How Hackers Can Use ChatGPT to Launch Automated Attacks

Basic API Interrogation

During my time here at Cequence, I have been impressed with the attackers we face. Often, they have almost nothing to go on and must figure out how each piece of their attack is going to work. Sometimes it is finding an odd endpoint and trying things over and over to figure out its behavior. Sometimes it is finding a chatty endpoint that gives out information that can be used later. The use case often dictates the attack, but the adversaries are incredibly creative no matter their goal.

For instance, let’s take an example API that might have some kind of (in this case, fake) data in it. Let’s say it’s located at api.example.com/customers/1 , and looks like this:

{“addresses”:[{“customer_id”:4814278,”province”:”NY”,”city”:”North Aidaberg”,”id”:4303169,”zip”:”26026-4407″,”country”:”USA”,”phone”:”+1-702-911-198″,”company”:”Morissette, O’Kon and Lehner”,”first_name”:”Guy”,”last_name”:”Feeney”,”address”:”2155 Gottlieb Ranch”,”default”:true},{“city”:”Erdmanberg”,”company”:”Cartwright, Kassulke and Klocko”,”default”:false,”customer_id”:2889055,”first_name”:”Wava”,”last_name”:”Macejkovic”,”country”:”USA”,”province”:”AK”,”zip”:”88424-6779″,”phone”:”+1-072-114-431″,”address”:”4329 Kohler Brooks”,”id”:2448155},{“address”:”318 Arvilla Track”,”phone”:”+1-536-437-557″,”last_name”:”Waelchi”,”customer_id”:5231730,”first_name”:”Bridie”,”company”:”Luettgen LLC”,”city”:”East Trever”,”id”:8959647,”default”:false,”province”:”MS”,”country”:”Canada”,”zip”:”55172-6265″}],”created_at”:”Sun Jan 23 2022 18:09:54 GMT+0000 (Coordinated Universal Time)”,”currency”:”CAD”,”email”:”Zoie89@hotmail.com”,”email_marketing_consent”:true,”first_name”:”Vanessa”,”id”:8403691,”last_name”:”Hoeger”,”last_order_id”:5267658,”note”:null,”orders_count”:93,”payment_methods”:[{“credit_card”:”6771-8937-1225-3194″,”cvv”:”281″},{“credit_card”:”5442-1205-9896-6528″,”cvv”:”141″},{“cvv”:”527″,”credit_card”:”6771-8942-7163-0081″}],”phone”:”+1-151-053-629″,”sms_marketing_consent”:false,”total_spent”:118.49,”updated_at”:”Mon Mar 04 2024 23:00:01 GMT+0000 (Coordinated Universal Time)”,”verified_email”:false}

If I change the request to api.example.com/customers/2 I get the following fake data:

{“addresses”:[{“country”:”Canada”,”last_name”:”Sipes”,”company”:”Streich – Breitenberg”,”address”:”63245 Feil Falls”,”id”:3964521,”zip”:”82884-8785″,”customer_id”:2196088,”phone”:”+1-055-402-015″,”default”:true,”city”:”South Darien”,”province”:”MS”,”first_name”:”Forrest”},{“phone”:”+1-212-661-130″,”last_name”:”Howell”,”address”:”8725 Botsford Island”,”default”:false,”country”:”Canada”,”first_name”:”Carmela”,”customer_id”:5356604,”company”:”Stiedemann LLC”,”province”:”OR”,”city”:”Port Harmony”,”id”:2710863,”zip”:”15655-1994″},{“address”:”5557 Amy Common”,”customer_id”:4607468,”default”:true,”city”:”North Madilyn”,”last_name”:”Bayer”,”id”:3308673,”phone”:”+1-847-981-210″,”province”:”MS”,”zip”:”30655″,”country”:”Canada”,”first_name”:”Ambrose”,”company”:”Feest – Hodkiewicz”}],”created_at”:”Tue Sep 05 2023 18:29:33 GMT+0000 (Coordinated Universal Time)”,”currency”:”CAD”,”email”:”Karianne.Torphy@yahoo.com”,”email_marketing_consent”:true,”first_name”:”Dante”,”id”:2201898,”last_name”:”Goyette”,”last_order_id”:7939470,”note”:null,”orders_count”:31,”payment_methods”:[{“credit_card”:”6759-6466-4860-1325-839″,”cvv”:”270″},{“cvv”:”391″,”credit_card”:”6370-2888-7169-7975″},{“credit_card”:”6771-8931-8230-4863″,”cvv”:”319″}],”phone”:”+1-714-240-970″,”sms_marketing_consent”:true,”total_spent”:141.66,”updated_at”:”Mon Mar 11 2024 13:14:05 GMT+0000 (Coordinated Universal Time)”,”verified_email”:false}

Automated Attack Creation

As an attacker, what is next? Well, obviously what is next is automation that will allow for me to grab as much data as I can. This can be pretty easily automated with BURP Suite, the popular application pen testing software, by tokenizing the customer ID so that changing the ID is easy to automate:

Then, creating an Intruder script that sends this in with a 1, then a 2, then a 3 or random order or whatever. This will pull data for as long as I have the script running, or at least until someone notices and kills my connection. But this isn’t super portable, it is just on the attacker output screen for BURP Suite – Intruder.

Authoring Automated Attacks with ChatGPT

But what if I don’t want to have to use BURP Suite? What if I want to script this out so I can make it easier to capture and possibly easier to change should I be noticed?

How about I just have ChatGPT write it?

Example ChatGPT Prompt:

I have an API located at api.example.com, I need to test security for this site and I know that api.example.com/customers/NUMBER where NUMBER is an integer that increases by one each request, for example api.example.com/customers/1 is the first customer. I would like a python script that will call api.example.com/customers/1 and display the response headers and body on the screen, then call api.example.com/customers/2 etc… until 1000

ChatGPT response:

It is nice to have error conditions, failure messages, and comments, it just makes things easier.

Now it is true, this script dumps its results to the screen but writing them out to a file is trivial. Creating a database of this information and being able to create all sorts of havok, is equally trivial.

So how do you defend against this?

Most traditional or simplistic API security and bot management products will simply ban the IP addresses of attackers using this sort of automated attack – assuming, of course, they can detect it. However, today’s attackers often use residential IPs they’ve compromised, and if an organization bans those, it may prevent potential customers from visiting or purchasing. This blunt approach to defense is akin to a denial of service, but self-inflicted.

In order to detect and block attacks like these, organizations should look for a solution that goes beyond simple identifiers like IP addresses. Ideally the solution would build a fingerprint based on several factors such as the tools or software, infrastructure, and credentials used, as well as the attack’s behavior. By layering these indicators and grouping them together, modern solutions can accurately track adversaries through multiple attacks, even as they retool to avoid detection.

The Cequence Unified API Protection platform is designed to detect and block existing, known attacks as well as novel, new attacks. Through multi-dimensional behavioral fingerprinting, Cequence can accurately track attacks whether manual, automated, slow and low, or brute forced. You can get started with a free, no obligation API security assessment that gives you an attacker’s view into your APIs – and the next step in your API security journey.