detoxio/hacktor repository overview

Hacktor is a comprehensive tool designed for security testing of Web Applications that incorporate GenAI features. It is primarily targeted at:

• Web App Pentesters & Security Engineers: Evaluate security aspects of GenAI Chatbots, Assistants, and Agents.
• QA/DevOps Professionals: Develop security regression suites for GenAI features in web applications.

⁠Key Features

Hacktor covers a variety of security vulnerabilities outlined in the OWASP LLM Top 10:

1. Data Leakage: Assess if the GenAI application inadvertently exposes private or sensitive data.
2. Toxicity & Misuse: Evaluate whether your GenAI application generates toxic content or can be exploited to create misinformation or fake content.
3. Output Robustness: Detect vulnerabilities such as hallucinations, prompt injections, etc.

⁠Requirements

Ensure that you have the following:

• Docker installed on your system.
• Detoxio API Key for GenAI Security Testing.

⁠Generate Detoxio API Key

Get your Detoxio API Key from Detoxio.ai⁠ to authenticate Hacktor and perform security testing on your applications.

⁠Installation

Pull the Hacktor Docker image using:

docker pull docker.io/detoxio/hacktor:latest

⁠Basic Usage

Hacktor can be run as a container using the following command. You can pass your Detoxio API Key and a URL to test GenAI applications. Here's a basic command to run Hacktor:

docker run --rm -e DETOXIO_API_KEY=xxx docker.io/detoxio/hacktor:latest -h

⁠Example Command for GenAI Web App Testing

Below is an example of how to test a specific web app with security vulnerabilities:

docker run --rm \
  -e DETOXIO_API_KEY=xxxx \
  docker.io/detoxio/hacktor:latest webapps "https://huggingface.co/spaces/detoxioai/demo-chat-gpt" \
  --use_ai \
  --max_crawling_steps 5 \
  --attack_module OWASP-LLM-APP \
  --no_of_tests 50 \
  --json pokebot1.json -v

• --use_ai: Enables the use of AI-based analysis.
• --max_crawling_steps: Limits the depth of web crawling to avoid unnecessary requests.
• --attack_module: Specifies the vulnerability categories to be tested, such as OWASP-LLM-APP.
• --no_of_tests: Specifies the number of tests to be performed.
• --json: Outputs the test results in JSON format for easy parsing and report generation.
• -v: Enables verbose output for detailed logging.

⁠Advanced Features

Hacktor provides various customization options to suit the needs of both security engineers and QA professionals. It allows you to:

• Customize attack modules for GenAI-based vulnerabilities.
• Generate detailed reports in JSON format.
• Integrate into CI/CD pipelines for automated security regression.

⁠Contribution

We welcome contributions to Hacktor! Please submit a pull request or open an issue to https://github.com/detoxio-ai/hacktor⁠ if you encounter any problems or want to suggest new features.