ChatGPT For Cybersecurity

Summary

This video explores the utilization of Chat GPT for cybersecurity, offering insights into its capabilities and applications for both red and blue teams. The presenter demonstrates Chat GPT's ability to answer complex questions, generate code, and assist in tasks like vulnerability scanning and writing queries. The video addresses concerns about AI's impact on cybersecurity jobs, arguing that Chat GPT enhances knowledge and efficiency rather than replacing human professionals. It concludes with a discussion on the importance of validating Chat GPT's information and using it as a tool to improve cybersecurity practice.

Takeaways

• 🤖 Chat GPT is an AI-driven chatbot by OpenAI that uses reinforcement learning from human feedback (RLHF) and is built on top of the GPT 3.5 language models.
• 🔍 It is designed to answer follow-up questions, admit mistakes, challenge incorrect premises, and reject inappropriate requests, showcasing its conversational capabilities.
• 🆓 Chat GPT is currently free during its research preview stage but is expected to be placed behind a paywall once the preview ends.
• 🛠️ The tool can be utilized for various cybersecurity tasks, demonstrating its potential to be an invaluable resource for both red team (offensive security) and blue team (defensive security) practitioners.
• 🔑 Chat GPT can generate code snippets, identify vulnerabilities, and provide solutions, which can streamline tasks for cybersecurity professionals.
• 🚫 Despite its capabilities, Chat GPT is programmed to reject requests that may violate its content policy, such as generating phishing emails.
• 💡 The video suggests that Chat GPT can enhance the knowledge and skills (KSAs) of cybersecurity professionals rather than replace them, by providing quick and efficient answers to complex questions.
• 📚 It emphasizes the importance of the NICE framework, which uses KSAs to assess an individual's qualifications and readiness for a job role.
• ⚠️ The script highlights the need to validate information obtained from Chat GPT due to the lack of displayed sources and the potential for inaccuracies.
• 📝 The presenter advises being specific and providing context when asking Chat GPT questions to receive the most accurate and useful responses.
• 👍 The video concludes by encouraging viewers to try Chat GPT for themselves and to share their thoughts, suggesting that the presenter is excited about the tool's potential and the discussions it will generate.

Q & A

What is the main focus of the video?

The video focuses on demonstrating how to utilize Chat GPT for cybersecurity, showing its capabilities and discussing its potential impact on the cybersecurity industry and jobs.

Why has Chat GPT received attention from the cybersecurity industry?

Chat GPT has received attention because cybersecurity professionals quickly adopted it to test its capabilities and discovered many innovative uses for it in the field.

What is the purpose of showing Chat GPT's capabilities in the video?

The purpose is to illustrate the potential of Chat GPT as a tool for improving knowledge, skills, and abilities in cybersecurity and to encourage viewers to explore its uses themselves.

What is Chat GPT and how does it work?

Chat GPT is an AI-driven chatbot launched by OpenAI in November 2022. It is trained using reinforcement learning from human feedback and is built on OpenAI's GPT 3.5 family of large language models.

How can one get started with Chat GPT?

To get started with Chat GPT, one can visit the provided link, create a free account, and access the chatbot at chat.openai.com.

What is the difference between Chat GPT and Instruct GPT?

Chat GPT is optimized for dialogue, allowing it to answer follow-up questions and interact conversationally, while Instruct GPT is trained to follow an instruction prompt and provide detailed responses.

What are some limitations of Chat GPT mentioned in the video?

One of the limitations mentioned is that Chat GPT can be excessively verbose and overuse certain phrases, such as restating that it's a language model trained by Open AI.

How can Chat GPT assist cybersecurity students or practitioners?

Chat GPT can provide detailed explanations, code snippets, and guidance on various cybersecurity topics, which can be an invaluable resource for learning and problem-solving in the field.

What is an example of a red team use case for Chat GPT demonstrated in the video?

An example of a red team use case is generating a PHP reverse shell one-liner and encoding it in base64, which can be useful for penetration testing.

How does Chat GPT handle requests that may violate its content policy?

Chat GPT will refuse to generate content that may violate its content policy, such as creating a phishing email, and will inform the user of the violation.

What is the potential impact of AI, like Chat GPT, on cybersecurity jobs according to the video?

The video suggests that AI, including Chat GPT, will not make cybersecurity professionals redundant but instead will enhance their knowledge and skills, making them more efficient in their roles.

What is the Knowledge, Skills, and Abilities (KSA) framework mentioned in the video?

The KSA framework is a model used to categorize a person's abilities and readiness for a job. It breaks down a person's qualifications into knowledge (theoretical understanding), skills (technical proficiencies), and abilities (demonstratable capacity to apply knowledge and skills).

What advice does the video give regarding the use of Chat GPT for research?

The video advises to always validate the results obtained from Chat GPT, be specific with questions, provide context, and not rely solely on Chat GPT for research due to its current limitations and lack of real-time learning.

