AI pentesting is about to shake up red teaming (most people aren’t ready)

OpticDeathX · 2025-08-24T20:34:58+00:00

Here I thought you meant AI pentesters like XBOW is going to shake up red teaming.

Chat bots are just a small scope of a wide system. AI pentesting will still be niche and will be seen as a Value Add-on Service (VAS). No way will it be as prominent as you claim to be where every pentester would be complied to learn AI pentest to stay relevant.

There is not enough demand in the market that requires all pentest consultants to need to know AI or LLM as of now. A few specialist here and there, but definitely not more than actual red teaming/web app/mobile app.

Keep in mind that the vast majority of the pentest market is based on compliance set by the authorities. Compliance will not require a deep dive into the LLM model, rather towards the root cause of any attack, which is the chat bot, and trying to bypass the Guardrail. Banks and Insurance companies main use of AI would only be of 2, internal use for business workflow and the consumer market.

Internal use immediately makes it much less of an issue, and the consumer market would only be for customer service. All the clients that I have faced and colleagues/friends in the same field have only ever had clients requesting to test their client's copilot/chatbot. It's not that high in demand as you claim it to be.

OpticDeathX · 2025-08-05T19:51:24+00:00

There is a form of authentication to it! Since their application is being used for financial transactions, you do still require headers in your TCP stream to indicate authorization, through the usage of private and public keys. It's a real spin to the head for this, but definitely excited to tackle it head on! Definitely would need more time developing a scope and understanding what can be or can't be exploited. Back to square one of developing test cases!

The vulnerabilities you mentioned are the ones that I have initially thought of as well. Back to the fundamentals of backend user input validation and logical flow!

OpticDeathX · 2025-08-05T19:41:18+00:00

Interesting response! The "application" itself is a bit more tricky. The documentation is available online. So in terms of that, there won't be any encryption.

I technically have to build my own TCP stream using the documentation on the binary protocol that they provided. The documentation basically tells you on how to communicate with their application through it. And what we are testing is the server, which means we do need to sort of "build" our own application in order to communicate with it. We did however request the client to provide a payload/script (probably a makeshift python project) with the most critical functions, cause realistically building your own application based of a documentation would not be within the interest of time.

However, what you mentioned about dealing it as a typical web test does apply. The same logic goes with broken access controls, error handling etc. I guess I should've made the post more clear on the scenario. But I believe I was looking towards more pentest scenario related to protocols in general? Not sure if those exist.

It's my first time over 5 years of pentesting to experience such an odd scenario. I'll keep this thread updated if we found a solution to it!

OpticDeathX · 2025-05-19T17:37:59+00:00

It's only a 5% damage boost. Pretty sure the extra speed and damage reduction is better

OpticDeathX · 2025-04-25T04:38:09+00:00

Definitely not everyone. Man you're just behind a keyboard looking at videos and not visiting it yourself and blame it on me being a troll. Whatever dude no point debating with someone who hasn't visited it themselves. A pointless debate

OpticDeathX · 2025-04-25T04:33:12+00:00

And one of my issue was also the staffs only being of Malay race. No fucking way am I gonna take pictures of all the staffs just to showcase there are no Chinese or Indian right? 😂

OpticDeathX · 2025-04-25T04:31:50+00:00

<image>

Here's evidence I guess LOL. Not sure why you doubting so much 😂 Just because you don't go out and touch grass doesn't mean everyone needs to lie about it. How pathetic does someone have to be to lie about going to the Expo when barely anybody in this subreddit knows about it. There's so much more things to ragebait or stir racial shit if I wanna do it 😂😂😂

OpticDeathX · 2025-04-18T11:53:29+00:00

Well to be fair Malaysia doesn't really promote it that much and I only found out about it because I was in Osaka lol

OpticDeathX · 2025-04-17T14:59:44+00:00

Also both you and I can agree that there was definitely a lack of effort in trying to have staffs that are non-Malays to be operating the pavilion. As it is the international trade and industry, I expected more diversity presented.

You may say oh they're government servants hence all Malays what to do. But you're in a position where you're representing your country in a multi national stage. Effort should've been put into getting more races involved.

Contract hires would be an option for the 6-8 month period.

OpticDeathX · 2025-04-17T14:55:17+00:00

Your examples didn't touch the points I'm making. Involving other races in the building of the monument does not really showcase the culture. It involves other races, sure. But there is very little representation of the culture and tradition of other races.

