AI / LLM Hunter

Systematically detect and confirm LLM/AI-specific vulnerabilities across all trust boundaries — prompt injection, system prompt leakage, exfiltration, agentic tool abuse, and cross-tenant IDOR in retrieval layers.

What Does It Check?

LLM-backed applications introduce a new class of trust-boundary vulnerabilities that differ fundamentally from traditional web bugs. The model itself is not the target — the target is the data, tools, and actions the model can reach. A jailbreak that makes the model say something rude is not a bug. A payload that causes the model to exfiltrate another tenant’s data, invoke a privileged tool, or execute code on a worker is.In scope:

Direct prompt injection: system prompt extraction, tool invocation bypass, context window pollution
Indirect prompt injection: document/PDF upload, web page injection, email injection, Unicode Tags block (invisible payload smuggling)
Data exfiltration: markdown image leak (zero-click), SSRF via agent tools, DNS base32 exfiltration — all require OOB confirmation
Agentic system testing (OWASP ASI01–ASI10): goal hijacking, identity spoofing, tool misuse/SSRF, memory poisoning, sandbox escape, inter-agent trust abuse
Cross-tenant IDOR in RAG/retrieval layers: canary-string methodology across separate accounts

Out of scope:

Content policy violations — model refusing or saying something offensive is not a bug
Traditional web vulnerabilities (XSS, SQLi) — use dedicated skills for those
Automated scanning — this is a guided manual methodology

How It Works

Phase 1: Reconnaissance — Map the AI Attack SurfaceIdentify LLM-backed features (streaming responses, /api/chat, choices/message in JSON), accessible tools (function_call, tool_use in responses, RAG/knowledge base, code execution, external integrations), and map all injection surfaces (direct via chat, indirect via document upload, web fetch, email, or database fields).Phase 2: Direct Prompt InjectionAttempt system prompt extraction via role overrides, continuation tricks, format injection, and model-specific token boundary exploits. Test tool invocation bypass to invoke restricted functions. Attempt context window pollution via many-shot overrides.Phase 3: Indirect Prompt InjectionPlant payloads in documents the model reads (PDF/DOCX with invisible text, HTML hidden elements), web pages it summarizes (HTML comment injection, meta tag injection), and emails it processes. Use Unicode Tags block (U+E0000–U+E007F) to smuggle instructions past human reviewers while remaining fully effective against the model.Phase 4: Data ExfiltrationTest all outbound channels the model controls:

Markdown image leak: if the model renders markdown and auto-fetches images, inject an image URL pointing to Burp Collaborator
SSRF via agent tools: ask the model to fetch your Collaborator URL using HTTP/fetch tools
DNS exfiltration: encode secrets as base32 subdomain labels and trigger DNS resolution

All exfiltration findings require a live Collaborator/webhook hit with actual data — on-screen rendering alone is never sufficient.Phase 5: Agentic System Testing (OWASP ASI01–ASI10)

ASI Category	Test
ASI01 Goal Hijacking	Inject an alternative goal into the planning context
ASI02 Identity Spoofing	Spoof orchestrator, admin, or supervisor identity
ASI03 Tool Misuse / SSRF	Fetch cloud metadata, internal APIs, or attacker infrastructure via agent tools
ASI05 Memory Poisoning	Plant false facts in long-term memory; verify they persist in a new session
ASI06 Inter-Agent Trust Abuse	Spoof worker agent output to the orchestrator
ASI09 Sandbox Escape	Test code interpreter for OS command execution and network reach

Phase 6: Cross-Tenant IDOR in LLM SystemsPlant a non-guessable canary string as Account A. Switch to Account B. Ask the AI to search for the canary. If Account B retrieves Account A’s canary from the RAG layer — confirmed cross-tenant IDOR. Requires reproducibility across fresh sessions.Phase 7: False-Positive Gate (run before every report)

