Skip to main content

AI Assistant Range

Two surfaces in one: a login to get past, then an LLM assistant to test for prompt injection.

Run a Cracken operation against a web application that puts an LLM-backed assistant behind a login. This range combines two surfaces: ordinary web authentication on the front door, and the behavior of the AI assistant once you are inside. It is a good fit when you want to see how Cracken handles an AI-application target as well as a conventional web one.

Authorized lab range — scope strictly to it

http://107.23.14.14:8000/login is a disposable, isolated lab target provided for testing Cracken, and you are authorized to assess it. Point Cracken only at 107.23.14.14. Running the same operation against any other host — including a production system that happens to share that address elsewhere — is unauthorized testing.

Prerequisites​

  • Access to a realm in your tenant.
  • A connected Tentacle with network reach to 107.23.14.14 on port 8000.
  • Optional: the built-in Web App Pentest Playbook.

The target​

PropertyValue
URLhttp://107.23.14.14:8000/login
NameAI Assistant
TypePython web app (Flask) with an LLM-backed assistant behind login

Every route redirects to /login until you authenticate, so the assistant itself — the interesting part of this range — sits behind the auth gate. The assessment therefore has two stages: get past the login, then test the assistant.

Run it in Cracken​

  1. Open or create a realm and confirm a Tentacle is connected.
  2. Create a new operation and select the Web App Pentest Playbook, or describe the goal yourself — for example: "Assess the web app at http://107.23.14.14:8000/. First test the login for authentication weaknesses and get authenticated. Then probe the AI assistant for prompt injection, for instructions or system context it should not reveal, and for any action or data it exposes beyond its intended scope. Confirm each finding."
  3. Set the target to http://107.23.14.14:8000/.
  4. Run the operation and approve actions according to its autonomy mode.

What to expect Cracken to find​

A successful run treats the login and the assistant as one connected target, recording the auth path and any assistant weaknesses in the Cybergraph:

  • Authentication surface — the login form is the first thing to test: weak or guessable credentials, and how the app responds to valid versus invalid input.
  • AI-application weaknesses (post-login) — whether the assistant can be steered with prompt injection into ignoring its instructions, revealing its system context, or acting outside its intended scope.
  • Data exposure — anything the assistant returns that a user at that privilege level should not be able to reach.

You have a clean PoC when the operation has authenticated, exercised the assistant, and produced a report describing both the web and the AI-application findings.

Next steps​