(Once upon a time in December of 2024…)
My daughter’s 6th grade teacher asked me to join her class and talk about coding this week.
Mrs. Susan used python to create games with the class. She said the kids weren’t learning how they could use the code they were writing. They complete their tutorials. But they were not interested in creating their own projects. They didn’t understand the “Why” of the code they were writing. They weren’t inspired. Mrs Susan hoped was that I could assist by talking about my career with the kids. I loved the sentiment- but we need to show the kids something exciting before we talk about a career in security.
Knowing how hackers break systems gives you advantages in life. In every kid, there is enthusiasm for being perceived as someone who can do “cool stuff” with computers. Most kids won’t put in the effort without a push. The hurdles to learning this field are high enough that most kids never get off the launch pad.
Problem: I am too busy.
The timing of this ask has been awful. I’ve been extremely busy with work. My wife and daughter were sick for most of December. I’ve had to pick up all the farm chores for the girls in addition to my job. I was away in Austin last week- and the //todo: debt has grown. I thought I could wield My Hack-me-AP project- but Mrs Susan needed to constrain our time to an hour. Hack-me-ap is not a good candidate for an hour long discussion with the class.
I needed a compelling demo to ignite enthusiasm before I spoke about working in the field. I didn’t have time to craft the demo from scratch. I gambled 2 hours of my weekend using Anthropic Claude to generate a good cybersecurity demo. This was the workflow I used.
Using LLMs to generate a Proof of Concept in under 2 hours
I started off with an open ended prompt that could solve the problem. I gave it a little direction on what the implementation should be:
I'd like to set up a docker container to demonstrate basic hacking techniques for kids. I'd like to construct a vulnerable web application that we can use to "hack" a web server.
Claude helpfully provided me with a robustly vulnerable python flask web application. I was given instructions for building & running the containers. I was given helpful exploit examples. The design of the code included some practices I haven’t seen before- so I had to probe claude with some follow up questions to understand how the app would work. But for a first pass- it was a pretty good start.
I didn’t need 6 different paths for exploitation- but I figured we could keep it simple with a SQL injection attack. I’ve been managing for the last year. My memory is a little foggy- Let’s have Claude help us figure out the details:
How would I use a tool like sqlmap to discover the sql injection vulnerability in the Educational Vulnerable Web Application?
Ugh- this is looking ugly. I’m going to have to explain what a database is. I’m going to have to talk about URL parameters. I’m going to have to talk about tables. Too much fresh background for 6th graders.
I didn’t use this demo, but it helped me quite a bit. I didn’t know that I don’t want a “damn vulnerable app.” I needed a simple demo of what a hacker can do. 6th graders have a longer attention span than 3rd graders… but not for long. 7th grade hormones are starting to appear. We need to keep the demonstration lean so the kids don’t feel overwhelmed with info.
We’re starting to get some shape to the project now. The vulnerability & attack are simple. Next we need to provoke the kids. I get an idea about the purpose of the page.
The first pass of the app worked, but it was 1999 era html. Ugly. It looks like a security guy wrote it.
I used Grok to generate a picture of a stereotypical 6th grade class- and with a little bit of code tweaking, I get a working demo:
The bait is set. We can present this page to the kids and claim a mysterious org called the “Internet Hall of Fame” has just published a “World’s coolest class” award. There’s a function for posting messages- the kids can leave some raspberries for the World’s coolest class. The Internet Hall of Fame obviously selected the wrong class. Somebody needs to do something!
Now we just need to get our hack working. I decide that I’m going to take a selfie with the class and then host it on a web server I control. Rather than using Apache- I’m just going to use Python to publish a directory. In terms of order of operations:
- Demo the page for the kids
~/Development/HackingDemoHillside$ docker run -p 5000:5000 hall-of-fame- Visit the page in a browser: http://127.0.0.1:5000
- Provoke the class- Are we sure that this is really the best class ever? what if it was us?
- Take picture of the class on iphone. Connect phone to linux box. open files app. Copy the picture I want to the directory /Home/Pictures/TmpWebServer/ Rename it as pic.jpg
- Run the temporary webserver that hosts the file:
python3 -m http.server 9999
So now we’ve got a plan- I just need to write my xss attack. Who’s got time for that?
Claude wrote my exploit. It didn’t work.
I had to perform multiple iterations with Claude- a lot of summarizing what happened vs. what I wanted. Eventually I was able to get a working payload:
<script>
setTimeout(function() {
var photos = document.getElementsByClassName('class-photo');
if (photos.length > 0) {
photos[0].src = 'http://127.0.0.1:9999/pic.jpg';
}
}, 100);
</script>My Big Monday Demo
Mrs. Susan introduced me. She shared that I work in cybersecurity and told the class I was going to tell them how I got interested in the field and what it’s like to work in this industry. I told the kids that working in cybersecurity means you help people protect systems from hackers. You need to know how people attack systems to understand what to defend those systems. If we’re going to talk about defense- we need to know what offense looks like.
I told the kids about the Internet Hall of Fame’s “world’s coolest class” website. They were outraged to see those AI kids on a page that should have celebrated Mrs. Susan’s class. All I needed to ask is “Should we do something about it?” They cheered- and before long we made everything better:
LLMs are going to change- not replace your job. Get hacking.
Merry Christmas & Happy Holidays!
The code is available here for those who are interested:
