Logo Crystal's Portfolio Page
  • Home
  • About
  • Skills
  • Experiences
  • Education
  • More
    Recent Posts Projects and Hobbies Accomplishments
  • Posts
  • Notes
  • Dark Theme
    Light Theme Dark Theme System Theme
Logo Inverted Logo
  • Posts
  • Build your own Hugo website
  • OWASP Juice Shop Walkthrough
  • Setting up an Active Directory Lab
  • OpenWrt on Raspberry Pi 3b
  • Kasm Workspaces
  • HTB: Writeup — Forge
  • Beginner Bug Bounty Journey
  • One Month Bug Bounty Journey Update
  • Bug Bounty: How to get private invites
  • Cyber Apocalypse CTF 2022
  • HTB: Writeup — Pandora
  • Bug Bounty: A tale of credentials listed on phpinfo
  • Bug Bounty: Path Traversal in Snap Creek Duplicator plugin before 1.3.28 for WordPress
  • Installing and running llama3 locally"
  • Assessing Large Language Model (LLM) Vulnerabilities
Hero Image
Assessing Large Language Model (LLM) Vulnerabilities

In the landscape of technology advancement, Large Language Models (LLMs) stand as pivotal players, transforming our digital interactions. However, alongside their remarkable capabilities, there exists a critical need to acknowledge and address their vulnerabilities to ensure robust security measures. In this discourse, we embark on an exploration of the top vulnerabilities inherent in LLMs, providing actionable insights for detection and mitigation strategies. Mapping LLM API Attack Surface Understanding the API access of an LLM serves as a fundamental step in identifying potential vulnerabilities.

Friday, May 3, 2024 Read
Hero Image
Installing and running llama3 locally

I recently decided to install and run LLaMA 3, a popular AI model for generating human-like text, on my local machine. As someone who’s interested in exploring the capabilities and security of AI, I wanted to experience firsthand how this technology can be used. Installation The installation process was surprisingly straightforward when using ollama. And it has support for Windows, Linux, and macOS. So first visit https://ollama.com/ and select Download. This just brings us to a page to select the operating system we will be using for the instal.

Sunday, April 28, 2024 Read
Hero Image
Bug Bounty: A tale of credentials listed on phpinfo

While I am manually going through target websites I always run automated scanning in the background. It rarely finds a real reportable vulnerability and a lot of it is either informational even if it says low or medium or companies tend to run vulnerable versions of software that are patched so the vulnerabilities aren’t exploitable, but I still enjoy looking up what it sees and learning about that specific issue or CVE.

Wednesday, June 15, 2022 Read
Hero Image
Bug Bounty: Path Traversal in Snap Creek Duplicator plugin before 1.3.28 for WordPress

The Vulnerability The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init. Intro Early in my bug bounty journey, I picked a few programs from different platforms to learn how they work and respond to reports and to ultimately decide which platform I would choose to stick to. Knowing that WordPress plugins were often forgotten to update and a good place to find vulnerabilities I focused on finding WordPress vulnerabilities in the wild.

Wednesday, June 15, 2022 Read
Hero Image
HTB: Writeup — Pandora

Recon Initial nmap scan An initial scan with nmap shows that there is two ports open, ssh on 22 and http on 80. Site Having a look at the page hosted on port 80 there appears to be a host name of Panda.HTB. Next I added this host to the /etc/hosts/ file with my favorite editor nano. The line added to hosts should look like 10.10.11.136 Panda.HTB. Oddly the same page loads so there’s nothing new to see here.

Tuesday, May 24, 2022 Read
Hero Image
Cyber Apocalypse CTF 2022

Intro I have decided to write on my experience at this years HackTheBox CTF event. Apologies for the short writeups. They were taking from the mess of notes and whatever screenshots I had taken to share with the group for discussion. I didn’t plan ahead to write a post about it after so learning better note keeping is definitely going on the list! Kryptos Support For this task we were simply given a page saying “Report any issues regarding the Kryptos Vault below” and an input field similar to a reporting system where after submission the admin checks our report.

Monday, May 23, 2022 Read
Hero Image
Bug Bounty: How to get private invites

Now I know that a lot of people will not like this answer and you certainly do not have to follow this method if you don’t wish to. But the answer is: Vulnerability Disclosure Programs These programs are generally frowned upon by the majority of skilled hackers as they do not pay anything for valid vulnerabilities. Since they are overlooked however, it is the easiest and fastest way to finding high ranking and valid vulnerabilities.

Tuesday, April 5, 2022 Read
Hero Image
One Month Bug Bounty Journey Update

Introduction My goal with this is to explain some of my thoughts and how they changed as I progressed and how I modified my path along the way. For we will always be learning in the field of Cybersecurity and there is no race to a finish line just finding the most time efficient path to learn as much as we can as we go. Lastly I want to mention when you feel like you are struggling and seeing everyone’s accomplishments on social media is getting you down, remember that they too struggled.

Thursday, March 24, 2022 Read
Hero Image
Beginner Bug Bounty Journey

Introduction I began my journey with all the many resources out there both free and paid that are centered on training you to become a penetration tester. The main resources I found to be the best for learning were TryHackMe and the Practical Ethical Hacking course by TCM Academy. The problem I learned mostly by following the major community leaders in Youtube, LinkedIn and Twitter, is that there are already far more people wanting to be penetration testers than there are open roles for them to fill.

Wednesday, February 23, 2022 Read
Hero Image
HTB: Writeup — Forge

Recon Using Rustscan and Nmap came back with different results. We can’t really do anything with the filtered port but it’s nice to know that it is there. I wasn’t able to find a way to make Rustscan discover this filtered port that Nmap had so I may default back to using nmap. Or just keep trying them both out like I have been. So here we have 3 open ports.

Thursday, January 27, 2022 Read
Hero Image
Kasm Workspaces

Introduction Kasm Workspaces are delivered through Docker containers and is mainly aimed at small businesses looking to reduce platform resource requirements and increase security especially in this work from home space we have been moving into. But this software can easily have many personal uses with its disposable browsers and desktops. Options to host Kasm Workspaces include on-premise, in the cloud, or they even have the option to host it for you.

Tuesday, December 28, 2021 Read
Hero Image
OpenWrt on Raspberry Pi 3b

Introduction So back when Raspberry Pi was super hyped I really wanted one. I always loved to play with tech and there was so much that could be done with such a handy small and inexpensive device. So eventually and very excitedly I purchased the Raspberry Pi 3 when I had some extra cash to do so. But after an extensive search of existing Pi project lists, personal sites, and Youtube videos, I wasn’t really able to find many project or project ideas that actually interested me or felt worthy.

Tuesday, December 28, 2021 Read
  • ««
  • «
  • 1
  • 2
  • »
  • »»
Navigation
  • About
  • Skills
  • Experiences
  • Education
  • Recent Posts
  • Projects and Hobbies
  • Accomplishments
Contact me:
  • cmmercier86@gmail.com
  • CMMercier
  • Crystal Mercier

Stay up to date with email notification


By entering your email address, you agree to receive the newsletter of this website.

Toha Theme Logo Toha
© 2024 Copyright.
Powered by Hugo Logo