llm-prompt-injection

name	llm-prompt-injection
description	LLM prompt injection / system prompt extraction — 40+ technique catalog against hardened GPT-4o-class deployments. Covers direct/indirect/agentic attacks, encoding bypasses, delimiter smuggling, boolean extraction, positional enumeration, RAG poisoning, guardian-model defense patterns, and real-world cases (GeminiJack, EchoLeak, Reprompt).
version	2.0.0
author	uphiago
license	MIT
platforms	["linux","macos","any"]
compatibility	Requires python3, requests
metadata	{"tags":["redteam","llm","ai","prompt-injection","jailbreak","gpt-4o","openai","rag","agentic-ai","indirect-injection"],"category":"redteam","related_skills":["js-secrets-extraction","hunt-source-leak","hunt-llm-ai","hunt-api-misconfig","hunt-ssrf"]}

LLM Prompt Injection — Technique & Defense Catalog

Prompt injection is the OWASP #1 vulnerability for LLM applications (2025). Unlike SQL injection — which has had parameterized queries as a solved defense for two decades — prompt injection exploits a fundamental architectural limitation: LLMs process instructions and data as a single flat stream of text tokens with no privilege boundary between them. There is no PREPARE statement for natural language. Defender instructions and attacker payloads compete in the same context window, and the model resolves the conflict through statistical pattern matching, not access control.

This skill catalogs 40+ tested techniques, defense patterns observed in production systems, and real-world case studies where prompt injection produced data exfiltration, identity takeover, and financial fraud.

When to Use

• Target exposes a chatbot, copilot, or AI-backed endpoint (serverless function wrapping an LLM API).
• Response includes metadata like context_length, response_length, or token counts — passive measurement vector.
• Standard jailbreak prompts ("ignore previous instructions") are blocked — model has explicit refusal training.
• Target uses RAG (retrieval-augmented generation), agentic tools, or multi-modal inputs — wider injection surface.
• You need to map system prompt contents without backend source access.

Prerequisites

• python3 with requests library.
• Endpoint URL accepting JSON payload with message and optional conversationHistory, entity data fields, language.
• Low rate-limit tolerance: space requests 2-5s apart.

---

1. The Architectural Problem

+-------------------------------------------------------------+
| LLM Unified Context Window                                   |
|                                                              |
|  [System Prompt]        (Trust Level: HIGH — developer)      |
|  [Conversation History] (Trust Level: MEDIUM — user/assistant)|
|  [Retrieved Documents]  (Trust Level: NONE — external data)  | <-- INJECTION
|  [Tool Outputs]         (Trust Level: NONE — external system) | <-- INJECTION
|  [User Input]           (Trust Level: UNTRUSTED)             | <-- DIRECT INJECTION
+-------------------------------------------------------------+

The LLM has no native mechanism to verify the origin of tokens in its context. An instruction hidden in a retrieved document has the same structural weight as the developer's system prompt. This is the architectural root cause — it is not a "prompt quality" problem, it is a .