Hey, hello everyone. Thank you for joining me. How's everyone doing? Cool. Yeah, welcome to my talk, LLMs at the forefront. And basically, we're using LLMs to fuzz Python and kind of showing you some tricks and cool strategies and stuff like that. Or a better title is chat GBT, write me some fuzz tests for this source code. Yeah, so let's go ahead and get started. Let's kind of go through the agenda, right? We're going to start off with an introduction and motivation, you know, to myself and like what was the whole entire motivation for this talk, like why I was interested in it and where it kind of really started. We're going to go some like brief background info on LLMs and fuzzing. And then I'm going to introduce my tool, which really combines LLMs and fuzzing. I'll give you a quick run through how it works. Then we're going to talk about some of the cool vulnerabilities and cool fuzzers that it created. And then kind of ended off with a just kind of summary and kind of discuss some of like the future research directions right on. So yeah, about me, my name is X Xavier. I'm a vulnerability researcher. I think an important part is that I am not an AI or ML expert.  And outside of security stuff, I enjoy base techno and like bicycles, you know? So yeah, so let's start off with the motivation, right? This really started, I guess because at the beginning of the year, there was like a huge meme, right? Like LLMs slash chat GBT, they're taking over software dev, right? Like there are going to be no more software devs. And I wanted to explore like its potential for like offset. And is it real? Is it legit? Like how much can we do? So I explore like multiple paths, right? I use LLMs for, you know, basic CTFs. I try to do some like cryptography stuff. I'm talking like simple, even like Caesar cipher type things. And it wasn't really that great. I found that the best thing it was LLMs were good at was like code generation, right? So I wrote a blog post in like February that first explored this. I started writing, starting to use it to write some fuzzers. And this is kind of where the idea exploded. I had really good success. I found a lot of bugs. So I decided to expand it. And besides kind of showing you the cool bugs and cool fuzzers, I really want to like inspire everyone here to just kind of explore these cutting edge tools and techniques, right? I think as a security person, it's pretty easy to get jaded and be like, oh, this is not as cool, not as interesting. But you know, I think there's a lot of potential in all these types of things. Yes, let me give you a brief, very brief intro into like LLMs, right? They're large language models, right? And many people use the word LLM and AI like interchangeably, but it's really just a machine learning neural network. And they're trained on like a wide range of corpus, you know, from from the internet. I'm talking about like Wikipedia, GitHub, Reddit, et cetera. And they work by predicting the next most likely token in a sequence. So it doesn't really have like a traditional knowledge database. It's just getting what is most likely next. And this creates some really like interesting challenges to work with, which, you know, I'll kind of describe how I approached it and how like we can kind of like combat this, this like operating model. No, but since it kind of works by predicting the next most likely token in a sequence, you know, without like specifically teaching LLMs things, they're able to learn, you know, language syntax, context, and even a little bit of like semantic understanding, right? So it's really powerful. And I'm going to be using primarily open API open AI models, which are 3.5 and four. But I mean, Google has barred meta has open sourced. I mean, there are many more open source ones. And I'll kind of talk about some of these different models and how like how they actually work and how they kind of compared to open AI. But for me personally, I think some of the open AI's models were the best at code generation. Yeah, so first of all, let's go into like some of the limitations. You know, I kind of mentioned it that they struggle with factual accuracy, right? They don't know facts the way that humans do. They just generate the responses based on like patterns. So this means that they can hallucinate details, right? Or create APIs that don't exist. I saw many instances where the code has a function like parse headers, right? Or parse requests, and it will make up an API that's like parse cookies because that sounds like it exists. So that's like one of the big challenges. It really loves to hallucinate things. Another like really hard challenge is just the prompt context limitations, right? So when we say prompt, we're talking about the conversation like your text and what it sends back, right? That's what we mean by prompt. And while there are limitations and they are expanding, like open AI now has 32K tokens, that is still kind of limited. For Python code, 32,000 tokens is about 2,000 lines of code. So it can get maybe like a source code file. There's like no way for it to get a whole repo. And there are techniques to like combat that, right? Like you may have heard of like vector databases. And what it does, what these things do is they chunk up data into like small portions and then create a data structure so you can like quickly parse through and find what you're looking for. But I found for code in particular, it's not as powerful and it's not as good because functions like call each other functions. So even if you use it in like a vector database and you search for something, it might find something that's not particularly relevant or a function that's being used somewhere else but not like the main function. So I just kind of wanted to add that. I mean, some people say we don't really need vector databases. Eventually like the context will grow. But at least for this kind of project, I thought vector databases were not like as useful as people say they are. So but there are many strengths to the first of course is like code, right? LLMs are very adept at understanding and generating code. But it's up to like us individually to actually verify the correctness and test the output. Another like big like strength is scalability, right? They can handle a large amount of tasks and kind of fix themselves. So you just tell it to do something, it'll happily write the code and do it. I think it's like an intern or junior dev, right? It'll happily churn out code and try anything you ask it for. Even if it doesn't like fully understand why it's performing this task, it's just happy to write code and be like, all right, here's my strategy, here's my plan. This is how I would do it, even though it has like no idea. So because of that, I found that it's best used by domain experts to like build tools. Another thing that I've had like great success with is like data parsing, right? Like we can copy some JSON and say write a script to extract these and order them like this and it'll do it. Another great thing is like regex. Hey, write me a regex to find this and it'll just do phenomenal. So there are many strengths. But kind of like to drill down on this code, I want to say it's not good at code review.  