FIVE Practical AI Uses for Cybersecurity

Key Takeaways

what's up everybody TCM back with another video and today we're going to talk about how AI tools such as chat gbt such as mid-journey such as other websites I'm going to show you can be utilized to help you in your cyber security slash pen test career we've seen a lot of talk about AI replacing Us in the workspace and all these Jazz but in reality AI is actually a really good assistant and I think that's where it's going to be for a while so let me show you how AI can be used to make your life a little bit easier in your career and we're going to do that with quite a few examples today so let's take a word from our sponsor and then we're going to hop right into the video oh yeah and as always if you like the video like comment subscribe hit the Bell you know the drill there are a ton of vulnerabilities out there from remote code execution to prototype pollution and even SQL injection just name a few as an ethical hacker I love exploiting these types of vulnerabilities but also running a development team I hate hate seeing these types of vulnerabilities show up in our applications that's where sneak comes in sneak automatically scans your code dependencies containers and configurations binding and automatically fixing vulnerabilities in real time so here's how easy this is you can use my link sneak.co forward slash cyber Mentor come to the landing page here and hit sign up once you signed up you can come in here and add a project I'm going to select a project from GitHub and once your Project's imported sneak finds your vulnerabilities and you can fix them with just a click watch this I come into here I can open a fixed PR or a pull request and sneak opens fixed PR so you can merge and move on plus it does it all from your existing tools Ides CLI repos pipelines Docker Hub and more and look how easy that was to just do a pull request with these issues in hand it's amazingly fast so what are you waiting for come check out sneak and find out if there's any vulnerabilities within your projects it's free and you can sign up using my Link at sneak.com forward slash the Cyber mentor so for this first topic we're going to be using chat GPT if you've never used chat GPT before that's okay you can just go to chat.openai.com and you will be presented with this login or sign up screen all you got to do is sign up and then you'll be brought to a prompt so if you have a new chat it might look something like this you can choose default of chat GPT 3.5 or gpt4 3.5 is a little bit faster four is a little bit slower it's newer it does more it knows a little bit more but just for this example we're going to use 3.5 so example number one as a pen tester we have to write a lot of reports now we get reports that look something like this and we have to write executive summaries so if we scroll down just a little bit you can see we have executive summaries in here we talk about the findings that we have in this report as an example we did an external penetration test for this company we're going to pick our own dates and just play around a little bit but I'm going to use this report just for a sample and we write out this summary that says hey here's what we found here's kind of the severity findings and here are the key strengths and weaknesses right so we come in here and then we give them this vulnerability card and we say hey here's finding one here's the severity here's the recommendation so what we can do is we can build out just this like we can copy all of this and then move this over to Chachi BT and have this help write some of this for us now one caveat to mention is that it doesn't always get everything correct it is confidently wrong sometimes so you need to make sure that you are fact checking what is being presented but this is a great way to help you as an assistant in this example I said to chat gbt that I'm writing a pen test report for organization named democorp and I told the dates of the engagement so May 10th to or May 5th to May 10th and here are the findings that I had the only thing different I did here is I did colon separate these so here is the finding here's the title of the finding here's the severity and then the recommendation and went through with that so I printed all these out and I said hey they're all colon separated into the following categories in an active writing voice you could tell what type of writing voice you want passive active Etc can you please write an executive summary using the above information so this is what it printed out said hey from May 5th May 10th we found several vulnerabilities and here is the executive summary and it kind of printed them out on top of that it made better recommendations than what I provided for example I came up here and I said hey you had insufficient password complexity Implement CIS Benchmark requirements or Pam solution this came in and actually said hey you can do that to enhance the complexity and strength of user passwords this will significantly mitigate the risk of unauthorized access through password guessing or cracking attacks pretty cool and it did that for all of them and told what severity it was etc etc all right right that's pretty awesome however that's not really how we write our executive summaries though it could be but you can tell the format that you want so I could say hey can you rewrite the above in a paragraph format and then it took that and it said okay so we found one high severity of ept001 revealed to be insufficient password complexity to address this is crucial for democorp to implement CS Benchmark password policy so it's not as strong as before but it still does say exactly what we want and it writes all of this out for you okay and puts it all together and writes an executive summary in literal seconds it's awesome again you need to go back and verify the information and make sure everything it's saying is correct but I would say chat GPT is right most of the time still it's incorrect enough that you need to verify this another thing Chad GPT can do is be used to generate payloads for example we could say could you please provide me with 10 SQL injection payloads and just send this here okay and it'll tell you it'll give you a warning and say hey this is a malicious technique don't have to worry about it because it still gives you some examples you could ask for more you could say could you please give me 10 cross-site scripting payloads it'll also do that and it'll come through just like that another thing chat GPT can do is help with source code review so we could say something like can you please identify any vulnerabilities within this code now again this isn't going to be perfect manual review is always better than a bot but having a bot helps so I'm going to go ahead and just send this and let's see how it does okay and it says Hey the code you provided let's look at the code I provided by the way basic process scripting vulnerable page right and we have this PHP Echo get name which should be vulnerable to cross-site scripting it comes in here it says there's a vulnerability in the code that could lead to cross-site scripting perfect and it says hey it embeds the name parameter HTML output gives you an examples it even updates the code for you to