Outlines

00:00

🤖 Introduction to Chat GPT for Cybersecurity

The speaker introduces a video focused on utilizing Chat GPT for cybersecurity purposes. They explain the intent to demonstrate Chat GPT's capabilities and its potential impact on the cybersecurity industry. The video aims to address questions about Chat GPT's influence on cybersecurity jobs and its use as a tool to improve knowledge and skills in the field. The speaker shares their experience with Chat GPT and its training process involving reinforcement learning from human feedback. The video promises a practical demonstration and a discussion on the long-term effects of AI on cybersecurity.

05:01

🔒 Exploring Chat GPT's Features and Limitations

This paragraph delves into the features of Chat GPT, highlighting its conversational method of interaction and its ability to answer follow-up questions, admit mistakes, and reject inappropriate requests. The speaker discusses the model's training process, including reinforcement learning from human feedback and its relation to Instruct GPT. They also mention the limitations of Chat GPT, such as verbosity and overuse of certain phrases, and the iterative deployment of the model. The speaker provides examples of how Chat GPT can be used, particularly in the context of coding and development, emphasizing the importance of providing context for nuanced questions.

10:03

📚 Demonstrating Chat GPT's Practical Applications

The speaker provides a live demonstration of Chat GPT's capabilities by interacting with it through the open AI website. They showcase how to create an account, access the chatbot, and utilize its conversational format to ask questions and receive detailed answers. Examples given include defining terms, providing explanations, and generating code snippets for tasks like scanning for SMB vulnerabilities with nmap. The speaker emphasizes the value of Chat GPT as an educational resource for cybersecurity students and professionals.

15:05

🎯 Advanced Cybersecurity Queries with Chat GPT

The paragraph explores more complex uses of Chat GPT for cybersecurity, including generating code for tasks like creating a PHP reverse shell and fuzzing XML files with gobuster. The speaker demonstrates how Chat GPT can provide detailed explanations and code examples, even when prompted with advanced and specific cybersecurity-related questions. They highlight the potential of Chat GPT to streamline research and problem-solving in cybersecurity.

20:05

🛠️ Generating Code and Automating Tasks with Chat GPT

The speaker discusses Chat GPT's ability to generate code and automate tasks, such as creating a shell code that executes cmd.exe or generating a macro for Office Suite. They also show how Chat GPT can help in writing emails, automating port scanning with bash scripts, and even creating CTF challenges with specific vulnerabilities. The video illustrates the versatility of Chat GPT as a tool for both red team and blue team cybersecurity operations.

25:08

🛡️ Utilizing Chat GPT for Blue Team Operations

This section focuses on how Chat GPT can be used to support blue team operations. The speaker shows examples of using Chat GPT to write search queries for detecting registry changes in Windows logs, build regular expressions for filtering IP addresses in Splunk, and identify vulnerabilities in provided PHP code. They emphasize Chat GPT's potential as a resource for improving knowledge and efficiency in cybersecurity practices.

30:10

🤖 The Impact of AI on Cybersecurity Careers

The speaker addresses concerns about the impact of AI, specifically Chat GPT, on cybersecurity careers. They argue that Chat GPT will not replace cybersecurity professionals but will instead enhance their knowledge and skills. The video discusses the NIST and NICE frameworks for assessing knowledge, skills, and abilities, suggesting that Chat GPT can significantly improve the knowledge aspect of cybersecurity professionals' competencies.

35:10

🚀 Conclusion and Future Outlook on Chat GPT

In the concluding paragraph, the speaker summarizes the benefits of Chat GPT as a resource for improving knowledge and efficiency in cybersecurity. They highlight the importance of not relying solely on Chat GPT and the need to validate its outputs. The speaker also expresses excitement about future videos that will explore more resources and integrations with Chat GPT for both red and blue team operations. They invite viewers to share their thoughts and engage in a discussion in the comments section.

Keywords

💡Cybersecurity

Cybersecurity refers to the practice of protecting internet-connected systems, including hardware, software, and data, from theft, damage, or unauthorized access. In the video's context, it is the main theme as the presenter discusses the use of Chat GPT in both offensive (red team) and defensive (blue team) cybersecurity operations. The script mentions cybersecurity professionals quickly adopting Chat GPT to discover its capabilities.

💡Chat GPT

Chat GPT is an AI-driven chatbot developed by OpenAI that uses reinforcement learning from human feedback to engage in conversational interactions. The video showcases Chat GPT's potential in cybersecurity, demonstrating how it can assist in tasks such as scanning for vulnerabilities, generating code, and providing explanations for complex concepts.

💡Red Team

In cybersecurity, the red team represents the offensive security side, simulating attacks to evaluate an organization's security posture. The script provides examples of how Chat GPT can be utilized on the red team side, such as generating a PHP reverse shell one-liner or fuzzing XML files with gobuster.

💡Blue Team

The blue team in cybersecurity is responsible for the defensive side, monitoring and protecting systems from threats. The video discusses Chat GPT's applications for the blue team, like helping to write search queries for detecting registry changes or identifying vulnerabilities in code.