And there's been other research here where they, where people put like vulnerable code snippets and try to find bugs, but it just completely misses it. So the way you kind of have to approach these tools is ask for what the code is doing. Like there's a, like there's Webseq prompts. Ghidor has many extensions and it's never find the XSS in a code. It's more find the syncs, right? It's never find the bug. It's find the functions that are parsing it, right? So it's it's very particular in being able to get a general idea. But once you get like really in depth, it kind of loses its track and LLMs are not good at that at all. Yeah, so that's kind of LLM, just a brief intro, right? So fuzzing, I'm sure many people here know fuzzing, but I'm just going to give you like a brief intro description of it, right? So it's a security testing technique. It sends random data to programs and you're kind of looking for any like divergent or unexpected behavior. Now, generally, they use it primarily for like memory managed software, right? Because the crash means we can write an exploit and get it to do whatever we want. So, you know, some of you might be asking like why even fuzz Python, right? It's memory safe. What can we achieve with it, right? Well, we still get like a large a wide range of like types of Python bugs, right? I'm also personally part of the kind of people that think that fuzzing should be part of the SDLC just like QA and unit tests, right? It just makes your programs more resilient, just like anything else. Fuzzing is I think something that needs to be integrated for everything. So this really helps. And then some secondary reasons up to why use Python and why it shows Python specifically. It's because it's honestly the language that open AI models understand best. There's also kind of a newish fuzzer called Atheris. So it's native, it's integrated, it's a native Python fuzzer. And since it's fairly new, there's not like a huge corpus of training data. So I found like this was a good opportunity to like really test the capabilities of it. Versus if my thinking was if I use something like C, there's just so many fuzzing examples, right? Live fuzzer, AFL. There's just the internet is like full of them. So you can't really test the capabilities. Whether if I use Python, and then many of these Python libraries don't even have fuzz tests. So it's just like a great green field project where we can write fuzzers for things that don't exist and find bugs for things that have never been tested at all, right? So that's kind of why I chose it. This is another slide of like specific Python bug types. There's all types of things, you know, some of these hit the lower level libraries. A lot of them are like best practices. A lot of like denial service, you know, if we can crash a program, that's very common and it's very easy to accomplish. Yeah, so now we know fuzzing and we know LLM. So like how do we, how can we combine them to like get our goals better, right? First of all is like the pair programming abilities. It just allows us, it allows me to write so much more code. I think that's one of the big strengths. It's like a force multiplier for like software development. Whether you use the chat box, co-pilot. Alright, personally I'm a big fan of this SGPT repel. So it allows you to use GPT in a repel format where you can like interactively code inside. Kind of like an iPython terminal. So you can like write code, test it and then you know copy that in there. But kind of a note is always use the API. I found that when I'm trying to do things through like co-pilot or the chat box, oftentimes I would get a warning error where it'd be like I see that you're trying to do some like software hacking. It's illegal. So once you start using the API, those like warning signs are off. So really always use the API. So besides coding, you know, it's great at fuzz test. And I'll show you, it gets the whole function we put it in. It adds, it kind of mimics the functionality, creates error messages. It's really good. And third kind of like benefit is just the unlimited scalability, right? Generally when we're fuzzing, we're kind of limited by person cycles because we have to dig in the code, try to find like paths that are particularly vulnerable. If we're using something like LLMs, which have unlimited scalability, like there is no reason to kind of find these high potential functions. I just let it rip on the entire repo and let it go. And we'll see like how that works exactly. Yeah. And I kind of integrated all these ideas straight into this tool called fuzz forest. And it uses LLMs to like install it, to parse the source code, create the fuzz test, fix the non-running ones. And it even allows us like triage the crashes. And here's a link, you know, hopefully you all find it useful, use it. Because personally I'm a big believer in like writing your custom tools, you know, for all of your needs, for your different assessments. So I hope you take inspiration, use these ideas, you know, fork the code, whatever you need, you know, it's for the community basically. Okay. So this is what I generally consider like a fuzzing engagement process, right? There's, I kind of divide into three sections, right? There's the recon, we're kind of learning about the repo, we're understanding the code base and trying to find these critical code paths, which are usually, you know, parse functions, stuff like that. The second kind of major portion is running, writing and running these. So we kind of have to run them, make sure they're getting good coverage, you know, either adjust them, fix them, and let them run for a long period of time. And then finally is we're triaging the crashes, right? We're seeing the security impact. We're reporting the, the, the volums if there are volums and like, you know, giving them to the teams on how to fix them, right? So this is generally what I consider the three stages of an engagement process that I try to, uh, integrate into, uh, my tool. Um, so the first is this recon, right? Now, like I say here, usually hackers would be limited by their capacity to understand. And it's great if we have like unlimited time, but generally we're on a time limit. So we're looking for the, uh, the most critical paths, doing the important things. But, you know, since we're kind of offloading this thing to GPT, uh, and it's great, I simply extract all functions in the code and let it run. As you can see here in my, uh, in my little code snippet, I create a SQL IDB and then this, this was recon class. It essentially goes through and it uses the, uh, uh, AST tool to extract every single function, every single name, except for, you know, some, you know, I don't, uh, include test functions. I don't do like a main function, you know, but, but generally we're grabbing every single function from the code and storing it inside this SQLite database. Uh, so now that we have this SQLite database, uh, we can generate full tests. As you can see here, we can generate like every, uh, a fuzz test for every function. But if you want to get a little more, um, like specific, we can do function. I added some helper functions, like contain string for parse, for load, uh, file name. And these are all, uh, fuzzy matches too. So if your file name is parse XML, you know, uh, responses or something, it'll find it. So we can, you know, these, these are fuzzy. These are fuzzy. And then, uh, once we have like the functions that we're looking for, right, these kind of extractive functions, we can do the generate fuzz test. And this is where the cool part, the cool part is, right? So when we get this generate fuzz, we send it over to the prompt. And this is, this was the part that I really struggled with. And this was like the real, real meat of it. For our prompt, as I kind of mentioned before, our prompt is what we tell