performing-ai-assisted-vulnerability-discovery

name	performing-ai-assisted-vulnerability-discovery
description	Using LLMs to accelerate vulnerability research and pentest workflows — generating syntax-valid fuzzing seeds and evolving grammars, fine-tuned mutation dictionaries, parallel agent-based proof-of-vulnerability generation, and evidence-driven passive analysis of real HTTP traffic via the Burp MCP server. Covers concrete prompts, AFL++/ libFuzzer wiring, and Burp+Codex/Gemini/Ollama MCP setup.
domain	cybersecurity
subdomain	ai-security
tags	["penetration-testing","ai-security","fuzzing","vulnerability-research","burp-mcp"]
version	1.0
author	xalgorix
license	Apache-2.0

Performing AI-Assisted Vulnerability Discovery

When to Use

• During authorized vulnerability research where complex input formats (SQL, URLs, custom/binary protocols) stall a blind fuzzer
• When bootstrapping a coverage-guided fuzzer (AFL++, libFuzzer, Honggfuzz) that needs syntax-valid, security-relevant seeds
• When you have crash candidates and need to scale proof-of-vulnerability (PoV) generation across many agents/models
• When triaging large volumes of real Burp HTTP traffic and want evidence-driven passive analysis + report drafting
• When working under cost/time budgets (bug-bounty, CTF, AIxCC-style cyber reasoning systems)

Critical: Techniques Most Often Missed

Teams either ignore LLMs entirely or paste code and hope. The high-value patterns are about feeding the model coverage feedback and keeping the human/Burp as the source of truth.

1. LLM seed generation for semantic validity (deeper coverage early)

SYSTEM: You are a helpful security engineer.
USER: Write a Python3 program that prints 200 unique SQL injection strings targeting common
anti-pattern mistakes (missing quotes, numeric context, stacked queries). Ensure length <= 256
bytes/string so they survive common length limits.

python3 gen_sqli_seeds.py > seeds.txt
afl-fuzz -i seeds.txt -o findings/ -- ./target @@

Ask for a single self-contained script and tell it to diversify encoding (UTF-8, URL-encoded, UTF-16-LE).

2. Coverage-feedback grammar evolution ("Grammar Guy")

The previous grammar triggered 12 % of the program edges. Functions not reached: parse_auth,
handle_upload. Add / modify rules to cover these.

for epoch in range(MAX_EPOCHS):
    grammar = llm.refine(grammar, feedback=coverage_stats)   # use diff+patch, not full rewrite
    save(grammar, f"grammar_{epoch}.txt")
    coverage_stats = run_fuzzer(grammar)                     # stop when Δcoverage < ε

3. Fine-tuned mutation dictionary for memory-safety bugs

# AFL_CUSTOM_MUTATOR dictionary entries suggested by a model fine-tuned on vuln patterns
{"pattern":"%99999999s"}
{"pattern":"AAAAAAAA....<1024>....%n"}

Prompt: "Give mutation dictionary entries likely to break memory safety in function X." Empirically >2× faster time-to-crash.