💡Reinforcement Learning from Human Feedback (RLHF)

RLHF is a learning technique where an AI model is trained based on feedback from human interactions. The script explains that Chat GPT is trained using this method, making it capable of conversational interactions and the ability to learn from and adapt to user inputs.

💡Knowledge, Skills, and Abilities (KSAs)

KSAs refer to the knowledge, skills, and abilities an individual needs to perform a job successfully. The video emphasizes that Chat GPT can enhance a cybersecurity professional's KSAs by providing quick and efficient access to information, thus improving their overall capabilities in the field.

💡Vulnerability Scanning

Vulnerability scanning is the process of detecting potential weaknesses in a system that could be exploited by attackers. The script demonstrates Chat GPT's ability to provide commands for scanning SMB vulnerabilities with nmap, illustrating its utility in vulnerability assessment.

💡Code Generation

Code generation is the creation of new source code using automated tools. The video shows Chat GPT's capability to generate code snippets, such as a PHP reverse shell or a bash script for automating port scanning, highlighting its potential as a coding aid.

💡Buffer Overflow

A buffer overflow is a type of security vulnerability that occurs when a program attempts to write more data to a fixed-length block of memory, or buffer, than it can hold. The script includes an example where Chat GPT generates C code vulnerable to buffer overflows and explains how to fix it, demonstrating its educational value.

💡SQL Injection

SQL injection is a code injection technique used to attack data-driven applications, where malicious SQL statements are inserted into an entry field for execution. The video demonstrates Chat GPT's ability to identify and provide solutions for SQL injection vulnerabilities in PHP code, showcasing its utility in secure coding practices.

Highlights

Introduction to utilizing Chat GPT for cybersecurity, explaining its capabilities for both red and blue teams.

Chat GPT has gained significant attention in the technology and cybersecurity industry.

Demonstration of Chat GPT's ability to answer questions and provide examples for cybersecurity tasks.

Chat GPT is an AI-driven chatbot launched by OpenAI, trained using reinforcement learning from human feedback.

Explanation of Chat GPT's conversational method of interaction, allowing follow-up questions and corrections.

Chat GPT's response to specific cybersecurity queries, like scanning for SMB vulnerabilities with nmap.

Generation of a PHP reverse shell one-liner by Chat GPT.

Chat GPT's ability to encode code snippets, such as base64 encoding.

Demonstration of Chat GPT providing commands for fuzzing XML files with gobuster.

Chat GPT's capacity to generate shell code that executes cmd.exe.

The ethical stance of Chat GPT when asked to generate a phishing email, highlighting content policy adherence.

Creation of a bash script for automating port scanning with nmap by Chat GPT.

Chat GPT's assistance in writing an email to employees about end-of-year bonuses.

Generation of a macro that executes cmd.exe by Chat GPT.

Chat GPT's explanation of buffer overflow vulnerabilities and provision of vulnerable C code.

Discussion on the impact of AI like Chat GPT on cybersecurity jobs and the industry.

Highlighting that Chat GPT will not replace cybersecurity professionals but enhance their knowledge and skills.

The importance of the knowledge, skills, and abilities (KSAs) framework in assessing and improving cybersecurity professionals' competencies.

Advice on using Chat GPT responsibly and not relying solely on it for cybersecurity tasks.

Transcripts

foreign

[Music]

