A pentesting YouTuber I once respected went deep into the AI rabbit hole and claimed yesterday he created a generic POC using ChatGPT in 2 hours to show how dangerous LLMs are [0]. After that he shilled his AI pentesting platform.

If there was a grain of truth to this claim, surely someone would've stolen the prize by now? Thousands of people would've had a working POC if it was this easy.

[0] https://youtu.be/SP7y1h0laN0

▲

LiveOverflow 4 hours ago | parent [-]

1. I dont have an AI pentesting platform.

2. This CTF is using nginx which has a `client_max_body_size=1m` limit. My exploit right now requires more, but I will give it a try (aka ask Codex).

3. You can setup a server with `docker run php:8.5.11-apache` with any of the over 400 vulnerable `php` apache images and give me the IP.

▲

lifeisloving 3 hours ago | parent [-]

Ive been pretty skeptical of your coverage as well, and you're in the OpenAI daybreak program and huffing and puffing about how great OpenAI is while having 900k subs, seemingly only talking up OpenAI products...

OpenAI and others are infesting the influencer space with what is basically dark money, not saying you're one of the guys on the take but I just don't trust any large influencer atm who only talks positively about OpenAI (or any lab).

I guess you can prove us AI cyber doubters all wrong with this CtF tho.

▲

LiveOverflow 2 hours ago | parent | next [-]

I think you missed the time where I burned the bridge to OpenAI by calling out the CISO: https://x.com/LiveOverflow/status/2101252692635004997

I wish I would be sponsored by OpenAI. I am spending way too much on subscription for it.

	▲	jijijijij 2 hours ago \| parent \| next [-]
		Have you experimented with local models? That would make pretty good, potentially relatable content, I think.
	▲	lifeisloving 2 hours ago \| parent \| prev [-]
		Noted.

▲

jijijijij 2 hours ago | parent | prev [-]

Not gonna defend the OpenAI shilling, but the guy recently had a pretty brutal tragedy in his personal life and I assume the AI content is just a low effort move to keep the channel and marketing for his business afloat. The lack of elaborate educational content may be rather a symptom of personal resource exhaustion and struggle, than popular enshittification. Time will tell, but maybe cut him some slack for the moment.

▲

LiveOverflow 2 hours ago | parent [-]

thanks you, but I don't want to use that as an excuse. The AI content is really just a reflection of what excites me right now... sorry :D

And this php2shell vulnerability perfectly hits the sweet spot for me and is one of the coolest vulns I have ever seen.

	▲	jijijijij 15 minutes ago \| parent [-]
		Fair enough :D jAwECQEKMLU49MiDV9LSmgFyUbVA3GI6fCx5U2M+0vra/s81r2NWmfqtJTHM0Yn/J8jkzhq1rlXL5/DvyPNPXr0TJp1HeyLaYLvuGrQb/cDMGDeIOebk8yD48YKxUUTVJJFV0I3mzET1pngQEme9r2HrXrOgWVTASCQU/kEYbRfw9ogbCguFCu4qfVZq3JpzNDF52YS1kwtvKVA/wkb+sN5L5fgqEvsZqc8=