fix the cross-site scripting vulnerability how awesome is that pretty freaking cool if we wanted to we could even write a finding for this we could say could you please write a finding based on the xss found in the above code along with recommendations for remediation and this will do it it's amazing look at this it's so fast too and it tells you everything you need to do you could use this in a pen test report again you need to validate the information but look how fast this is it says Hey the provided code is vulnerable to cross-site scripting the name parameter from the query string is directly embedded into the HTML output etc etc etc gives you all the recommendations that you would need very very awesome okay let's shift things now to a site called mid Journey if you're not familiar with mid-journey mid-journey is used to make pictures and we can do a lot of things with pictures that are awesome so if you're here and you've never signed up for Mid Jordan before you can come and say join the beta and you will need a Discord account in order to join the beta once you join the beta you can come in here and actually use the mid Journey rooms in order to utilize the service however you can also just click on the mid-journey bot and say add to server so you can just create your own server select the server you want to add it to and run it in there for example I have this mid Journey stuff server and I put all of my information in here all my runs that I do and it's pretty awesome okay I'm going to show you what we did recently using mid journey to improve some of our quoting documents you can do this with reporting documents a lot of other things just generating Graphics in general is really cool and it can save you with a subscription fee to utilize sites like envato or other places and you can create your own media that's unique to you which is pretty cool so this is a little bit older but this is kind of what our sales document looked like we had the front page we got about us we've got some things about the people that work for us we've got some of our services etc etc and then we get into some of this methodology like hey here's what an external pen test is here's what an internal pen test is etc etc so we took that and we used mid journey to create this quote which is pretty neat so everything that you see here is going to be AI generated and if you come through you can see like hey it's the same kind of concept same kind of feel but it feels a little bit different we've got more of a cyberpunk kind of cartoonish feel which I actually really like and we can generate some images in here like if we come through you can see like hey here's the external pen test of what it looked like now compared to what it looked like before and I think this looks a heck of a lot better this is all AI generated right here this is AI generated all these images that you see in here totally AI generated it's really really cool so let's take a look at Mid journey and how this is actually done so I'll be honest to start with some of my failures I was looking for a wireless device hacking type photo and I just started off with saying hey I'm looking for a hacker using a wireless device to hack and I gave an example photo here which was actually just a pineapple so I fed this pineapple into mid journey and I tried to get it to use that with a hacker and I got some okay results it looks like a hacker are using wireless device not terrible but I wanted it to be a little bit better so I started saying Hey I want this maybe to be more cyberpunk I want to have a command terminal and we started getting some decent ones like this one down here is not too bad and you could come in here and reroll what you could see that I did and it'll generate more images you can also pull down images like if I say u4 I'm collecting this image in a higher quality I could do variants of the images here so if I want a variant of this I can also just click that and roll here you can see I download that photo maybe I was going to use it maybe not didn't end up making the cut but it ended up turning into a lot better things so I kept adjusting this this aspect ratio was actually 9x16 I actually wanted 16 by nine so I started generating that and I started getting some okay photos some not you can keep re-rolling on these and probably get something a little bit better but I wanted something a little bit more cartoonish so I I came in and I started generating cyberpunk with cartoon I started putting some weight to this image here so this image weight means hey I want to consider it a little bit doesn't have to be too heavy but my aspect ratio incorrectly and then I started getting photos I really liked like I like this photo I like that aspect of it I could take that photo which I did I could take this photo and I can also re-roll this because I already like the content that's coming out and just to see what came through like this one not that great okay can re-roll it again and you just keep re-rolling telling it what you want to do and it keeps generating nice images for you which is great and I'll give you an example here okay so I'm just going to copy this and we'll go ahead and just roll something really quick so if I come in here and I just say forward slash imagine and I want to come in and actually utilize it I'm going to take this image weight off because I'm not using the image way let's say that I wanted a hacker using a wireless device to hack cyberpunk cartoon you can actually separate these if you want you could put weights behind this like make this a two and then say something like hacking inside of an office give that a weight of a one and do that it may or may not work mid Jersey is still working on it it's getting better every iteration so just give it time but if you sit down and really take the time to play with this and learn this I've spent hours on my journey it gets a lot cooler and a lot better okay so it generated these images and we've got a few here so we've got this one I kind of like so what we can do is again we can click on this if we want to download it we can also do variations of this let's I picked the wrong one actually I picked the bottom one Let's Do A variation of this and just roll it this will Auto roll I have my settings a little bit different so I actually have to submit this on mine but you'll see that it creates the same image but with subtle differences and that's kind of nice too so you can come in here and also re-roll if you want on and just get four more images until you find something that you like you can be more descriptive you could say pink Hues purple Hues blue hues whatever you want just depending on how you want your photo to look it actually gets fairly unique depending on how many times you run this so you can see now it's generating it takes a minute or so just to get through it but once it does we'll have four different images that look similar to the very first one and we can continue playing around with that so here are the four Images our guy has looks like a little hat on here he's wearing a mask here has facial hair here and then has facial hair here too uh wearing glasses so we can give different backgrounds and different ideas you could see like this has a little bit different background