the ALLM to do, and you know, with all our context and all our info, but also what it sends back. And this is what we mean by limited by the token context, right? Like, if we could just send everything over there, it would write it correctly, but it kind of, it kind of makes it up. So I found that for our prompts, we have to add very specific examples. So I start off my prompts with, uh, a basic atheris, which is the fuzzer example code. I have to put in the API information because if not, it would like create random APIs. Uh, another more complex atheris example. And then like some, some important directives. Um, and, and you'll see like these, these directives without it, it was not working. And then finally, I kind of ended off with a right fuzzer for this and this. And there's a link to the GitHub in total, this whole prompt, which we'll, we'll see in the next slide. There's about a hundred lines or 1,300 tokens. Uh, yeah, so here's, here's the prompt and here's the beginning of the prompt, right? So I start off with a generic, like fuzz example, as you can see right here. This is just taken straight from like, uh, the docs, you know, page one of the docs so that the LLM kind of understands what it's doing. Um, and then down here, I actually decided to paste in the entire like API reference. Uh, and you can see here, it's like consume bytes, consume unicode.  Things that, uh, don't necessarily exist in the API that just sound like exist. So I had to add this context or it wouldn't work. Um, and then I added another more complex example. This uses this, uh, kind of like mutation technique from lib fuzzer. Uh, so it's kind of for more complex like data formats. And again, this was also another example just to reinforce to the LLM like, hey, this is how a more complex example is. Uh, but you know, an interesting thing here is like, you see this note, the importance always use a terrace. When I was initially like creating these fuzz tests, it would consistently skip this instrument all. So it kind of write a fuzz test, but it wouldn't have the proper like instrumentation. So I found that you have to give like specific directives, like use instrument all before calling main. And then I put an example in there. Uh, I also put another, another like directive, uh, before using it cause it would keep writing tests and it could keep triggering like attribute errors cause like, you know, like one of the main weaknesses, like I said, it would try to make things up.  So I found that by adding this second important statement, uh, make sure before using any attributes methods or functions, make sure they exist and are accessible, right? So try to avoid triggering an attribute error and just putting in that sentence, like up the completion rate, like significantly. So it's, goes to that tendency that you oftentimes have to remind and like, I know I specified it before, but you kind of have to tell the LLM, hey, don't forget that you have to use, uh, variables that actually exist and it'll kind of trigger and be like, okay, gotcha. And then the very, the very last line is where I would paste in the, um, the function name and the source code. And this whole prompt is sent to our, uh, the LLM which returns like Python, Python code. And this Python code, I just do a quick helper function where I like run it just for two runs, right? So it creates a file, it runs it and if it's successful, I sort in a database like runs true, else, uh, I get like a, a runs false and I send it to this, uh, LLM agent loop. Or it like, I call this like the fix-fuzz test code, right? So all of them that are marked as runs false, they're sent to this function and it uses this, this idea called an LLM agent loop. Uh, now there's this tool that some people may have heard of called like Langchain, which uses this concept of an agent loop and what an agent loop is, it's that, uh, it's kind of like a self-learning technique, right? So you send the, the stuff to the LLM and say like, here's the directive, here was the output from that directive, uh, move on to this next step. And for us it's, it's quite a simple step of like fix the code, right? And here's the basic, uh, structure of this. We send the code, the non-running code and the output to the LLM and say, you need to fix this. Uh, it returns new code. We run that again and if it works, we save it else. We send the updated code and the updated output back to the LLM and it keeps running, uh, until it runs without errors. Um, from my experience, I put a limit of five, uh, and that has, as you can see, we'll see it later in the stats, but that fixes about like 85% of our, of our fuzzers. Uh, you can have a higher limit, sometimes I try it out with like 10 or 20 but if, if it doesn't work, if it doesn't fix itself within five, I find that it's, uh, it's not going to fix itself, it just doesn't really understand what's going on. Okay, now here are the cool, here are some of the actual tests. Now the cool part is that I, I have never used like twisted, right? So these tests were all completely, these, these harnesses were all written by the LLM. I don't know much about these, but we can already see that it's being very smart, right? We're doing this FTP and in the Consume Unicode, like the LLM knows to use like the sys.maxize. I didn't specify that, it just kind of knows like this is what the fuzz test should be and you know, I looked at the parse QS code and uh, there is like a value error catch here. So the fuzzer was, or the LLM was smart enough to be like, uh, we, the code is itself is trying to catch these value errors. So we don't need to like trigger, you know, we'll just, uh, just pass them on. So that way we're not like getting these false positives by triggering these value errors. The fuzzer itself is like, okay, if we hit that, that's already accounted for, let's just continue. Um, but let's see some of these cooler ones, right? This was like a babble parse state. Babble is another super popular Python library. Uh, as we can see here, like the locale and format, it, it wrote all of these things itself. And again, I just want to stress that I didn't write any of this code. This was all returned to me from the LLM. Uh, you know, so it, it creates these great functions that actually, uh, allows you to put like the locale and the format. And again, uh, this unknown locale error, it's a custom error catching thing from the code and it just integrates it. Um, this one was pretty cool. This is like Boto 3. It's another super popular Python library.  But I thought the, the most interesting part was that, check out that regular expression part right here. It actually wrote a, uh, a regex to cat, to, to make sure that we're like, uh, abiding by the S3, uh, like standard format. Right? So it's, it's really powerful. And another thing is you can kind of see these comments at the very top. This was one of the functions that did not run initially, but it was sent to the fixed code. So every time it's run through the fixed code, it actually adds its own comments to say like what it updated, right? So like for the initial run, it didn't actually import RE it just said, which is the regular expression library. Uh, so when it fixed it, it imported it, right? And then, uh, so it's, it's like even the fixing like functionality is like really, uh, amazing. So it'll import itself and it's, it's just really powerful. Uh, this was actually my favorite one right here. This was from the Python cryptography library. And again, I didn't write any of this, the LLM did. And it knows to use like different key sizes, uh, try different hashing algorithms. But I, you know, what I think is one of the coolest parts, oops, my bad. One of the coolest parts is towards the end. It actually makes a comment, uh, about an RFC, as you can see there. And it says the DSA signature is a pair of two integers. Uh, and it tells you like how you can verify it by decoding the signature. Uh, and then it actually integrates that into the fuzzer, which, you know, is as someone who's not familiar with cryptography, the, the fact that it's able to like reference RFCs and write code that actually asserts like these values to me was like amazing.  