ai-security-methodology

Security research methodology — 5-phase workflow (intake → recon → enum → hunt → report). Routes to specialized technique modules. Use when the user asks to audit, penetration test, bug bounty, find vulnerabilities, exploit a target, or perform any security assessment.

AI/ML attack techniques — prompt injection, indirect/RAG poisoning, tool-calling manipulation, adversarial examples, model extraction, membership inference, training data extraction. Use when the target involves LLM agents, chatbots, ML model APIs, image classifiers, or federated learning systems.

Binary exploitation techniques — buffer overflow, format string, heap exploitation, ROP, kernel exploitation, sandbox escape, shellcode. Use when the target is a native binary (ELF/PE), remote service with memory corruption, or kernel module. Requires pwntools, GDB, and binary analysis tools.

Cryptography attack techniques — RSA, ECC, symmetric ciphers, hash collisions, PRNG attacks, lattice/LWE. Use when the challenge involves encryption, decryption, key recovery, nonce reuse, padding oracles, or cryptanalysis of custom schemes.

Forensic analysis techniques — disk, memory, network, steganography, side-channel analysis. Use when given a disk image (.dd, .E01, .raw), memory dump (.vmem, .raw), packet capture (.pcap, .pcapng), image/audio file with hidden data, or side-channel trace.

Malware analysis techniques — static triaging, dynamic sandboxing, PE/.NET analysis, C2 protocol identification. Use when analyzing a suspicious binary, script, document, or network capture from a potentially compromised system.

Open Source Intelligence techniques — social media investigation, geolocation from images, DNS/web reconnaissance. Use when gathering intelligence from publicly available sources, identifying a person/location/organization, or performing passive reconnaissance.

Security payload reference — SQL injection, XSS, SSRF, command injection, SSTI, file inclusion, JWT, deserialization, WAF bypass, binary exploitation, and post-exploitation payloads. Load specific payload files by category. NEVER generate payloads from memory — always reference this library.

Post-exploitation techniques — lateral movement, privilege escalation, Active Directory attacks, credential harvesting, persistence, and data exfiltration. Use when shell access or valid credentials are already obtained on the target.

Reverse engineering techniques — static and dynamic analysis, anti-analysis countermeasures, language and platform-specific patterns. Use when the target is a compiled binary, obfuscated code, firmware image, mobile app (APK/IPA), WebAssembly module, or bytecode.

Reusable attack patterns distilled from disclosed vulnerability reports. Use when hunting for vulnerabilities to understand common exploitation chains, or when you're stuck and need to think about what typically goes wrong in a given feature type.

Web application attack techniques — SQL injection, XSS, SSRF, SSTI, XXE, command injection, file upload, path traversal, deserialization, JWT/OAuth/SAML, prototype pollution, HTTP smuggling, GraphQL, race conditions, logic flaws, info disclosure, client-side, NoSQL injection. Use when the target is an HTTP application, API, browser client, auth flow, or template engine.