here back again with another video in

this video I'm going to be showing you

how to utilize chat GPT for cyber

security

um so I'm gonna you know start off by

explaining what it is uh because a lot

of you have asked me about it and uh

sort of giving you examples of how it

can be used both on the red team side of

cyber security as well as the blue team

site and of course we'll be discussing

my haircut in the comments section but

let's get started so I'm just going to

give you a you know very uh brief

introduction uh in the form of slides

because I think that's most appropriate

um so why am I making this video uh well

firstly as you already know chat jpt has

received a lot of attention from the

technology industry and specifically the

cyber security industry and this is

something that you know uh you know took

open AI the company behind chat jpt by

surprise uh given the fact that you know

cyber Security Professionals will

quickly jump on chat apt and test it and

we've discovered a lot of crazy things

that can be done so the main objective

here is to show you how you can how tall

to use it is very very simple and then

of course show you what it's capable of

at a very basic level of course I'm

encouraging you to try it out for

yourself so there have been a lot of

questions surrounding the impact uh you

know the effects that chap uh chat GPT

will have on cyber security uh the cyber

security industry and practitioners so

that's one of the second reasons why I'm

making this video is I've gone a lot of

private messages are asking me well uh

you know chat GPT is cool but what

impact will this have not just through

chat GPT but generally speaking what

impact will AI have on cyber security

and will this affect cyber security jobs

so on and so forth and the other reason

of course is it's an invaluable tool or

resource that can be used to improve

your ksas that is knowledge skills and

abilities in a particular field within

cyber security but not limited to cyber

security as you'll see and finally of

course it's a game changer in my opinion

now the main question is why have I

taken this long to make a video on

chatgpt well the reason for that is

firstly I wanted to try it out for

myself

and also think quite deeply about the

second Point here which is a question

and that is how will this affect cyber

security in the long term all right and

I'll be answering that towards the end

of the video so lots of reasons and I

wanted to take my time and sort of under

stand it get an idea of what it can and

can do what are its benefits and of

course limitations so that begs the

question what is chat GPT well chat GPT

is an AI driven chatbot launched by

openai in November 2022 it is trained

using reinforcement learning from Human

feedback which is a um

a learning technique and of course that

the abbreviation for that is RL HF which

I'll touch upon and it's built on top of

openai's GPT 3.5 family of large

language models and is fine-tuned with

both super supervised and reinforced

learning techniques and you can get

started with uh chat DPT by visiting the

following link it is currently free at

the moment because it's still in the

preview mode and I'll explain what that

means but you'll actually learn a lot

about this shortly so

that's essentially an intro to chat GPT

now the best way to show you this is to

actually give you a demo so I'm going to

switch over to my browser and we can get

started

all right so I'm currently on the open

AI website and the reason I want to

start off here is because this is your

starting point so you'll need to create

an account is free and then you'll have

access to uh chatgpt or the chatbot

itself which is accessible on the

chat.openei.com

but before that we need to understand a

few things so right on the website we

have a a brief description so you can

see chat GPT optimizing the language

models for dialogue so we've trained a

model called chatgpt which interacts in

a conversational way that's very

important one of the the great things

that a lot of people have liked about

chat GPT and really on the utilized is

its conversational uh method of of

interacting with you or with you know

you interacting with it so what this

means is that the dialog format makes it

possible for chat TPT to answer

follow-up questions which is something

again that you should take advantage of

admit its mistakes challenge incorrect

premises and reject inappropriate

requests so in addition to just giving

you answers and you're responding in

let's say a way that it expects you know

sort of asking a follow-up question you

can also you know essentially tell the

actual chatbot that hey this doesn't

look correct and uh you know the

response obviously will either be too

you know to cross verify that or to tell

you you know this is where it's limited

so on and so forth so

um chat Deputy is a sibling model to

instruct GPD which is trained to follow

an instruction prompt and provide a

detailed response and of course you can

scroll down right over here and you know

you know they essentially go over some

of its strengths and weaknesses and at

the moment you can see it's free uh

during the research preview stage and

this is a tool that obviously is gonna

be priced or BPI is going to be behind a

paywall and you'll see why in a couple

of seconds so you can see that again

they give a couple of examples here

specifically for developers where you

can put in a code snippet or a chunk of

code and say this code is not working

like I expect how do I fix it all right

so there's two questions in that one

statement and it's a very detailed

specific question and you know you the

user paste in the snippet of code and

you can see the response from chat GPT

is you know tells you it's difficult to

say what's wrong with the code without

more context so this is something that's

very very important uh for bespoke

questions or very nuanced questions

um you will be required to provide

context and that is something that you

need to be acutely aware of anyway you

can see that jtbt responds and you know

the user says the error never surfaces I

think there's something wrong with the

channel so you know there's essentially

a conversation there so on and so forth

and they go ahead and explain the

methods so this is where we have the um

reinforcement learning from Human

feedback uh technique and this is the

same technique used or the same method

that's used as or within instruct GPT

with slight differences in the data The

Collection setup so they've trained the

initial model using a supervised

fine-tuning human AI trainers provided

you know provided conversations in which

they played both sides the user and the

the AI assistant we gave the trainers

access to model written suggestions to

help them compose their responses we

mixed this new dialogue data set with

the instructor GPT data set so on and so

forth so they actually explained this

entire process which I recommend you go

through and of course they outline the

limitations so I'll specifically talk

about one of the limitations here

and uh this one right over here so the

model is often excessively uh verbose

and over uses certain phrases such as

restating that it's a language model

trained by open AI so on and so forth

and you'll actually see that so

uh yeah and then finally of course it's

an iterative deployment so do take note

of that and um you know you can actually

go through their website now to get

started uh you can see I've signed in

and this is the interface uh

fundamentally speaking so you can see

that you have the Discord server at the

bottom here and you can switch to a

light mode or a dark mode and you can

you know check the latest updates and

the FAQ pages and you can log out and

you can create new chats here so I'm

currently interacting with it here and

it gives you very useful uh very useful

starting point so you have examples

capabilities and limitations

and we're going to be taking a look at a

couple of examples both on the red team

side and the blue team side of things so

just keep that in mind and you know

you'll actually see how powerful this is

um so to get started um how does this

work well you essentially ask it a

question all right that's very very

simple you just say uh you know so I can

ask for example what is red teaming very

simple question right and this is how

it'll respond so it'll say red taming is

a method you know of evaluating the

strengths and weaknesses of plan

organizational or system by simulating

the actions of an adversary uh we can

send you know

uh we can then ask it a follow-up

question this is not really a good

example but um I'll show you what that

looks like so you ask it a question and

it gives you a definition now one of the

the issues that I have especially for

researchers is this definition of course

does not you know it doesn't tell you

where it's obtained the definition of

course there's multiple sources behind

the data set but it doesn't give you the

actual sources so for researchers you

know this will sort of give you a very

succinct explanation which you can then

derive from and then perform further

research but you know you ask it a

question and

um you know

it then gives you a response based on

what you asked it so in this case I can

say what's uh for example what is nine

times eleven sorry what is nine

um times 11.