Um, yeah, so, so these, these were some of the functions. So you're probably wondering like, you know, where are the volans? Like how much stuff did we find? Well in total, uh, as you can see here, it's like linked and we have a little bit more info than what's here, but we have 72, uh, unique findings. And when I say findings, I don't mean like volans. I say 72, like unique bugs, crashes. Uh, not all of them have security impacts. Some of them are more like, uh, good programming practice, but I was able to, uh, so far, I mean I'm still triaging them all, but so far about like 32 real legitimate like security impact findings. Um, and here are like some, some of the cool ones, right? Yeah, you can see it highlighted there. Uh, some of these, like these, this is an HTTP library. We get like overflow errors for, for the C stuff. We get some easy stuff like Unicode, uh, escape errors. These were, like Flask is this like web app, uh, like framework. And this causes like a straight up system exit. So as long as you send this one request, uh, to Flask, and everything's kind of routed through the Rods command, it like makes it crash. Uh, this NumPy, we're able to cause like memory errors, which is like a scientific computing thing in NumPy. But, you know, and these are the security impact ones, but there are some that are not security impact, but they're just good programming practice. Like, this PIL is the, the Pillow Imaging Library. Uh, so on this decode one, we get a decompression bomb error. Cause it says we have this huge like pixel, pixel size image, but it's really just like a recursion bug that makes it like crash. So that's, uh, and this has error catching for it, but you know, it's still pretty cool. And in this SciPy, uh, we have like a local variable FS reference before assignment, which is one of those more, uh, just like good coding practice things, even though it can make your, your program crash, right? And there's many, many more, but these are just some of like the, uh, just to kind of show you like the top, the stuff, the type of things that I found, right? And as you can see on the, uh, this library field, I mean, we got bugs in BodoCore and Django, Flask, a bunch of stuff in NumPy. You know, pretty much every, like popular Python library, we were able to like make crash or make, uh, misbehaves somehow, which is, which is really great. Um, yeah, so, uh, I kind of did this analysis with two different, like, uh, uh, models and some more models, which I kind of like describe later, but the old open AI models were, like I said, the best. So as you can see here, the 3.5, it's significantly, I tested against the same 20 libraries. So the 3.5, it costs zero, zero two cents per 1,000 tokens. So, uh, we were able to create 365 fuzzers and 172 were able to run. So for the initial run, we had about 47% that were actually able to run and this costs 29 cents in total for the, for the GPT-4, hitting the exact same 20 libraries. It created 405, but only 29% were able to run. I did a lot of, like, triaging on this and trying to figure it out. And I think it's because GPT-4, uh, just created many more complex examples. Think about, like, the past cryptography one. Those were, uh, exclusively two GPT-4, versus, like, the P.R.S.Q.S. one was a 3.5. So, you know, from my analysis, the four, uh, were much more complex and that's why they didn't run during the initial, like, creation of it. They needed to import more libraries and stuff like that. Uh, but after I run the five tri, like, fixed loop, um, the 3.5 was able to fix a significant number. It got up to 75%, uh, for a total cost of 42 cents, versus the four, it actually managed to fix more after that loop. So we got about 86%, we're actually able to, like, run, uh, and fuzz and get, you know, continuous, like, coverage. Like, decent coverage. I also, uh, wanted to get, you know, over, like, hundreds of paths covered. So if they didn't reach, like, at least 100 paths, I would just kind of cut them off there and set them again to, like, to fix fuzz tests. Uh, but anyway, as you can see here, like, the 3.5, just for 71 cents total, we were able to get, like, 46 unique crashes. Uh, for the four, it cost about $50, but we were able to get 65 crashes. Uh, many of them, like, converged and they were the same. Uh, the GPT-4 were often more complex, but they usually crash in the same, you know, some of the same parts as 3.5. So there were unique ones, but just because we're kind of targeting these Greenfield projects that don't have a lot of, uh, like, fuzzers to them, uh, they found, they found many of the same bugs. Uh, so yeah, so basically, for, like, $50, you can write fuzzers and get a lot of, like, bones out of here, which is definitely cheaper than any, like, you know, software to ever, like, uh, or, or hacker, or pentester, et cetera. Uh, so another part is, like, this other models, you know, I keep talking about, like, open AI models and, like, you know, you're probably wondering, like, why would I use these exclusively? Isn't there others, like, Salesforce, Repellet, you know, uh, this hugging-faced StarCoder and stuff like that?  And honestly, no, not yet. These were similar, like, the model comparisons for the same one. As you can see, like, this StarCoder, it, it doesn't even make sense, honestly. It just doesn't import the correct, uh, libraries or anything like that. The Salesforce one as well, like, it's, it's going DevU Random, RB, and it kind of imports this, but, and we're using the exact same prompt, but it's still, like, uh, I don't, I don't know what to do with this or how to use it at all. So, uh, open AI models are just, at least in my experience, just like, you know, a level above, at least for code generation and understanding. Um, yeah. So, uh, the next steps in this, you know, I'm currently, uh, reporting all the bugs and, you know, notifying all the teams. That's going really well. The next steps, of course, are to, uh, add some, uh, a JavaScript functionality, because that's the, the second language that open AI, like, understands best. Uh, so that's kind of the big project that's next. Uh, I'm also did a little bit of testing on, like, improving existing fuzzers, right? So, I, I did very minimal of, like, where I would get an existing Chrome fuzzer or a Linux kernel fuzzer that are in C and basically tell the LLM, here's a, um, here's an existing fuzzer. Try to improve it and, uh, for this, I had some, like, limited, uh, uh, success. So, I think I just need to, and one of the main goals is, like, improve the prompts to get, like, more coverage, right? Cause it's, uh, a big part of it is kind of, like, figuring out these prompts, knowing what to ask for, knowing how to ask for. It's, it's really weird. It's, like, incantations.   