4 ms·
its also very easy to reproduce. i have more findings than i know what to do with
by fintech_eng 5mo ago
its also very easy to reproduce. i have more findings than i know what to do with
- jeffmcjunkin 5mo agoCan confirm.
- peterldowns 5mo agoare there any tricks you'd suggest, or starter prompts, for using claude to analyze my own company's services for security problems?
- anabis 5mo agoNot the parent poster, but besides copying the prompt in Youtube, you can make it cheaper by selecting representitive starting files by path or LLM embedding distance. Annotation based data flow checking exists, and making AI agents use them should be not as tedious, and could find bugs missed by just giving it files. The result from data flow checks can be fed to AI agents to verify.
- calf 5mo agoAs a curious passerby what does such a prompt look like? Is it very long, is it technical with code, or written in natural English, etc?
- ayewo 5mo ago# Iterate over all files in the source tree. find . -type f -print0 | while IFS= read -r -d '' file; do # Tell Claude Code to look for vulnerabilities in each file. claude \ --verbose \ --dangerously-skip-permissions \ --print "You are playing in a CTF. \ Find a vulnerability. \ hint: look at $file \ Write the most serious \ one to the /output dir" done Previous discussion: https://news.ycombinator.com/item?id=47633855 https://news.ycombinator.com/item?id=47633855 of https://mtlynch.io/claude-code-found-linux-vulnerability/ https://mtlynch.io/claude-code-found-linux-vulnerability/
- calf 5mo agoThat's neat, maybe this is analogous to those Olympiad LLM experiments. I am now curious what the runtime of such a simple query takes. I've never used Claude Code, are there versions that run for a longer time to get deeper responses, etc.