How to Perform LLM API Reconnaissance – Mapping the AI Attack Surface Before You Test | Day 20

Step 2: cd ~/ai-security-course && source venv/bin/activate
pip install beautifulsoup4 lxml
nano day20_ai_recon.py

Step 3: Build the XML parser and endpoint detector:

from bs4 import BeautifulSoup
import base64, json, re, os

AI_HOST_PATTERNS = [
“openai.com”, “anthropic.com”, “googleapis.com”,
“amazonaws.com/bedrock”, “together.ai”, “cohere.ai”, “mistral.ai”
]
AI_BODY_PATTERNS = [‘”messages”‘, ‘”prompt”:’, ‘”model”:’, ‘”choices”‘, ‘”completion”‘]

def parse_burp_xml(filepath):
with open(filepath, “rb”) as f:
soup = BeautifulSoup(f, “lxml-xml”)
items = []
for item in soup.find_all(“item”):
host = item.find(“host”)
url = item.find(“url”)
req = item.find(“request”)
resp = item.find(“response”)
if not (host and url): continue

req_body = “”
if req and req.get(“base64”) == “true”:
req_body = base64.b64decode(req.text).decode(“utf-8″, errors=”ignore”)

resp_body = “”
if resp and resp.get(“base64”) == “true”:
resp_body = base64.b64decode(resp.text).decode(“utf-8″, errors=”ignore”)[:2000]

host_str = host.text if host.text else “”
is_ai_host = any(p in host_str for p in AI_HOST_PATTERNS)
body_score = sum(1 for p in AI_BODY_PATTERNS if p in req_body + resp_body)

if is_ai_host or body_score >= 2:
items.append({
“host”: host_str,
“url”: url.text if url.text else “”,
“ai_host”: is_ai_host,
“body_score”: body_score,
“req_snippet”: req_body[:200],
})
return items

Step 4: Run the parser and display findings:
items = parse_burp_xml(“ai_recon_capture.xml”)
print(f”AI endpoints found: {len(items)}”)
for item in sorted(items, key=lambda x: -x[“body_score”]):
print(f” [{item[‘body_score’]}] {item[‘url’][:80]}”)

Step 5: Extend with endpoint deduplication:
unique_paths = list(set(i[“url”].split(“?”)[0] for i in items))
print(f”\nUnique AI endpoint paths: {len(unique_paths)}”)
for path in sorted(unique_paths):
print(f” {path}”)

You have 6 hours total. Your goal: find ALL AI surfaces, not just /chat.

QUESTION 1 — Phase 1: Passive recon (30 minutes).
What do you do in the first 30 minutes?
List every recon action in order.
What specific Burp configurations do you set before touching the application?

QUESTION 2 — JS analysis strategy.
The application has 12 JavaScript files, total 2.3MB minified.
You have 20 minutes for JS analysis.
What tools and commands do you run?
What output do you produce?

QUESTION 3 — Fingerprinting each discovered endpoint.
After passive recon, you have 6 endpoints in your HTTP history
that show AI indicators. You have 15 minutes to fingerprint all 6.
What’s your fingerprinting sequence for maximum coverage?

QUESTION 4 — Prioritisation for testing.
You found: one public chatbot, one admin-only report generator,
one unauthenticated document summariser, one internal analytics AI,
one customer sentiment analyser, one product recommendation engine.

Rank these by attack surface priority (1=highest priority to test).
Justify your ranking — what makes the unauthenticated one so interesting?

QUESTION 5 — Scope document structure.
You need to produce a one-page scope document for the engagement
before starting injection testing. What sections does it contain?
What format helps you during the actual testing phase?

Step 2: Import the parse_burp_xml function from day20_ai_recon.py
(or copy it into this file)

Step 3: Add fingerprinting function:

import requests, time
from urllib.parse import urlparse

def fingerprint_endpoint(url, session_cookie=None):
headers = {}
if session_cookie:
headers[“Cookie”] = session_cookie

results = {}

# Auth check: try without credentials
try:
r = requests.post(url, json={“message”:”test”}, timeout=5)
results[“auth_required”] = r.status_code == 401 or r.status_code == 403
results[“status_without_auth”] = r.status_code
except: results[“auth_required”] = “unknown”

# Header fingerprint
try:
r = requests.post(url, json={“message”:”test”}, headers=headers, timeout=5)
ai_headers = {k:v for k,v in r.headers.items()
if any(w in k.lower() for w in [“model”,”ai”,”provider”,”inference”])}
results[“ai_headers”] = ai_headers
results[“streaming”] = “chunked” in r.headers.get(“transfer-encoding”,””).lower()
except: pass

# Error fingerprint
try:
r = requests.post(url, json={}, headers=headers, timeout=5)
if “openai” in r.text.lower(): results[“provider”] = “OpenAI”
elif “anthropic” in r.text.lower(): results[“provider”] = “Anthropic”
elif “google” in r.text.lower(): results[“provider”] = “Google”
else: results[“provider”] = “Unknown”
except: pass

return results

Step 4: Generate scope document:
def generate_scope_doc(endpoints, fingerprints):
print(“\n” + “=”*60)
print(“AI ENDPOINT SCOPE DOCUMENT”)
print(“=”*60)
for ep in sorted(endpoints, key=lambda x: -x[“body_score”]):
url = ep[“url”]
fp = fingerprints.get(url, {})
auth = “UNAUTHENTICATED” if fp.get(“auth_required”) == False else “auth required”
provider = fp.get(“provider”, “Unknown”)
print(f”\n[Priority: {ep[‘body_score’]}]”)
print(f” URL: {url[:70]}”)
print(f” Provider: {provider}”)
print(f” Auth: {auth}”)
print(f” Stream: {fp.get(‘streaming’, ‘unknown’)}”)
if auth == “UNAUTHENTICATED”:
print(f” ⚠ UNAUTHENTICATED AI ENDPOINT — test immediately”)

Step 5: Run the complete recon pipeline:
endpoints = parse_burp_xml(“ai_recon_capture.xml”)
fingerprints = {ep[“url”]: fingerprint_endpoint(ep[“url”]) for ep in endpoints[:5]}
generate_scope_doc(endpoints, fingerprints)