I can ask it that uh the way and say

that uh is incorrect all right that's

sort of the responses that you can give

so you can see I told you that it's

incorrect now of course I know it's

correct but it tells you right over here

I apologize for the mistake the correct

answer is 99. please let me know if you

have any other questions so this is one

of the important things that I wanted to

touch upon is that you can have a

dialectic

um you know discussion or dialogic

discussion with the actual chatbot and

it's very intelligent now of course I've

used very stupid examples but you also

have the ability to modify your

questions and more importantly you can

also start a new chat so I'm just going

to delete this one here because if you

take a look at this here it remembers

what the user said earlier in the

conversation so for different topics and

contexts I'm just going to create a new

chat like we have over here so I'll give

you a simple example of what a cyber

security student or practitioner may ask

a chat GPT so for example I can say uh

let's try and change it we can say how

can I scan uh for SMB vulnerabilities

with nmap you know that's a it's a very

I wouldn't say it's a very specific

question but we're asking it a question

that's loaded with context and uh what

am I saying when I say this well we've

mentioned a tool we've mentioned a

specific technology SMB and this is in

the context of both offensive and

defensive security but I can say you

know I can ask the question here

uh now this is one of the issues with

its verbosity in that it now it gives

you a definition of nmap which is very

very helpful

um but um you can see that uh right over

here it gives you the definition of what

nmap is and then it says to scan it uh

to scan for SMB vulnerabilities with

nmap you can use the following command

and it actually gives you the the actual

code snippet here so nmap you limit the

scan to Port 445 and then you specify

the script option and then you specify

the SMB vulnerability scripts but use

the wildcard flag right over here or the

wildcard option to specify that you want

to use all nmap scripts and then specify

the Target right and then it gives you a

follow-up explanation which is awesome

so it tells you that this will scan the

target host for network uh this will

scan the target host on network for SMB

vulnerabilities and then it explains

what each of the options in flag flags

do and then it says radio you can also

use the a option to enable OS detection

and version scanning so on and so forth

so

I mean this is absolutely incredible if

you think you know if I think about it

from when I was a student or when I was

getting into cyber security this is an

invaluable resource now why am I saying

this you know you might be saying well

there's resources online that you can

find via Google and that's true however

to ask to be able to ask a question like

this with a very basic I would say

grammar or I did maybe I didn't

structure it correctly but I had enough

context and for this explanation uh you

know for this question to be answered

with such a you know really well written

explanation and examples of code

Snippets as well as

um the actual explanation of what the

command does is absolutely fantastic so

that's a very basic example now we can

try out a couple of other examples so

for example you know I can say

um

generate a PHP reverse shell one liner

now this is you know you may be asking

yourself can I do this well of course so

it gives you the definition of what a

reverse shell is and then absolutely

incredible it provides you with a

it provides you with a PHP reverse shell

one-liner and explains how it works

fundamentally speaking I mean this is

absolutely insane now follow-up question

that I could ask is

encode the code above

you know

and then right over here it tells us you

know to encode the PHP reversial one

lineup you can use a tool such as base64

so you know we didn't provide it with

context with regards to how we want to

encode it but you know we can ask

follow-up questions and this is

absolutely phenomenal so it encodes it

in base 64. and you can see this will

output the encoded version right over

here that's how to generate it as a you

know one-liner base64 string and to

decode it you know it gives you

instructions not to decode it so

absolutely phenomenal so these are just

a couple of examples now I can even go a

bit further with this I can say for

example

um

let's try something a bit a bit more

nuanced so I can say uh how can I fuzz

uh sorry let me type that in correctly

how can I fuzz 4

um XML files with gobuster and let me

make sure you guys can see this but

there we are you can see how can I fast

for example files with Go Buster

that we also gives you a definition of

what gobuster is and um

you know this is absolutely incredible

so it actually explains really

everything about that particular command

and it then gives you an example

and I can show you another follow-up

that you can ask it as you know as we

are curious pen testers really uh you

know we could maybe say all right so

um

let's see if I can if this will work so

I can say

um

uh we can say fuzz how can I I'll just

write it here so using the above code

how can I also limit gobuster to fuzz or

um PHP files

that return

a let's see this is actually a quite

difficult return a not difficult you

know very simple to understand to

understand but let's say return a 200 uh

status code

let's see if this actually works this is

uh you know

there we are it actually works so tells

us how to limit uh you know files that

were found that return at 200 um an HTTP

200 status code so I mean this is

absolutely incredible now of course

we're taking a look at Red Team examples

and I'll I'll go through a couple more

just to show you how robust this is and

uh you know again the same question may

be asked uh you know

wouldn't be wouldn't this be easier to

search for directly on Google and the

answer is yes you can search for the

same thing however I don't think Google

can answer this question as specifically

as chat GPT has so for sure once the

research preview has ended they are

going to put this behind a paywall I

definitely deserves that I mean I'd be

happy to pay for this I found tremendous

use

um

I found this extremely useful when doing

research so on and so forth but uh you

know that's just a very basic example

that you can do now you may be asking is

