LLM Security

It started with a chatbot. It ended with an enterprise password vault decrypted without its master password. Everything in between involved an FTP jail escape, an Electron AppImage, a native Node.js add-on and a custom cipher that collapsed under its own mathematics. I recently worked through OffSec’s Living Off the Vault challenge, and it had one of the strangest technical progressions I have seen in a lab so far. The first page looked like a normal support portal. A few stages later, I was analyzing an affine substitution box and using the application’s own native encryption primitive against it.