logoalt Hacker News

tptaceklast Thursday at 4:29 PM1 replyview on HN

You convert GETs into arbitrary requests through some other pivot. I'm not saying that's what happened but this is bog-standard SSRF pentesting, so I'd expect models to be good at it.


Replies

nickpsecurityyesterday at 4:13 AM

I'll add that, because they mostly parrot and learn from pretraining data, they'll do any combination of what was commonly written about in articles, books, and videos. The more they're already used, the more likely they'll use the attack vector or combo.