it just limited to commands can we

generate some code of course we can so I

can say

um

generate a Shell Code

uh that executes

cmd.exe so let's say you want to

generate some Shell Code all right it

explains what's Shell Code it explains

what shell code is and then it gives you

some sample Shell Code that will execute

command.exe

all right there we are so just wait for

it to complete generating of course it

doesn't format it correctly but you get

that there now of course another thing

that I need to State and you'll see this

shortly is based on their

uh the actual policies and guidelines

you can really you know

interact with chat GPD in a way that may

produce results or information that

could be used for illegal activity so I

can say you know generate a phishing

email and you'll see the response here

so once it's done with this particular

question

or query if you will

I can say generate a phishing email

there we are so it tells us right over

here this content may violate our

content policy and what we can do then

let's say you know we don't regenerate a

phishing email it's too abstract anyway

but let's say we're trying to generate

some a very well written email so we can

for example say

um

let's see

um I can say write an email informing

employees of uh sorry let me type that

in

informing employees

of end of year bonuses

let's say we want to perform you know

phishing campaign we want to generate a

very well written email you can see it

actually does that for you so I mean

this is absolutely insane even more

insane than my haircut so anyway uh

getting back to this but uh you know it

actually it actually highlights areas of

substitution but there we are dear old

uh I am pleased to announce that our

company will be offering end of year

bonuses to all employees and of course

you can modify this and say click on the

following Excel or click on the

following document and sign it so on and

so forth and you know the that

particular document could contain a

macro speaking of macros can we generate

a macro

um let's try this we can say generate a

macro that executes and I'm sticking to

cmd.exe for Simplicity here that

executes cmd.exe

all right so it explains what macros are

in the context of office or the office

suite

um and it actually generates that macro

so

uh yeah yeah this is absolutely insane

uh and then you know I can ask it a

follow-up question

um

on the above code modify the above code

uh

to execute

a

Powershell script I know this is quite

stupid but uh you know I can ask it to

do this you can see that the only thing

substituted would be you know specifying

the path to the actual partial script

but I mean absolutely phenomenal I I

don't know whether you guys can see how

excited I am and this is this is like

insane do I have this type of resource

available is uh I mean I I can't even

believe that I'm seeing this

um

whatever you are doing this you know

some buff overflows which I'll be

covering on the channel uh but you can

say

C code vulnerable

to buffer overflows

you know very simple question explains

what a buffer overflow is

and

there we go generates the C code and

then it'll um let's see if it actually

provides an explanation there we are as

to why it is vulnerable so this can be

seen as both you know useful from the

perspective of a red team and blue team

um

but you can see there we are it actually

explains that and uh

we can say fix the above code if I can

type correctly today

there we are and um

where it'll actually show you how to fix

the the buff overflow vulnerability this

is this is mind-boggling guys and of

course I would love to hear what your

thoughts are in the comments section now

I'll be making follow-up videos on chat

GPT because there's a tons there's tons

of resources you know the desktop

applications the browser extensions uh

plugins for you know tools like Ida that

have been released I'll be covering them

how they they can sort of be utilized to

streamline the operations but these are

sort of the examples now I'll touch on a

couple of other examples for red team as

and I'll show you some blue team

examples

um you know so

and another one maybe could be uh you

know generate a bash script and this is

really cool and I'll show you why bash

script to that

um

that automates Port scanning within map

all right

I mean this is it actually provides

documentation I mean this is absolutely

insane now of course

this is something that you need to

verify you know you can't just take this

and run it in the case of more complex

pieces of code but it also tells you how

to execute the

just absolutely insane hope you guys are

excited as I am so that's very simple

but we can also do a bit of chaining

here so in addition to that I can say uh

I need a bash script

that automates

a sub domain enumeration with a tool

with you can say sublister

and

um

takes screenshots

with eyewitness this is more so for

those you know of you who are bug bounty

hunters uh it actually generates it and

looks like it gives us that uh

uh warning here

but uh

with regards to context I mean

I I can't believe what I'm saying I mean

honestly I don't know whether you guys

can

um this is absolutely insane so you can

say it you know prompts the user for the

sub for the Target domain and then

enumerates it with uh with subflist

auto-based the process and it outputs it

into a text file and then utilizes

eyewitness to take screenshots and yeah

just absolutely insane now

um

another cool example that I had seen

recently on Twitter is we can say

generate a CTF

challenge

um that contains an SQL injection

vulnerability

okay

oh all right okay all right yeah so we

got the error there doesn't look like it

works anymore but I'll show you

something really interesting in a second

so we've taken a look at some really

interesting red team examples I'll touch

upon blue team so let's take a look at

that now

all right so

I have created a new

um a new chat here so for blue team how

can this be used well let's take some

tools that you typically utilize so for

example we can say let's say we're

trying to learn how to

write a search query to identify changes

in Windows registry right on the Windows

registry from

the logs that are and events that are

being sent to Elk so you can say elk

query to detect

um registry changes

okay that gives you an intro to the

elastic or rather the elk stack and then

I hope you guys are seeing this but uh

there we are