Like, this is kind of low priority cause we saw these different models, they're just, uh, not up to snuff, right? Uh, you know, I want to improve the coverage and analytics, but I think a, a big improvement is, like, this unit test, right? I'd like to, uh, modify it to write a unit test for these functions, especially to catch these crashes. And I know that this is a, uh, uh, like a worthwhile invest- uh, investment of time because, you know, while I was performing this research throughout the beginning of the year and through summer, uh, GitHub announced their, their program, Co-Pilot X, which is, like, supposed to integrate itself into the code base and list, like, automatic unit test creation is a major feature. So, uh, as you can see, like, this kind of test creation is really, like, what it excels at. Like, that's one of their main selling points for this, you know, really expensive Co-Pilot X, uh, project, uh, and it's something that we can do very easily. I mean, we're writing fuzzers, unit tests are just kind of like a small modification to that. Um, yeah, so, let's just end it off with, like, this implication for, uh, like, AI, you know, for security people, like, we keep hearing that, you know, chat GBT will eliminate software devs. Like, will it end security professionals too? And, like, no, no to either of those. Uh, not only is it not good at finding bugs, it can't even write bug-free code. Often from the test, it had bugs in it. Um, in fact, I actually think the opposite. Like, there's increasing software creation because of these tools. I know many people that are using it to, like, write, uh, easy scripts, right? So more people are creating more software, so there's just gonna be more, like, opportunities for these bugs to be introduced. But the trend, as has been, you know, throughout, like, you know, off-sec is that the bugs will become, like, more subtle and harder to find. Like, they're gonna keep popping up, but it's just gonna be more difficult. Uh, and then I put a link here to this, this famous paper called The Art and Science in Engineering of Fuzzing. It's still, I think it's, it holds very true. Like, sure, the LLMs may be able to abstract some of this engineering, but it's really more than that. It's, it's, kind of knowing how to set it, the R of it, right? Uh, really, it's a good coverage and find these bugs. So there's still, you know, not, don't worry guys, like we're still gonna have jobs for a couple of years. Uh, yeah, and then, um, yeah, basically, you know, to kind of go along with the DEF CON theme, what we really have to do is, you know, we really have to, like, adapt, I feel, we have to adapt to this new tech and like, ride the wave into the future, right? Like, there's always gonna be new things, and, like I said, as security people, we're like super jaded, because everything is new, same things pop up, but, uh, really we gotta, like, I feel like, we have to like, use these tools to their best potential and just like, use them to the best of our abilities and ride the wave into the future. Um, yeah, so thank you, and here are the, the different blog posts that I've, you know, really, uh, talk about this stuff, like in, in detail, right? Like, I'm actually going through the code, I show actual code snippets of like the, the agent loops and stuff like this, I just, the, these slides are more at a high level, but if you really wanna dig deep, like, you know, go into these blog posts, uh, these are like, a really good prom course that I use throughout my, uh, throughout my research and these were like, other blog posts that like, really helped, uh, kind of formulate this idea and you know, I talked to some of these people and kind of like, they just gave me good feedback to like, really make this and really find, you know, all the different bugs. Uh, but yeah, that's it, thank you guys. Um, awesome. Nice. Yeah, yeah, I guess we're, are Mike right here? Yep. All right. Sorry. Um, so I really appreciated your breakdown on total cost. Um, I'm wondering if, uh, maybe not quite yet or if it's kind of in your plan to, um, explore what it looks like to automatically generate and try to like, automatically fix these things up to a certain budget. Yeah. Um, because right now, especially with GPT 3.5, it looks like, it would end up being more cost effective, uh, especially for a team that's maybe got to be budget conscious to get a lot of fuzzing done when they only care about, let's say, the bottom 80%. Yeah. So, I don't know if that's something that you've already explored or... Yeah, definitely.  I mean, 50 bucks is not that much. Uh, but I, I do agree with you. I think, if you want just a quick and dirty, 3.5 is, is what you can do. Thank you. Hi. Um, I saw you had the comparison of the, um, like the review win ratio between 3.5 and 4, and I'm wondering, for the ones that made it, did 3.5 take more iterations to fix something than 4? Like, did 4 fix it in one try? More than 3.5? Y- Yes, actually, 3.5 often hit, uh, like 5, uh, limit, uh, very often, versus the 4, it almost always fixed it. All of these were, uh, the, the 4, often times within the, the 2 or 3, versus the 3.5, it always hit the 5, even when it, uh, fixed them, it would always hit the 5. So yeah. Thank you. Uh, so one of the concerns raised at a lot of presentations with LLMs is that they, uh, can't really describe the method by which they arrived at their result, right? And maybe that's gonna get better over time. Uh, in fuzzing, we're usually concerned about, um, documenting the process as much as possible, so we can replicate the crash or error consistently or, uh, pass the context to your devs so that they can hopefully patch out, uh, the edge cases as much as they can. Uh, so I'd be worried that you end up with a really cool fuzzing capability, but it's a black box to everyone that's using it. Uh, so what recommendations do you have for the audience in regards to documenting your process as you're forging your prompts, um, and working through creating these? Yeah, absolutely. That's a, that's a great question. So, uh, uh, you know, I try to do this, you know, with all my work. I try to be driven by metrics, right? So every single test case, I put it in a separate directory and, uh, it's not here, uh, in this code snippet. It is in the, like the blog post, but we save all the run output into a specific, uh, specifically formatted like .json file, which we later are able to like triage because that's a very good point. And I also work by creating, uh, a directory for every single fuzz test and stuff like that so that we know exactly where it's at. But, but yeah, basically log every single thing in the .json format. Yeah. Sweet. Yeah. Have you found that some libraries or some types of functions, it has better intuition on how it writes fuzzing functions? Yes. Yes. Definitely. If it's, if it's well used, if it's like a request library, we'll get a lot of, of bugs and we'll be able to write, like the cryptography. It was able to write really good intricate tests. But if it's a library that's not as popular, uh, like say this, you know, uh, this IO HTTP, which is not as, there's not just as much, like, uh, stuff out there. It doesn't really know how to use it. So we'd get a lot of those, like, attribute errors, because there's just not enough info for it to use. Yeah. Did you experiment with the temperature settings or did you always use the default .7 parameter? No, I actually, I actually found that if you go a little bit, uh, if you increase it more, like, like .7 was, uh, decent, but if, if you increase it specifically, towards like the .9 and higher, that's when you start