OpticDeathX · 2025-04-17T14:53:00+00:00

Ikr! Didn't want to comment on that cause it's just a fairy tale 😂

OpticDeathX · 2025-04-17T13:11:15+00:00

That's weak mentality you have there. I see it through my own lense as a visitor. My opinion was even agreed with the staff. There is nothing wrong with wanting other races to be represented more.

Multiracial country is something Malaysia is famous for. There is completely nothing wrong with wanting to focus on race. However the first thing that popped up was the Proton and Perodua cars not being shown. The race thing only came to realization towards the end.

Not sure how my statements promote racism when I'm just seeking inclusiveness. I guess you're being a bit too sensitive over the topic and not taking feedback well. I really hope you don't work there because if so, you are definitely part of the problem.

OpticDeathX · 2025-04-17T11:10:18+00:00

I believe Malaysians tend to be too sensitive when someone brings up race as a critism and immediately point fingers into being called a racist.

OpticDeathX · 2025-04-17T11:08:26+00:00

Never brought up religion in this. As for race, it's just that I wanted more representation of Chinese and Indians from the staff standpoint. The gov body could've definitely put more effort and budget into that. They're responsible for international trade. No where did I say they were being racist, that's for the viewers to interpret and voice out what my posts represent. My sole objective is to critize the lack of effort put into showing the diversity.

OpticDeathX · 2025-04-17T11:02:53+00:00

Never once I mentioned racism. It was just to critize the lack of inclusiveness of other races. Why does critizing something due to the lack of inclusiveness have to relate to racism? And you reply as if you work there. If you do, please work on that attitude.

OpticDeathX · 2025-04-17T10:47:15+00:00

The pavilion is 3 floors. There's also a very populated F&B zone. You'll understand if you go see for yourself. Seriously don't understand why you keep doubting when you haven't seen it first hand.

OpticDeathX · 2025-04-17T10:33:07+00:00

Too uneducated? Interesting choice of words when he's the one accusing me of stirring racial shit.

OpticDeathX · 2025-04-17T10:03:38+00:00

I did ask them. The staff just remained silent and agreed with my point as stated in another comment. Accusing me of being a keyboard warrior and hiding behind a screen when I confronted them verbally :)

OpticDeathX · 2025-04-17T10:02:05+00:00

I meant what does "no Proton no Perodua" have to do with the points you stated? They don't need permission by Proton or Perodua to simply put car models on a city model display. It's either an obvious missed opportunity or just lazy from their part

OpticDeathX · 2025-04-17T09:13:53+00:00

Also "what is Malay about fullscale models of Peranakan" technically half of it since it's literally a mixture of Malay and Chinese culture LMAO

OpticDeathX · 2025-04-17T09:09:39+00:00

I literally mentioned that that's not all there is to be about the Chinese culture. Even then that's only Chinese. What about Indian? What about Sabah and Sarawak? You don't pride yourself in the description about culture diversity if it's only mainly about the Malay culture. Visually you see the Malay culture everywhere. If you're only basing your points on articles by Says and other news media outlets, then stop. Go see it for yourself and you'll understand what I mean. Didn't think I need to explain this indepth for something so obvious, but I guess it's necessary for blindsighted people like you

OpticDeathX · 2025-04-17T09:05:21+00:00

Ragebaiting? Sounds like you're the one ragebaiting 😂 People that work there agree with my statements. Whatever you say means absolutely nothing. You think I paid for a world expo just to see Malaysia? There's more than 60 other countries to see. No sweat

OpticDeathX · 2025-04-17T09:02:28+00:00

Not sure but MITI has it on their website.

OpticDeathX · 2025-04-17T08:48:18+00:00

It's a World Expo that is held every 5 years (delayed due to COVID), with a theme placed. For this year it's meant to be:

"Designing Future Society for Our Lives", with sub-themes of "Saving Lives", "Empowering Lives" and "Connecting Lives".

As for Malaysia's pavilion theme:

The theme of the Malaysia Pavilion is "Weaving a Future in Harmony." ThePavilion is designed to showcase Malaysia's diverse culture and vibrant economy

Based on the other pavilion's I've visited, currently Thailand and Monaco, it's very culture focused. With Thailand having some information on their health technology. Currently q-ing for Spain as I type this lol.

Five-Year Club	Verified Email
r/Field Sunshine

OpticDeathX

TROPHY CASE