Загрузка...
Vulnerability Assessment
CVE analysis and security testing of AI systems and frameworks
Доступные техники
MCP DNS Rebinding Attack
(MCP-DNSRb)Critical vulnerability (CVE-2025-49596) in Anthropic's Model Context Protocol allowing remote code execution via DNS rebinding attacks.
Ключевые особенности
- •DNS rebinding exploitation
- •Localhost port targeting
- •Authentication bypass
Primary Defenses
- •Session token implementation
- •Origin and Host header validation
- •CSRF protection mechanisms
Key Risks
AI Framework CVE Scanning
(AI-CVE)Systematic identification and assessment of known CVEs in AI/ML frameworks, libraries, and dependencies used in AI systems.
Ключевые особенности
- •Automated vulnerability scanning
- •Dependency tree analysis
- •CVSS score assessment
Primary Defenses
- •Regular dependency updates
- •Automated vulnerability scanning
- •Software composition analysis (SCA)
Key Risks
LLM API Security Testing
(LLM-API)Comprehensive security testing of LLM APIs for authentication bypasses, injection vulnerabilities, and access control issues.
Ключевые особенности
- •Authentication mechanism testing
- •API endpoint enumeration
- •Rate limiting validation
Primary Defenses
- •Strong authentication mechanisms
- •Proper authorization checks
- •Input validation and sanitization
Key Risks
AI Model Backdoor Detection
(BD-Detect)Detection and analysis of backdoor vulnerabilities in AI models that activate malicious behavior when specific triggers are encountered.
Ключевые особенности
- •Trigger pattern analysis
- •Model behavior monitoring
- •Statistical anomaly detection
Primary Defenses
- •Model provenance verification
- •Behavioral analysis during training
- •Statistical testing for anomalies
Key Risks
Ethical Guidelines for Vulnerability Assessment
When working with vulnerability assessment techniques, always follow these ethical guidelines:
- • Only test on systems you own or have explicit written permission to test
- • Focus on building better defenses, not conducting attacks
- • Follow responsible disclosure practices for any vulnerabilities found
- • Document and report findings to improve security for everyone
- • Consider the potential impact on users and society
- • Ensure compliance with all applicable laws and regulations
От инженера, создавшего этот каталог
Закажите red teaming вашей агентной системы
Задокументированные здесь атаки каждый день срабатывают против продовых агентных систем. Проверьте свою раньше, чем это сделает кто-то другой: инъекции промптов, джейлбрейки, злоупотребление инструментами и эксфильтрация данных, каждая находка описана вместе с исправлением.
€750 вместо €1 500, одна неделя, письменный отчёт и разбор в звонке, до 30 сентября