Chargement...
Vulnerability Assessment
CVE analysis and security testing of AI systems and frameworks
Techniques disponibles
MCP DNS Rebinding Attack
(MCP-DNSRb)Critical vulnerability (CVE-2025-49596) in Anthropic's Model Context Protocol allowing remote code execution via DNS rebinding attacks.
Points clés
- •DNS rebinding exploitation
- •Localhost port targeting
- •Authentication bypass
Primary Defenses
- •Session token implementation
- •Origin and Host header validation
- •CSRF protection mechanisms
Key Risks
AI Framework CVE Scanning
(AI-CVE)Systematic identification and assessment of known CVEs in AI/ML frameworks, libraries, and dependencies used in AI systems.
Points clés
- •Automated vulnerability scanning
- •Dependency tree analysis
- •CVSS score assessment
Primary Defenses
- •Regular dependency updates
- •Automated vulnerability scanning
- •Software composition analysis (SCA)
Key Risks
LLM API Security Testing
(LLM-API)Comprehensive security testing of LLM APIs for authentication bypasses, injection vulnerabilities, and access control issues.
Points clés
- •Authentication mechanism testing
- •API endpoint enumeration
- •Rate limiting validation
Primary Defenses
- •Strong authentication mechanisms
- •Proper authorization checks
- •Input validation and sanitization
Key Risks
AI Model Backdoor Detection
(BD-Detect)Detection and analysis of backdoor vulnerabilities in AI models that activate malicious behavior when specific triggers are encountered.
Points clés
- •Trigger pattern analysis
- •Model behavior monitoring
- •Statistical anomaly detection
Primary Defenses
- •Model provenance verification
- •Behavioral analysis during training
- •Statistical testing for anomalies
Key Risks
Ethical Guidelines for Vulnerability Assessment
When working with vulnerability assessment techniques, always follow these ethical guidelines:
- • Only test on systems you own or have explicit written permission to test
- • Focus on building better defenses, not conducting attacks
- • Follow responsible disclosure practices for any vulnerabilities found
- • Document and report findings to improve security for everyone
- • Consider the potential impact on users and society
- • Ensure compliance with all applicable laws and regulations
Par l’ingénieur derrière ce catalogue
Faites red-teamer votre système d’agents
Les attaques documentées ici fonctionnent chaque jour sur des systèmes d’agents en production. Faites tester le vôtre avant qu’un autre ne s’en charge : injection de prompt, jailbreaks, détournement d’outils et exfiltration de données, chaque constat rédigé avec son correctif.
750 € au lieu de 1 500 €, une semaine, rapport écrit et appel de restitution, jusqu’au 30 septembre