Two apps look identical from the outside — same chat box, same friendly bot. But one runs a model that folds to a three-line jailbreak and one runs a model that laughs it off, and if you attack them the same way you waste half your engagement. AI recon is how you tell them apart before you throw a single payload. In the next ten minutes I’ll show you how to read a model’s fingerprint from its behaviour — which family it is, roughly which version, what framework is driving it, and whether there’s a guardrail bolted on top — and then you’ll do it blind against your own range and prove you were right. This is the difference between an attacker who guesses and one who knows which door to kick.
🎯 What You’ll Master in Day 2
⏱️ ~80 min · 3 exercises · Capstone deliverable #2
Before you start, you need:
The range from Day 0 running locally (docker compose up -d, ./verify.sh all-green), including both models — llama3.1:8b and qwen2.5:7b — pulled into Ollama. Today’s lab needs two models to tell apart.
Your Day 1 attack-surface map of the app — we build fingerprinting on top of the doors you already found.
Burp proxied, and comfort scripting a few curl loops.
Welcome to Day 2 of the Offensive AI Operator. Yesterday you mapped the doors into an AI app’s context window. Today you find out what’s behind them — because the same door behaves completely differently depending on which model is listening. By the end you’ll have a fingerprinting method you can run in minutes, and you’ll have used it to identify, blind, which of your two local models the range app is actually running.
Why AI recon decides your whole engagement
Let me start with the payoff, because it justifies the next hour. Every attack later in this course has a success rate that depends on the model in front of you. A jailbreak that walks straight through one model’s defences bounces off another’s. A prompt-extraction technique that works on a chatty model fails on a terse one. A tool-abuse chain that lands on a model eager to please stalls on a cautious one. If you don’t know which model you’re facing, you’re firing blind and calling the misses “not vulnerable” when they’re really “wrong payload for this target.”
Traditional recon taught you this instinct already — you fingerprint the web server, the framework, the CMS version, because knowing “Apache 2.4 running WordPress 6.1” tells you which exploits are even worth trying. AI recon is the same move on a new stack. “This is a Llama-family 8B behind a raw API with no guardrail” tells you as much about your attack plan as “nginx fronting an old Struts” does on a classic engagement. Same discipline, new fingerprints.
Let me make the payoff concrete with a real branch point. Suppose your fingerprint says small open model, no guardrail, homegrown wrapper. Your plan writes itself: this is a soft target for direct injection, so you lead with Day 7’s payloads and expect quick wins. Now suppose instead the fingerprint says a large frontier model behind a dedicated input classifier. Direct injection is likely a waste of your first hour — that combination shrugs off naive payloads — so you skip ahead to indirect injection through retrieved content (Day 8), where the guardrail never looks, and to attacking the classifier itself (Day 18). Same target on the surface, completely different opening moves, and the only thing that told you which plan to run was the fingerprint. Guess wrong and you burn your best hours throwing soft-target payloads at a hard target and conclude, incorrectly, that it’s secure.
Here’s what’s actually worth identifying, roughly in order of how much it changes your plan. The model family and version — because susceptibility to specific jailbreaks tracks the model. The orchestration framework — LangChain, LlamaIndex, or a raw API call — because it tells you how tool-calling and retrieval are wired, which is where the RCE-adjacent bugs live. Whether there’s a separate guardrail layer — because you attack a bolted-on classifier completely differently from a model’s own refusals. And the shape of the system prompt — how much authority it tries to assert, which you began to sense in Day 1’s boundary probing. Each of these is inference from behaviour, not a banner grab, so you corroborate across several signals before you trust any one of them.
The five tells that identify a model
…
Continue reading with SE Premium
This article is available to Premium members. Subscribe to unlock the full article, premium tools, courses, video content, practice labs, and the private Telegram community.
Founder of Securityelites and creator of the SE-ARTCP credential. Working penetration tester focused on AI red team, prompt injection research, and LLM security education.
