WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2024 • Aug 20, 2024 • Session details

Let’s write an exploit using AI

Julian Totzek-Hallhuber

A non-developer bypassed ChatGPT's guardrails to build a fully automated Log4Shell exploit. Discover how generative AI is democratizing offensive cyber capabilities, and why your AppSec strategy must adapt.

Pause
Mute Enter Fullscreen
#1 about 3 min

Using generative AI to develop an automated security exploit

Why a non-developer used generative AI to build an automated security testing tool.

#2 about 3 min

Understanding the Log4Shell vulnerability and external impact

How the Log4j vulnerability allows attackers to query external LDAP servers via unvalidated log inputs.

#3 about 2 min

Identifying Log4j vulnerabilities across internal network software applications

Evaluating software composition analysis, vulnerability scanners, and manual inspection to find at-risk applications.

#4 about 2 min

Bypassing AI ethical restrictions to generate exploit tools

How phrasing prompts as internal ethical evaluations circumvents large language model security filters.

#5 about 2 min

Reviewing the AI generated structure of a JavaScript scanner

Examining the initial JavaScript application generated by AI to detect flawed endpoints.

#6 about 4 min

Setting up a vulnerable test application and monitoring environment

Using AI to find a vulnerable Log4j repository and monitoring LDAP requests with Wireshark.

#7 about 2 min

Verifying the basic script payload via packet capture

Monitoring network traffic locally to confirm the script successfully triggers an LDAP payload request.

#8 about 3 min

Automating payload delivery for multiple targets and endpoints

Prompting AI to convert the single-target script into an automated multi-IP network crawler.

#9 about 3 min

Troubleshooting invalid paths and unreachable web application routes

Fixing application structure logic so the crawler targets responsive endpoints instead of generating missing page errors.

#10 about 3 min

The necessity of developer intelligence amidst automated attack generation

Why human engineers remain crucial for secure application logic while mitigating accelerated threats powered by AI.

Matching moments

2:59 min

Building a vulnerable application for security testing

Malte Lantin Malte Lantin +1 · World Congress 2026 Europe

1:36 min

Misusing AI for malware generation and physical evasion

Balázs Kiss · World Congress 2023

1:10 min

Defending against vulnerabilities in AI generated code

Chris Heilmann Chris Heilmann +2 · LIVE

1:10 min

Identifying emerging security vulnerabilities in generative AI agents

Alejandro Saucedo Alejandro Saucedo · World Congress 2025

3:31 min

Evaluating the flaws and benefits of AI code generation

Sergio Freire Sergio Freire · Europe 2026 Virtual

2:05 min

The impact and risks of AI generated code

Chris Heilmann Chris Heilmann · LIVE

More from World Congress 2024

Beyond the Hype: Real-World AI Strategies Panel thumbnail
24:07
12 months ago

Beyond the Hype: Real-World AI Strategies Panel

Mike Butcher, Jürgen Müller, Katrin Lehmann, Tobias Regenfuss

Carl Lapierre - Exploring Advanced Patterns in Retrieval-Augmented Generation thumbnail
21:17
almost 2 years ago

Carl Lapierre - Exploring Advanced Patterns in Retrieval-Augmented Generation

Carl Lapierre

Coding an Immersive Copilot using Unity / .NET and Azure OpenAI! thumbnail
31:50
about 2 years ago

Coding an Immersive Copilot using Unity / .NET and Azure OpenAI!

Zaid Zaim

Building a diverse tech company: The power of Diversity, Equity, Inclusion, and Belonging thumbnail
29:43
about 2 years ago

Building a diverse tech company: The power of Diversity, Equity, Inclusion, and Belonging

Sue Quackenbush

Dapr in Practice thumbnail
24:08
about 2 years ago

Dapr in Practice

marcklefter

Minimising the Carbon Footprint of Workloads thumbnail
27:46
about 2 years ago

Minimising the Carbon Footprint of Workloads

Michael Mueller

Related videos

The transformative impact of GenAI for software development and its implications for cybersecurity thumbnail
25:19
World Congress 2024 • about 2 years ago

The transformative impact of GenAI for software development and its implications for cybersecurity

Chris Wysopal

GenAI Is a Junior Dev With Root Access thumbnail
26:07
World Congress 2026 Europe • 3 months ago

GenAI Is a Junior Dev With Root Access

Julian Totzek-Hallhuber

Spot, Squash, Secure: Fighting Security Bugs with GitHub Copilot thumbnail
22:56
World Congress 2026 Europe • 3 months ago

Spot, Squash, Secure: Fighting Security Bugs with GitHub Copilot

Malte Lantin, Marie Theresa Brosig

The AI Security Survival Guide: Practical Advice for Stressed-Out Developers thumbnail
30:36
World Congress 2024 • about 2 years ago

The AI Security Survival Guide: Practical Advice for Stressed-Out Developers

Mackenzie

Can Machines Dream of Secure Code? Emerging AI Security Risks in LLM-driven Developer Tools thumbnail
35:37
LIVE • about 2 years ago

Can Machines Dream of Secure Code? Emerging AI Security Risks in LLM-driven Developer Tools

Liran Tal

Surviving the Vulnpocalypse: Open Source and Supply Chain Security in a Post Mythos World thumbnail
27:56
World Congress 2026 Europe • 3 months ago

Surviving the Vulnpocalypse: Open Source and Supply Chain Security in a Post Mythos World

Adrian Mouat

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.