shared encoder with
tools/hai_payload_builder.py). - excessive-agency — coerce an unsafe tool call / exfil (SSRF via "fetch URL", email send, payment).
- insecure-output — get the model to emit raw HTML/script that a downstream sink renders (XSS via AI).
3. CANONICAL OWASP ASI01-ASI10 (single source of truth)
This table is the ONE authoritative ASI mapping for the whole toolkit — skills/bug-bounty and skills/web2-vuln-classes both defer to it. If you edit the taxonomy, edit it here.
| ID | Class | What to test | Chain to |
|---|---|---|---|
| ASI01 | Prompt Injection / Goal Hijack | Override objectives via direct or indirect injection | IDOR / exfil / tool abuse |
| ASI02 | Tool Misuse | Attacker-controlled tool params ("fetch this URL", code tool) | SSRF / RCE |
| ASI03 | Privilege Compromise | Agent uses broader perms / admin tokens than the user | Priv-esc / cross-tenant |
| ASI04 | Supply Chain | Compromised plugin / MCP server / tool-output poisoning next agent | RCE / data theft |
| ASI05 | Code Execution | Unsafe code-interpreter / sandbox escape | RCE |
| ASI06 | Memory & Context Poisoning | Persistent RAG/memory corruption across sessions/users | Stored injection affecting all users |
| ASI07 | Agent Communication | Inter-agent spoofing / IDOR (agent A reads agent B's context) | Cross-tenant disclosure |
| ASI08 | Excessive Agency | Destructive action without confirmation; cascading failures | Funds/email/delete |
| ASI09 | Insecure Output Handling | AI output rendered as XSS / SQLi / command injection downstream | XSS / injection |
| ASI10 | Sensitive Information Disclosure | Leaks system prompt / keys / configs / user data | Secrets -> deeper access |
Triage rule: ASI alone = Informational. It is a bounty only when chained to IDOR / exfil / RCE / ATO with a working PoC.
4. CHAIN TO IMPACT (what makes it payable)
| Standalone | Chain | Result |
|---|---|---|
| Prompt injection | + reads another user's conversation/data (IDOR) | High |
| Indirect injection (RAG doc) | + persists in memory -> hits every user | High/Critical |
| Tool misuse "fetch URL" | + hits internal service / IMDS and returns data | SSRF (Medium/High) |
| Insecure output | + the host renders it -> stored XSS -> session theft | High |
| System-prompt leak | + the prompt contains an API key / internal URL | High |
| Excessive agency | + unconfirmed destructive action (send funds, delete) | High/Critical |
5. CONFIRMATION DISCIPLINE (no false positives)
- A category only counts when the canary / real leak / tool-call is observed in the response — never on "it sounded compliant."
- For blind exfil, require a correlated out-of-band callback (
tools/oob_listener.py), not just a rendered beacon tag. - For insecure-output XSS, confirm execution at the downstream sink with the XSS verifier (
tools/verifiers/xss.py/tools/dom_xss_harness.py), not in the chat reply. - Record the exact payload + response excerpt; the report must be reproducible verbatim.