here we are so event ID of 13 and uh

absolutely insane

uh so you can actually use this up you

know a couple of examples are you know

rejects or we can just say regular

expression

um

built a IP addresses

in Splunk let's say

all right it explains what regular

expression is

and of course the code or rather the

regular expression you can use to filter

an IP address in Splunk and now for the

final example in this case I'll use my

own piece of code I'm going to paste in

a piece of code here a PHP code that is

vulnerable to SQL injection because of a

lack of input sanitization

and I'm going to show you that it can

actually identify the issue again

without you know if we had asked jpt to

show give us an example of PHP code that

was vulnerable to SQL injection hey you

might be thinking yourself well you know

it's going to it's going to very easily

do that but let's provide our own code

and let's see how smart it is at

detecting that

all right so I've just brought up a

a PHP piece of PHP code that is

vulnerable to SQL injection so you know

like in this case I can say

um

what's wrong with this PHP code

very simple right and I paste in the

snippet there

and it tells us that there's a few

potential issues with the PHP code so it

says the arcv arrays used to pass

command line arguments to a PHP script

this is correct and then of course the

second Point here the get arrays used to

pass data to the to a PHP script through

the URL query string but it is not safe

to use uh user provided

um

let's see it's not safe to uh to use

user provided data directly in a SQL

query an attacker could manipulate the

ID parameter in the URL to form an

injection attack which could allow them

to execute arbitrary SQL statements at

potentially compromise the database to

fix these issues you could consider the

following wrap the code that passes so

on and so forth the following and then

the if statement itself and then use

prepared statements and you know it

actually gives us an example of how we

can modify the code to address these

issues so think about this from the

perspective of a blue team or even a web

developer or a developer in general you

can easily identify issues in your code

if you're if you know if you're new to

development or

if you're trying to find vulnerabilities

in your code and I mean yeah it's it's

incredible and of course I've just shown

you some very very basic examples here

now I've uh of course I'm not going to

go through some some more examples

because I think you guys get the gist of

what I'm saying here of course I

recommend trying it out yourself and I'm

just gonna clear my conversations here

but now coming to the question one of

the the actual incentives for making

this video and that was how will this

affect cyber security the industry in

general and of course practitioners and

from the questions I received it seemed

that there was sort of a negative

connotation Associated or attached to

the question which makes sense because a

lot of people are saying well if

you know a chatbot

a natural language processing chatbot

can do this and has enough context to

answer these types of questions doesn't

that sort of make in a way

penetration testers or cyber security

practitioners redundant in a way and of

course the answer to that is of course

not right in the case of chat GPT but

the question was

widely asking the impacts of AI on cyber

security and of course you know based on

what we've seen here it's very clear to

me after thinking about it long and hard

having

uh you know practiced in the cyber

security industry for a long time after

having developed training material and

you know I I essentially understand a

lot about instructional design with

regards to cyber security and how to

assess

the knowledge skills and abilities of

let's say a pen tester right and based

on what I've seen here it's very clear

that chat GPT is not going to you know

is not going to get any anyone is not

going to kick anyone out of a job in

cyber security instead it is going to

enhance their Knowledge and Skills with

regards to whatever they're doing

whether they're a pen tester or a blue

teamer or even a developer as I pointed

out now what do I mean by that well

uh you know nist and the nest nice

framework utilizes knowledge skills and

abilities to essentially categorize or

break down

um a person's let's call it

um

a person's ability to do something or

their

their Readiness I I I really can't

explain it in very simply but it

essentially assesses and determines as

it says right over here the best

applicants are when several candidates

qualify for a job all right so

it's known as the knowledge skills and

abilities framework it's widely used and

it's very very important as I said the

next nice framework is adopted by many

governments uh companies as well as you

know intelligence units so on and so

forth It's adopted by a lot of a lot of

organizations for various reasons

because

uh again as I said it determines who the

best applicants are when several

candidates qualify for a job the

knowledge skills and abilities necessary

for the successful performance of

opposition are contained on each job

vacancy announcement so you know it's

broken down into knowledge skills and

ability so knowledge consists of these

subjects topics and items of information

that an employee should know at the time

he or she is hired or moved into the job

let's just disregard

this here all right so knowledge is

essentially referring to your

theoretical

understanding of the field that you're

working in when I say theoretical I mean

understanding of what your role consists

of at a high level uh so sort of

understanding the elements that make up

you know your job and understanding them

theoretically very well skills refer to

the technical or manual proficiencies

which I usually learned or acquired

through training or through application

or empirical

empirical actions so this is where you

know uh you know none of these precedes

the other but you'll typically you'll

typically start off with knowledge so

you know you have your skills now and

this is where you're able to now take

information which is what we did with

chat GPT where you can ask it a question

you get knowledge regarding a particular

topic and I'm speaking very micro now

you know I can ask it what is adverse

remulation it tells me what adversary

emulation is I can ask it some follow-up

questions but at the end of the day I