getting these really cool, interesting fuzzers. So that was, that's one of the main things. Yeah. Did you find an increase in hallucinations by increasing the temperature? Yes, definitely. So after I increased the, the temperature, that's going to have to add, like, those attribute reminders, because it would just kind of make it up out of nowhere. So yes, I tried to combat that. Yeah. Thank you. Hello. Uh, more of a kudos, uh, about from creating vulnerability, exploits and fuzzing from, from manually, that looks like it's gonna save a lot of time. Um, and I can concur with you with vendors who release products, uh, into production that are very easily crashed. I've had a few vendors reach out to me to help them fix them. And I said, no. Yeah. I just alerted them, right? But it's very, I agree with everything you're saying. So thank you. Yeah. Cheers. Yeah. Yeah. Luckily people are like open to fixing it, but yeah, definitely. Uh, in your talk, you mentioned that integrating LangChains isn't worth it. And I was curious what your routines for like, stitching automation around these processes was like, and your approach to that. Yeah, definitely. Um, yeah, we could, uh, so basically, I'll be here for the sidebar. Yeah, yeah, for exactly. Basically LangChain is just a really complex library. So it integrates these tools like Python and stuff like that. But, uh, you know, in my experience, it's just, it's like importing a gigantic library to do a small task. So, uh, I found that it's better just to like, implement your own small loop with, with these specific tools because it has like a Python interpreter. But, it, it's so wieldy and it tries to do everything. It tries to like, instrument it and stuff that, just writing a basic like Python, uh, tool, run tool is like, much more effective. It may be better if you have like some crazy huge project but, uh, I found that LangChain is just too much stuff for, for something simple. Hey, uh, thank you. That was great talk by the way. Thank you. Um, so have you experimented doing this with API interface or fuzzing in API interface or a web interface where you describe its inputs and outputs and try to write tests around that? Um, similar, right? So, you can put an API and it kind of understands it. I had some good success with like, uh, like OAuth systems. So I'd like, paste the documentation of an OAuth system and it would be able to, uh, you know, do like the token exchanges and stuff like that. So it, it works limitedly like that. But if you were able to put like, uh, like a, uh, open a, or an open API like spec, it doesn't really know how to, it can write requests.  It doesn't really know that. So simple things that exist, yes, but uh, just open like REST APIs now. Yeah, thank you. It sounds like you really care about the, um, the quality of software in the world. Uh, where's the next, uh, step for your project? Like are you going to, uh, release this in a way that, uh, projects can use automated style? Yeah, definitely. Well, it's all open source now. So right now I'm, uh, currently, uh, submitting all the bugs to like the Python devs. Uh, and the next up is like, uh, JavaScript stuff. So I'd like to get, maybe if I can do it to like, uh, you know, like Google's OSS S somehow, but you know, that's to be determined. Right now I'm just like, uh, reporting all the bugs and stuff like that. But I would, I would like to. Thank you for taking all the questions. Um, have you found or do you think there's any chance since you're feeding in the full function body code, is there a chance that's limiting the fuzzer's ability to write good tests because Python is untyped. Is it restricting the tests it applies versus just having the function signature? You know, that's, initially I would kind of paste in some like documentation as well. Right. So that way it knows it. But if you notice some of these here, uh, it, it does, it does use a little too like, uh, since these things do exist, it's able to like, know like Unicode and stuff like that. But I, I did struggle with that. So I, I kind of experimented with adding like specific documentation of types, especially for the NumPy. Uh, and that was able to get like, good success. But it is something that is very difficult. So I'm, I'm kind of struggling with that. But I find that just, uh, dock links work, work pretty well. But it is hard. It's very hard. Thank you. Awesome. Thank you very much, everyone. Oh yeah. Infinite forests. Yeah. And infinite forest is where all the cool stuff is. Thank you very much. Awesome. Thank you.


Hey, hello guys John Wise here with Comic Edmund. I'm bringing you another one three of three movie reviews Three movies I've seen this past week. I already went over Thor Ragnarok makes you check that video out I just did one for jigsaw. So again check that one out. This one is for bad moms Christmas So here we go. The house looks really nice Thank you. Your dad is awesome. I thought you hated him. Why would you say that? I heard you and daddy in the bedroom. You kept screaming Those were just they were happy screams and then you punch the wall and yell the F1. You were like Thor Ragnarok comic book movie Jigsaw why jigsaw on a geek site? Well, you have the horror movie geeks and of course you've got Laura van der Voet as one of the characters. She is involved with smallville v.  It is a chick flick So what does a chick flick have to do with? Get them simple There is an awesome cam hero by green arrow himself Not that great arrow Justin Hartley green arrow from smallville So I've seen two movies this week with two former cast members from smallville alone and So yeah, that's and I just have to review this movie in his scene. So let's go ahead and get to it so I Last year the first bad mom's movie came out. I had Mina Kunlis in it and Christian Bell who of course also has roots in Geekum and The trailers were funny. I thought it was funny. Did I have to see it at the theater? I could wait until blue right but my girlfriend really wanted to see it And I wasn't gonna say no because it looked funny and I wasn't disappointed. It would actually ended up being my favorite comedy of the year last So when it was announced that they were doing bad mom's Christmas. I I had to go see it. I wanted to see it My girlfriend definitely wanted to see it. She loved the first one So we went and saw with her mom and her sister Which Some of the things in the movie that happened do it didn't make it a little awkward Especially you see was I think I was only one of two men in the entire theater And you can definitely hear the chicks laughing at the certain parts and going whoa And other parts Justin Hartley being one of them and I'll get in that here in just a moment So bad mom's Christmas. I don't think it's gonna be the comedy of the year for me I haven't really put too much thought into it, but this movie is very funny I'll go over real quick the main plot of the previous movie in this one So bad mom's stars me Nicholas Christian Bell As a trio of moms who decided pretty much had had it trying to be the perfect mom Does they decide they're going to be bad moms? They're going to not just not try so hard, you know They're going to make their kids make their own breakfast and they're old enough to do so They're not going to take crack from any members of the PTA to the school. So If a lot of humor ensues in this movie It's a little out there, but at the same time you can kind of see some moms doing this Which it has it a little enduring quality about it bad moms Christmas Continues