> Markdown version of [/videos/1004-let-s-write-an-exploit-using-ai?t=282](https://www.wearedevelopers.com/videos/1004-let-s-write-an-exploit-using-ai?t=282). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Let’s write an exploit using AI

A non-developer bypassed ChatGPT's guardrails to build a fully automated Log4Shell exploit. Discover how generative AI is democratizing offensive cyber capabilities, and why your AppSec strategy must adapt.

- **Speakers:** [Julian Totzek-Hallhuber](https://www.wearedevelopers.com/@julian-totzek-hallhuber)
- **Event:** World Congress 2024
- **Published:** August 20, 2024
- **Duration:** 21:01
- **URL:** https://www.wearedevelopers.com/videos/1004-let-s-write-an-exploit-using-ai

## Summary

A non-developer security professional demonstrates how generative AI can be leveraged to rapidly build a functional vulnerability scanner. Driven by a desire for efficiency, the speaker uses ChatGPT to construct an automated exploit script for the notorious Log4Shell vulnerability. This highlights how GenAI drastically lowers the barrier to entry for creating complex cybersecurity tools, allowing individuals without deep coding expertise to generate functional offensive capabilities.\n\nBy supplying contextual prompts—initially discussing mitigation to bypass ChatGPT's ethical guardrails—the tool generates a working Node.js scanner. The speaker sets up a local test environment using a vulnerable Java application and leverages Wireshark to capture simulated LDAP requests on port 389. To scale the effort, ChatGPT is directed to enhance the script, allowing it to ingest target lists, handle 404 errors by crawling application paths, and automatically inject base64-encoded HTTP header payloads across multiple network endpoints.\n\nWhile GenAI acts as a powerful efficiency multiplier, the speaker notes that "we still need developers" to provide the underlying logic and creativity that AI lacks. However, this accessibility is a double-edged sword; as AI democratizes exploit creation for script kiddies and manual threat actors, automated network attacks will surge. Consequently, organizations must prioritize robust software composition analysis and application security testing, ensuring third-party dependencies are continuously updated and first-party code is secured from inception.

**Keywords:** log4shell vulnerability scanning, automated exploit development, chatgpt ethical guardrail bypass, proof of concept automation, javascript payload injection, ldap request simulation, wireshark packet capture, software composition analysis, third-party dependency updating, application security testing, threat actor automation, generative ai security risks, continuous vulnerability mitigation, ai-assisted penetration testing

## Chapters

1. **Using generative AI to develop an automated security exploit** (00:16) — Why a non-developer used generative AI to build an automated security testing tool.
1. **Understanding the Log4Shell vulnerability and external impact** (02:26) — How the Log4j vulnerability allows attackers to query external LDAP servers via unvalidated log inputs.
1. **Identifying Log4j vulnerabilities across internal network software applications** (04:42) — Evaluating software composition analysis, vulnerability scanners, and manual inspection to find at-risk applications.
1. **Bypassing AI ethical restrictions to generate exploit tools** (06:24) — How phrasing prompts as internal ethical evaluations circumvents large language model security filters.
1. **Reviewing the AI generated structure of a JavaScript scanner** (08:13) — Examining the initial JavaScript application generated by AI to detect flawed endpoints.
1. **Setting up a vulnerable test application and monitoring environment** (09:36) — Using AI to find a vulnerable Log4j repository and monitoring LDAP requests with Wireshark.
1. **Verifying the basic script payload via packet capture** (12:56) — Monitoring network traffic locally to confirm the script successfully triggers an LDAP payload request.
1. **Automating payload delivery for multiple targets and endpoints** (13:58) — Prompting AI to convert the single-target script into an automated multi-IP network crawler.
1. **Troubleshooting invalid paths and unreachable web application routes** (16:12) — Fixing application structure logic so the crawler targets responsive endpoints instead of generating missing page errors.
1. **The necessity of developer intelligence amidst automated attack generation** (18:59) — Why human engineers remain crucial for secure application logic while mitigating accelerated threats powered by AI.

## Related Moments

- [Building a vulnerable application for security testing](https://www.wearedevelopers.com/videos/100052-spot-squash-secure-fighting-security-bugs-with-github-copilot) (from "Spot, Squash, Secure: Fighting Security Bugs with GitHub Copilot")
- [Misusing AI for malware generation and physical evasion](https://www.wearedevelopers.com/videos/715-a-hundred-ways-to-wreck-your-ai-the-in-security-of-machine-learning-systems) (from "A hundred ways to wreck your AI - the (in)security of machine learning systems")
- [Defending against vulnerabilities in AI generated code](https://www.wearedevelopers.com/videos/1743-wearedevelopers-live-ai-vs-the-web-ai-in-browsers) (from "WeAreDevelopers LIVE – AI vs the Web & AI in Browsers")
- [Identifying emerging security vulnerabilities in generative AI agents](https://www.wearedevelopers.com/videos/1383-the-state-of-genai-machine-learning-in-2025) (from "The State of GenAI & Machine Learning in 2025")
- [The impact and risks of AI generated code](https://www.wearedevelopers.com/videos/1280-navigating-the-future-of-junior-developers-in-tech) (from "Navigating the Future of Junior Developers in Tech")
- [Analyzing software composition risks and shadow AI vulnerabilities](https://www.wearedevelopers.com/videos/100248-reporting-active-exploits-in-24-hours-are-you-ready-for-the-cra) (from "Reporting Active Exploits in 24 Hours: Are You Ready for the CRA?")

## Related Articles

- [Exploring AI: Opportunities and Risks for Developers](https://www.wearedevelopers.com/magazine/522-exploring-ai-opportunities-and-risks-for-developers)
- [Transforming Software Development: The Role of AI and Developer Tools](https://www.wearedevelopers.com/magazine/527-transforming-software-development-the-role-of-ai-and-developer-tools)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)
- [One billion (bad?) developers: How AI is changing the way we learn to code](https://www.wearedevelopers.com/magazine/516-one-billion-bad-developers-how-ai-is-changing-the-way-we-learn-to-code)

## Related Jobs

- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Engineer, Offensive Security Organization](https://www.wearedevelopers.com/jobs/ext/1992296-engineer-offensive-security-organization) at **Twilio**
- [AI Software Engineer (Germany)](https://www.wearedevelopers.com/jobs/48317-ai-software-engineer-germany) at **Sunhat**
- [Staff Engineer - Offensive Security](https://www.wearedevelopers.com/jobs/ext/1226927-staff-engineer-offensive-security) at **Twilio**
- [Senior AI Agent Software Engineer (Go, Python) (m/f/x)](https://www.wearedevelopers.com/jobs/48277-senior-ai-agent-software-engineer-go-python-m-f-x) at **Dynatrace**
- [Staff Software Engineer, Copilot Experiences](https://www.wearedevelopers.com/jobs/ext/164361-staff-software-engineer-copilot-experiences) at **GitHub**