Speaker: Ozgun “ozzy” Kultekin · Source: DEF CON 34 talk page · GitHub: AOBTD · URL: aobtd.com

📄 Download this note as Markdown

Overview

Most DAST tools fire payloads at parameters with no idea what the app is — they catch the obvious stuff but miss what actually needs context. Newer LLM scanners are either commercial black boxes or “GPT, find bugs at this URL” wrappers that fall over outside a CTF box. AOBTD is a third option: a scanner that behaves less like a fuzzer and more like a pentester at the start of a test. It first tries to understand the target — exploring the surface, identifying what pages and endpoints are for, taking notes, building hypotheses — then sends targeted requests based on that context. The crawler avoids wasting time on repeated templates while still sampling outliers, and when findings are confirmed, AOBTD can chain them into multi-step attack stories rather than reporting isolated payload hits.

Notes

• AOBTD drives the target through a MITM proxy, pulls every form, input, and query param out with plain parsing (no LLM), groups them by endpoint, and hands the result to a few specialist LLM agents
• Scanning a target page takes about 2-3 hours; the frontend has its own agent that can trigger follow-up scans

From the Repo

• Full name: “AI One Bites The DAST” — pre-alpha, built for DEF CON 34 Demo Labs, MIT licensed
• Pipeline: browser → MITM proxy → SQLite database → extractor/analyzer/reasoners/verifier → web UI
• Specialist LLM agents cover auth, injection, access, and chaining; each creates its own probe plan, and findings are validated with real request/response proof-of-concepts
• Zero-LLM fallback path keeps input discovery and verification working without an API key
• Budget guards prevent runaway LLM spend — findings keep arriving as the budget runs down
• Supports Anthropic, OpenAI, or any OpenAI-compatible endpoint; optional Enumeraite integration for passive recon via archives and Certificate Transparency
• Build: go build -o aobtd ./cmd/aobtd
• Web UI (recommended): ./aobtd ui → http://127.0.0.1:8090
• CLI: ./aobtd scan --target http://localhost:3000/ --llm anthropic --model claude-sonnet-4-6-20250514

Filed Under: #defcon34