than this one does like this has a map going on so it's just subtle little differences the screens are different and you can just keep doing this rolling until you find which one you want which is fun okay so another AI that we can use is something like unreal oilperson.com this is similar to this person does not exist basically you come in here and just generate a photo of a random person it'll generate them this person's not real it's using AI to generate that well why do we care about this well I intend to make a full video on this later on but we can actually use these fake characters for fake personas for what's known as a sock puppet to have alternative accounts which is useful in cyber security yeah it's useful for trolling and other things as well but in cyber security if you're trying to have a Persona that you're going to utilize on a physical engagement or social engineering something like that you can create a whole fake profile for that using a person that doesn't exist now this is very basic this has been around forever but what we can do is start generating a little bit more information about this person and then using AI to help build a story and photographs of the person a gray website is fakenamegenerator.com you can come in here and say hey I've got a mail I want an American name they live in the United States you just generate that and now we've got hey Richard Watson who lives in Albuquerque New Mexico mother's maiden name social security number geo coordinates phone number all this stuff you could copy this stuff it even gives you like email addresses and all this fake information that you can utilize if you want so you can say hey chat GPT we're not going to go through this but you can say chat GPT I've got a guy named Richard Watson here's his employment can you give me a back story or can you tell me a story about this person and chat GPT will write a story for you I actually learned this from Zach Hill because he writes stories using chat GPT for his son every night and generates images to go along with that story using AI using mid journey and I think that's really cool too so to give you a better example I started working on this fake person project and this was an AI image that I generated from that website and I started making things here a little bit and again it takes finagling mid journey is not easy by any means but if you take the time to practice it does so I said hey setting is a school Frank has darker skin wears glasses has a fade haircut setting is prank teaching a class which kind of worked didn't hyper realistic hyper realism and this is kind of what I got and I fed this image in by the way this image to kind of get a face that looks like Frank you'll notice the faces are similar but not great and this is also very cartoonish even though I told it hyper realism it didn't work so I had to do some research and go in and start looking at okay how do I make this a little bit better to make this look more like a real person like this and what can we do to work with that so okay we can call out premium photography we can actually give weights to things like a four means a higher weight than a two or a one or a three we could say high quality ultra realistic realism those kind of things as well and it makes it a little bit better but if you put the weight just on the portrait photography and not the setting or any of the other information well then we just got a portrait photography because that's kind of what we told it to do so I kept going through and just trial and airing things and eventually you start adding in multiple photos like here's the photo of Frank plus this teacher here so I kind of wanted to get a better classroom setting and that started giving me better options here um now we can see okay hey we're in a classroom this looks a little bit better I started generating stuff I lost a little bit again because I went down to cartoons uh and then eventually you start to get it like this one okay I got a picture what I think Frank looks like as a kid so this could be frank as a child right and we could start developing a backstory for Frank putting photos on Instagram or something just to give him more realism and come through and just start generating more things like I wanted Frank in an office setting here so I found a guy in an office and I started looking at that and started generating images I found some decent ones that I kind of liked but then I just decided to come through and do variations of these ones to see if I like anything and eventually I kind of got one that I thought was a good background looked like it could be frank and that to me looks like it could be the same guy that we saw initially right we don't have to use the initial photo we want to make our own these are actually highly detectable if we scroll back up this is pretty apparent that it's a fake photo anybody who kind of has worked in cyber security or knows about this knows that these photos generated looked like this so they don't really fool many people anymore but if you start to come in and utilize AI to generate new imagery it can start really getting good um like some of these photos in office spaces and everything else that I was generating look great and you can come in and I pulled down like this photo looks like the same guy just in a different office you can see Windows actually in the background it's pretty unique now this is all very high quality fancy photo photography if I were to go through and do this over I would probably make this more realistic stake in the terms of maybe like a photography taken with a cell phone something that's not as high quality make Frank look a little bit more real but I've seen plenty of Instagrams and things as well where all the photos are of this quality and that's okay too so you just have to think about the Persona and the person that you're creating and creating a story for them this again takes a lot of research and a lot of time but it is powerful stuff you can build out fake profiles from it you can build out sales documents like you saw you can help with your reporting you can help build websites with this it's amazing what this is capable of doing there's so much power behind AI right now okay so those are just a few examples of what you can do in AI with cyber security it's very very small subset of what's out there I try to show some unique things because I think we know about building tools I think we know about some of the powers of hacking that this can do if you finesse it a little bit but I think that hey helping with report writing is realistic helping with sales document it's helping generate information all realistic applications to a cyber security role or a pen test role which is great again AI in its current form is an assistant it is not going to replace us as cyber security folks anytime soon it's here to help us it's here to make us better and help our jobs become more efficient or help us become more efficient at our job so it's not something that we should be scared of it's something that we should be embracing so that is it for this video as always if you liked it please hit the like button subscribe comment down below until next time my name is Heath Adams and I will see you in the next video peace out