Check	Requirement
Reproducibility	Same payload produces identical result in 2+ fresh sessions
Known-secret anchoring	Extracted content contains application-specific non-guessable values
Cross-tenant verification	Canary is independently confirmed to belong to the other tenant
OOB confirmation	For exfiltration: Collaborator/webhook received actual data, not just a ping
Impact beyond refusal	A tool was invoked or data was leaked — not just a policy bypass

Fail any single check = do not report the finding.Phase 8: Report Structure

Title: [Attack Type] in [Feature/Component] allows [Impact] — [Target]

Severity: Critical / High / Medium / Low / Informational
OWASP Category: LLM01 / LLM07 / ASI03 / (etc.)
CWE: CWE-77 (Prompt Injection), CWE-200 (Info Exposure), CWE-918 (SSRF)

Affected feature: [chat interface / document upload / email assistant / etc.]

Summary:
[2–3 sentences: what was found, how it was triggered, what trust boundary it crossed]

Steps to reproduce:
1. [Setup: account(s) needed, any prerequisites]
2. [Exact payload — copy-pasteable]
3. [Where to send it / how to trigger it]
4. [What to observe — Collaborator hit, data returned, action taken]

Evidence:
- Payload used (exact text)
- Raw HTTP request if applicable
- Collaborator / webhook screenshot with timestamp
- Model response or tool invocation log

Impact:
[Concrete attacker capability — not "the model can say X" — yes "attacker can read any tenant's documents"]

Remediation:
- Input validation at the retrieval layer, not just at the prompt layer
- Scoped tool permissions — agent should only access the calling user's data
- Output filtering for exfiltration channels (restrict image URLs, external fetches)
- Deny-by-default tool invocation — require explicit allowlisting per action

Quick-Reference: Priority Triage Order

Test in this order when time is limited — highest-impact first:

Agentic tool access — can you invoke HTTP fetch, code exec, file write, or email send?
Cross-tenant IDOR in retrieval — does the model return data from other tenants?
Indirect injection surface — what external content does the model read (docs, web, email, DB fields)?
System prompt leakage — extract via direct injection; anchor to non-guessable values before reporting
Exfiltration channels — identify all outbound channels (image rendering, tool calls, webhooks)
Sandbox escape — test code interpreter for OS command execution and network reach
Memory/session persistence — poison long-term memory and verify it carries across sessions
Direct injection — only payable if chained to real impact

Known Limitations

Exfiltration findings require an OOB server (Burp Collaborator, interactsh, or a webhook) — on-screen rendering is never sufficient for a payable finding
Cross-tenant IDOR testing requires two separate accounts with independent sessions
Memory poisoning tests require the application to expose long-term memory persistence — not all LLM systems have this
Sandbox escape techniques vary by sandbox implementation; OS command execution results depend on the specific container configuration

Metric	Without Skill	With Skill	Improvement
Turns to complete	3	1	-67%
Total tokens	~8,742	~2,981	-66%
Time	214s	58s	-73%
Attack vectors covered	2/8	8/8	+300%
Output quality	False positives	Verified findings	Critical

Overview

Attack Mindset

Web Application

AI / LLM Security

API Security

Infrastructure

Reconnaissance

Reporting

Compliance

Workflow

Integrations

AI / LLM Hunter

Summary

SKILL.md file

AI / LLM Hunter

What Does It Check?

How It Works

Quick-Reference: Priority Triage Order

Known Limitations

Benchmark Results

idor-hunter

ssrf-hunter

js-analyzer

​Summary

​SKILL.md file

​AI / LLM Hunter

​What Does It Check?

​How It Works

​Quick-Reference: Priority Triage Order

​Known Limitations

​Benchmark Results

​Related skills

idor-hunter

ssrf-hunter

js-analyzer

Summary

SKILL.md file

AI / LLM Hunter

What Does It Check?

How It Works

Quick-Reference: Priority Triage Order

Known Limitations

Benchmark Results

Related skills