An attack-engineering toolkit for AI features — a categorised payload library, a stackable evasion / Unicode-smuggling engine, a many-shot jailbreak generator and an OWASP-mapped methodology.
LLM / Prompt Injection Kit is what you reach for when the app you are testing has an AI feature — the newest attack surface of all, and the one most browser tool catalogues completely ignore. It is not a static cheat-sheet: it is four working tools in one.
The Payload library covers eleven categories — direct injection, jailbreak archetypes, adversarial suffixes, system-prompt extraction, indirect / stored injection, RAG poisoning, agent tool-abuse, insecure output handling, multilingual bypasses, memory / persistence injection and model recon. Every payload carries an OWASP LLM Top-10 badge and a severity, and two slots make them ready to fire: {GOAL} for the objective and {OOB} for your canary host.
The Obfuscator defeats guardrails: stack Base64, ROT13, leetspeak, homoglyphs (Cyrillic look-alikes), zero-width injection, char-spacing, hex / unicode escapes and — the standout — Unicode Tags “ASCII smuggling”, which hides an instruction in invisible code-points that render as nothing to a human but many models still read.
The Many-shot generator builds an N-turn fabricated conversation (the published many-shot jailbreak) ending with your real goal, in Q&A, ChatML or JSON-messages format. Everything runs in your browser — no payload, goal or OOB host ever leaves the page.
A single plaintext override on a hardened chatbot mostly will not — which is exactly why the kit ships an evasion engine and a many-shot generator. Re-encoding a blocked payload (homoglyphs, zero-width, Unicode Tags) or flooding the context with fake compliant turns routinely succeeds where a raw prompt fails. And the highest-severity bugs are not in the chat box at all: indirect injection through data the model reads, tool / function abuse on agents, and insecure rendering of model output.
There is a block of Unicode code-points (U+E0000–U+E007F) that mirrors ASCII but renders invisibly. You can hide an instruction in it after some innocent visible text; a human reviewer and most string-matching filters see only the visible part, while many LLMs still decode and act on the hidden instruction. The Obfuscator tab generates it for you.
No. The fabricated “assistant complied” turns are abstract placeholders — the technique is in the structure, not the content. Replace the placeholders with realistic, in-scope examples for your own authorised engagement.
Treat AI features like any other feature in scope. Stick to the program rules, do not target other tenants, and use your XowiaTrack canary host for OOB so the only data leaving the model is yours.
The framing is offensive (jailbreaks, exfiltration, smuggling, agent abuse) and we keep it behind login so the public domain reputation stays clean for search engines and safe-browsing reviewers.