Writeups and solutions for AI/LLM security challenges that I solved.
| # | Challenge | Platform | Category | Technique | Writeup |
|---|---|---|---|---|---|
| 1 | External Affairs | Hack The Box | Prompt Injection | Direct prompt injection via delimiter injection to force a GRANTED verdict |
Writeup |
| 2 | trynaSob Ransomware | Hack The Box | Prompt Injection | System prompt extraction via translation attack to leak the promo code / flag | Writeup |
| 3 | Loyalty Survey | Hack The Box | Agentic AI Hijacking | Prompt injection in survey answers to hijack an AI agent into calling update_citizen_score(score: 100) |
Writeup |
| 4 | Doctrine Studio | Hack The Box | SSRF / LFI via Agentic Tool Abuse | SSRF → LFI by forcing the agent to call fetch_news("file:///flag.txt") |
Writeup |
| 5 | Indirect Prompt Injection | PortSwigger | Indirect Prompt Injection | Poisoning a product review with a JSON-breaking payload to make the chatbot call delete_account on Carlos |
Writeup |