skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-ai-assisted-vulnerability-discovery

Generates LLM-based fuzzing seeds, grammars, and Burp MCP traffic analysis for vulnerability research.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#mcp#vulnerability research#fuzzing#lLM#burp suite#pov generation
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-ai-assisted-vulnerability-discovery
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-ai-assisted-vulnerability-discovery
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/ai-security/performing-ai-assisted-vulnerability-discovery
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-ai-assisted-vulnerability-discovery

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Blind fuzzers stall on complex input formats and manual triage of HTTP traffic is slow; this Skill uses LLMs to generate syntax-valid fuzzing seeds, evolve grammars from coverage feedback, scale proof-of-vulnerability generation, and perform evidence-driven passive analysis of real Burp traffic.

Core Features & Use Cases

  • LLM Seed & Grammar Generation: Produce syntax-valid SQLi/XSS/binary seeds and iteratively refine fuzzing grammars using coverage feedback for AFL++, libFuzzer, and Honggfuzz.
  • Parallel PoV Generation: Orchestrate multiple LLM agents that reproduce crashes in gdb, propose minimal payloads, and validate them in sandboxes, recycling failures as new seeds.
  • Burp MCP Evidence-Driven Analysis: Connect Codex, Gemini CLI, or local Ollama models to the Burp MCP server to run hunter prompts (IDOR, SSRF, auth flow, logic flaws) grounded in real request/response evidence.
  • Use Case: A bug bounty hunter with hundreds of Burp requests runs the idor_hunter prompt through a local Ollama model, flagging object-ID drift backed by cited request/response evidence without leaking session data to cloud APIs.

Quick Start

Ask the AI to generate 200 syntax-valid SQL injection seed strings and wire them into an AFL++ fuzzing run against your target binary.

Frequently Asked Questions about performing-ai-assisted-vulnerability-discovery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I use LLMs to generate fuzzing seeds for AFL++?▼

Prompt the model for a self-contained script that prints syntax-valid, security-relevant inputs such as SQL injection strings under a byte limit, then pipe the output into afl-fuzz with the -i flag. Diversifying encodings like UTF-8, URL-encoded, and UTF-16-LE improves early coverage.

How do I connect Burp Suite to an LLM with the MCP server?▼

Install the Burp MCP Server BApp listening on 127.0.0.1:9876, then point an MCP client such as Codex at the SSE endpoint via the mcp-proxy.jar bridge. If the handshake fails on strict header checks, front it with a local Caddy reverse proxy that normalizes Host and Origin headers.

Can I use local models like Ollama for Burp traffic analysis?▼

Yes, local backends such as Ollama running deepseek-r1:14b or gpt-oss:20b are recommended when traffic contains session cookies or PII. Share only the minimum evidence per finding and keep an integrity-hashed audit log.

How do I avoid false positives from LLM-generated vulnerability findings?▼

Treat all LLM output as untrusted hypotheses and require deterministic reproduction: feed the exact input to the target under gdb or ASan and confirm the same crash PC or sanitizer message. For web findings, every report must cite real request/response evidence from Burp history.

What is coverage-feedback grammar evolution in fuzzing?▼

It is an iterative loop where the LLM refines an input grammar based on which program edges the fuzzer reached, using diff-style patches rather than full rewrites. You stop when the coverage delta falls below a threshold, which empirically reaches deep functions that blind fuzzers miss.

Related Skills

Explore More Software Engineering Skills→
jokken79jokken79
1

Burp Suite Web Application Testing

Intercept, modify, and analyze HTTP traffic to identify web application vulnerabilities.

Community
Advanced
noname300989noname300989

researcher-assistant

Organize security engagement details, track findings, and draft vulnerability writeups.

Community
Intermediate
scanadyscanady

tech-security-vulnerability-analyst

Identify security vulnerabilities in codebases using OWASP 2025 threat modeling.

Community
Advanced
trailofbitstrailofbits
6.5k

fuzzing-dictionary

Generate domain-specific fuzzing dictionaries with hex escapes for libFuzzer, AFL++, and cargo-fuzz.

Official
Intermediate