still need to go and do that out

manually okay and that's where skills

come into play so with regards to how

charged apt will impact or affect cyber

security

I think that it will greatly

I mean

incredibly improve knowledge that the

knowledge of the the Next Generation and

the current generation of cyber Security

Professionals because you'll be able to

again get answers to your questions very

very quickly uh very efficiently and

you'll essentially improve or better

your understanding of whatever you're

you know you're doing or you're trying

to learn or whatever you're practicing

and of course this applies to not just

students but practitioners cyber

security practitioners people who work

in jobs as I give you an example with

the the elk query example where you know

if you're someone working in a blue team

and you're having a bit of issues you

can sort of offload a bit of the problem

solving to chat GPT or help it make you

understand what you need to do from a

fundamental level and this is where as

an individual you can then assess your

gaps in knowledge so if you're having a

a tough time with writing elk queries

and you utilize chat GPT you can

essentially say okay I clearly don't

understand this enough

can you help me get started with

learning regular Expressions how to

write regular Expressions then you move

on from there but at the end of the day

this would still need to be done

manually so

you then have abilities right abilities

present demons uh demonstratable

capacity to apply several knowledge and

skill simultaneously in order to

complete the task or perform an

observable Behavior so this is referring

now to your actual job right skills is

really talking about

um you know technical or manual

proficient proficiencies and highlight

your ability to do things uh like I

don't use the word ability but

highlights your competency with regards

to performing what fall what falls under

your your actual job role and your

responsibilities and then abilities

present demonstratable capacity to apply

several Knowledge and Skills

simultaneously so sort of the

intersection of all of the elements that

make up your job role so if you think of

a blue team abilities is where you have

the ability to detect threats

um perform correlation perform incident

handling incident response on and so

forth so

as I said the reason why I use this is

to sort of break that down of course

I've rambled on for a long enough time

but I think that jpt will greatly

improve this aspect here knowledge uh

and it'll make people much more

efficient with regards to what they're

doing and will make learning much more

efficient now as I said this area here

is something that again will not change

at least in my opinion unless AI systems

actually start doing this themselves but

even with that being done it would still

need manual verification because again

it's very difficult to

at least in the short term assign some

form of responsibility to a system to

essentially you know for example find

vulnerabilities in code fix them without

breaking let's say a web application but

at a very basic level they can do that

at the moment but these two I think here

is where humans will still be required

obviously uh but um

you know with regards to knowledge you

can obviously see that it's sort of you

know it's absolutely amazing and that's

essentially what I wanted to point

across instead of looking at chat GPT as

a threat to you and you know your skills

or whatever because even when I tried

this I was like wow this is I mean wow

you you can ask any question you had

really at you know take into account all

of the the limitations you can ask it

you know anything you had and it's much

faster than a Google search much faster

than watching a video which is a bit

scary to say but uh

this is one of the reasons why I focus

on this framework because

in my videos I try and cover all of this

right and of course abilities now come

through repetitive action and having an

understanding of different aspects of in

our case cyber security but I touch upon

knowledge so I explain things to begin

with and then I go over the skills or

how to use a tool you know so on and so

forth this is what you do in this case

on etc etc and then abilities is taking

into account maybe uh one to ten videos

that combine a lot of things together

and put it or give you an actionable you

know an actionable skill if I can use

that word without you know contradicting

myself so

judge GPT is your friend it is an

incredible resource that I wish I had

when I was getting started and uh you

know I'd like to hear what you guys

think of this and of course now to to

end off this uh particular presentation

I just want to you know go over a few

issues which you should be aware of and

I've already highlighted one of them and

that is that there are no sources

displayed in the context of research

uh information may not be accurate so

always validate your results and this is

where I say never rely on chat GPT alone

at least at this point in time and of

course because it is a

um you know it is an AI system

based on the current preview learning

has ended so it's currently working with

its current data set and is not learning

anything new so keep that in mind and of

course some Pro tips from my end is

always be specific provide context and

do not rely on chat chat GPT for

everything uh with that being said

um thank you very much for watching this

video if you found value in it please

leave a like and share it furthermore I

will be covering chat GPT more because I

think there's a lot to to touch upon and

specifically you know showing you

various resources that can be used to

integrate chat GPT or you can use you

can integrate chat GPT with to you know

streamline the operations whether in the

red team or blue team but I would love

to hear what you guys think and um

really looking forward to the discussion

that we'll have in the comments section

so thank you very much for watching and

I'll be seeing you in the next video

I just want to take a couple of moments

to thank all patreons thank you Michael

Hubbard Dustin umbres Jerry speds doozy

Sid Saab Ryan Carr Shamir Douglas JoJo

Bibi balangos Kush Kev RS Nino buikov

and David Bricker you guys are really

awesome thank you very much for

supporting us and you guys make these

types of videos possible so we really

appreciate it and we look forward to

producing even more high quality content

foreign

[Music]