pretty much months after the first movie. I mean Judge by when that movie came out the first one came out on this one the timeline kind of fits It's Christmas time as the title entails We had a Christmas character and I should tell you that there's going to be spoilers from the previous movie and this movie So be warned now Okay, still here awesome She just got through her divorce and it's Christmas time and she wants to try giving her kids a nice Christmas Not perfect out there Christmas But a nice Christmas. It's what her kids want Well, the three main moms from the previous movies We're reintroduced to them as their moms decide to visit for the holidays and One of them one of the moms is played by Anybody who watches has seen the Big Bang Theory the character Leonard her his mom Plays Mina Kunis's mom in this movie and it's pretty much the same exact character So it's kind of got typecast, but she fits really well in in the role. She's put in I've other surprise mom shows up Susan Sarandon. Well, I'm a big fan of because I want to work at your show Kristen Bell's mom shows up I can't remember her name and I feel horrible, but she's the type of mom who's got to be with her daughter all the time Even to the point in the movie where she actually had the watching Christian Bell on her husband began to have sex So where does Justin Hurley care to come in so one of the characters again, I can't think of the actress's name It works at a spa where she Waxes people Justin Hurley's character comes in he plays a stripping Santa It goes around to different Santa competitions dances and strips and he's come in to get his Twigs and berries waxed as well as his crack oddly enough a romance ensues between him This mom character. I think I can't remember her name. I feel horrible Maybe Shannon will look up and flash it on a screen for me because my mind is just right now It was an odd moment It was both for me funny and kind of uncomfortable not because I'm watching it with my girlfriend Because I'm watching it with my girlfriend's mom and her sister and you don't see anything Down there. So guys don't don't worry about that So that that is where Justin Hurley the green arrows Cameo comes in and he shows up a few more times in the movie We also have the arms again. I'm trying saying and I swear We we have another cameo from the main protagonist of the previous bad moms Christina Applegate from married with children She shows up in a cameo in this film In a very humorous moment during Christmas caroling So I'll make sure you keep an eye out for that this movie is It's funny. I enjoyed it. It's one. I plan on picking up when it comes out Let's face it all three of these movies. I've seen Thor, Jigsaw and Thanos Christmas.   I couldn't help it because everything that was going on on the screen was funny Did it up the ante from the first film not really you get a lot of the same Level humor and jokes in this one that he did in the first movie So it really is a continuation, but it's not a bad. It really is it would have liked to have seen a little bit more Anti, but I think if they went any further, maybe it would have just got downright ridiculous So maybe it was good to kind of kept a little level on same level as the first movie Let's see. Let's just Yeah, I mean it's just started just came out the theater of this past weekend. It's still there. It's Early November It is the it's the third so if you watched my jigsaw then I'm wearing the same shirt, you know, I'm coming back to back So so yeah, it just came out the theater this past weekend Very funny movie. Take your take your girl to go with go see it. She'll love it unless of course, she doesn't have the Perverted mindset because it's just definitely for those type of people with that kind of a mindset that would perverse Maybe she wants to go see it with her girlfriends. That's the case. Let her go see it. You can go see Thor Blade Runner still playing which I still have to see that movie Go see that Otherwise take your girl to go see it. She'll appreciate it There's things in the movie that may get a little hot and bother And it's definitely plenty of eye candy for the girls not so much for the guys, but definitely a lot of eye candy for the girls You may even be able to get back home and Continue the movie So enjoy yourself enjoy the movie if you've seen it or you're playing on a scene Let me know what you think in the comments below make sure you like and hit that subscribe button So you can now you catch all the comic in TV. Goodness. That is us You don't so thank you for tuning in to come again. We're all geek culture collide until next time my fellow friends and geeks


Today guys we look at a quest reward legendary drop called the 7th Sense and oh man this thing is amazing. How's it going guys my name's DPJ and today I bring you another BL3 video if you guys do enjoy it leaving a like really helps out and subscribe if you do want to see more. So the 7th Sense is a side quest reward which by the way was an incredible experience in itself. I will share that at the end of the video showcasing the entire mission which was amazing no spoilers right now though. The mission in which rewards this weapon is called the cold case and you start it with incurs haven right here. Doing this mission which is slightly lengthy reward due to 7th Sense jacob's legendary pistol and as far as I'm aware it only drops off in that trial element and as of yet I haven't seen any anointed versions of it but that's not to say they can't drop but I'd presume they can't. So firstly the weapon looks amazing reminding me a lot of the king's cool I'm sure you'll agree. Something so close and yet so distant with a party trick our reloading causes spawn projectiles to hit the original target. We will get into what this does and how it works in a quick second. Now we see this has a decent standard damage in around that 4500 mark per shot with 6 and a mag as well which isn't the worst I've seen with an accuracy of 66% 154% a reload time of 1.9 seconds and a fire rate of 8.4 shots per second which is quite quick if you do have a trigger finger. So those projectiles what do they do and what are they? Well they are very apparent when you shoot this thing as with every shot no matter where you hit that enemy it spawns in one of these projectiles which you could say linger about and upon you reloading the weapon they track and hit that target you were shooting at. Now if you were shooting at one target and it dies and you reload they don't track another target they only track a target you were shooting before you reloaded and if that is multiple targets yes they will track multiple targets. Damage wise these are amazing because it seems as though they actually match damage depending on where you hit that target so the body shots from these projectiles the seeking projectiles basically do the same damage as your initial shot shooting this weapon same as crit damage too and in total depending on the actual size of your magazine and what you can get that up to you can in reality double up all that damage but if you work out from a standard mag of six you can get in reality 600 extra damage when all projectiles seeking hit that target from a single clip but that'll be 600% on that initial one shot not 600% on the entire clip but take the mag up to 10 that's more or less a thousand percent extra damage of a single shot people that these projectiles can indeed do and when crit shots do almost three or four times as much as a body shot I mean you can hit the body of an enemy these things can spawn in and hit crit shots so fearlessly you can go even higher than a thousand percent so what we actually have here people it seems is a weapon which is basically like the original kings cool before the gearbox nerf the kings and queens cool into almost nonexistence now in terms of power output when it comes to jacob's pistols many would be comparing up against things like the maggie which we all normally say fan favorite and if in reality it's anywhere near the maggie then we know we have a great weapon on our hands now one paper isn't as powerful as the maggie but seen as it has those seeking projectiles which spawn in and track that target doubling up its damage it under simple maths and testing is about 80 percent stronger than the standard maggie but in saying that the maggie as we know comes anointed which then in this instance can't be touched even though still then damage will be higher but it isn't significantly higher than this weapon the seventh sense although it seems anointments aren't a thing it's still a great and powerful weapon and one I feel is definitely worth your time getting and even if you don't think the weapon will do your build any justice as the mission itself to get this thing is the best I've done so far so yes this weapon is up there with the maggie no doubt about it and in many instances people in my opinion it's actually a better weapon now normally when we go into quest lines the normal outcome is usually a novelty weapon one that looks good does something unique but doesn't really perform well this does this takes all three boxes for a great great weapon it looks good super unique and it does perform great and now guys if you don't want to be spoiled by the mission to get this thing leave now I will leave you to watch the entire thing it's pretty cool if you ask me and the whole story and theme about this weapon and the quest is something I'd love to see more of going forward so my fourth and the seventh sense is a great weapon a great new addition to the jacob's pistol family one that is seriously unique and does pack a deadly punch and I do feel you should at least try this thing out and see how it works for you and on that note guys we have come to the end of the video if you guys enjoyed it leaving a like really helps out if you're new and you want to see more boardlands be sure to subscribe and if you never want to miss a video upload you can turn notifications on by hitting that bell button but guys thanks as always for stopping by hopefully you enjoyed the video and hopefully I will see you on the next one now bring him here friend let's check out this case long there's a girl who died I forgot to tell me what her name was how's the case going from your perspective crack wide open beginning to crack what's the current level of the crack looks like my journal is full of obituaries aha that's what I was doing in the cemetery meet me there I won't remember anyway so my name is Zanzi call holless bandit game show hostess on pandor it's like in one of those stress dreams where you can't pick up a bottle burden birdie bird bird bird they're friendly don't need to breath here you've got secret passageways and you weren't going to share with all Zen by what can I say guess I'm just mysterious like that besides the man's gotta have some secrets let's cross references obituaries with the graves around here this loyal pitman fella kicked the bucket trying to give CPR to a zappy critch named elmer that he loved that's a new one this last order may have been missing presume dead looks like she was blabbering on about a fish some bad boy your name Brad with two teeth croak trying to taste the danger I can't go in there you scared of dead folk no it's not that there's this go on ahead in the painting this speaks to me from the far side of a char black chasm an echo of an echo here take it I can't look at it anymore there's something wrong about it something just try putting it back where it belongs thing on a grave that says your help with all this I'm gonna go ahead and use my secret passages again and no you're I'll see you at the gunsmith's shop mystery of that box let's see if the gunsmith is in Hartford let us this we gotta talk we our old friend right I need you to take a look at something we found in the cemetery oh taking a grave robin then have we how charming well give it here let's take a look go on then give it to us based on the maker's mark I'd say this was the work of my grandfather now there was a man of many secrets always played it real close to the best also always war vest classy fellow let's see if we can get her open well well what do we have here this is exquisite well quit it with the suspenseful pause already fella what do we find it's a pistol but it's been merged with some kind of iridian technology quite a rare artifact you've got here let me take a look at that old friend I think this was mine holy hellfire friend I'm gonna need you to take this now if you've got the stomach for it look through the scope right over there tell me what you see either way let me know when you're ready to move on I'll go I'll start something that's a new one so you did see it incredible this is a bottomless well of secrets and all we're hauling up are more questions my hunches are telling me there's more to discover on this case than thinking about that pain and I finally placed it it was a room in the archives the art gallery but there was a shadowy ominous presence the next knot to unravel has got to have something to do with that room I'll make my way to the archive meet me there look at us would you already finished now I don't know why this door would be locked but the art gallery is back there and you don't work in my profession this long without learning how to handle a lock give me a sec while I pick it up with me you're gonna want to see this with your own eye what's your name little lass met a little ghost lass cute as a button she was said she wanted to go home and disappeared her name was iris that name again a cabin in the canker would gonna be all right the key to seeing her again it's coming with us grab it for me would you and this all has something to do with that pistol let me tinker with it see what I can do it wasn't always a private eye I mean I don't remember I have to excuse my wandering mind this has all been a lot to take in curse or no curse how could I do that what kind of a man am I I'm sure it wasn't your fault don't beat yourself up about it I used the scope on that pistol to focus the effects of the portal device thinking you might be able to create a window into the wherever she is now let's set it up outside the hunches friend trust the hunches okay I don't know maybe shoot the damn thing to kick start the dimensional servos or whatever I'm sorry sweetie papa come away from that thing just a quick jaunt out of the known universe I'm game let's go well that's new a lot of new things today as soon as we went into that place I I remembered everything I couldn't do it I just couldn't relive that moment again put the pieces back together ever since please tell me she's safe now tell me she's at peace come on down from that perch there's someone who wants to talk to you huh I'm so sorry I I didn't know it was you I I couldn't save you it's not okay it's never gonna be okay because you're gone I'm so sorry of you too sweetie always listen uh oh never be able to thank you enough for everything you've done for me today but thank you think I need to be alone for a while