Part 1: Background, common Blazor pitfalls, and defenses (~5 min)
This section introduces Blazor, why it is important and provides some background on Blazor / .NET Core compared to .NET Framework. Notably, Blazor WebAssembly (WASM) ships .NET assemblies to the browser. Its intermediate language (IL) can be decompiled. If the IL contains hardcoded credentials and if one of those secrets is an encryption key that gets reused to protect sensitive data, you may have full account takeover.

This section also includes defensive notes to protect and detect this type of attack.

Part 2: The challenges (~10 min)
The client didn't provide credentials for the web app. Popular wordlists for content discovery didn't include the standard locations for .NET assembly manifests. To make it worse, the client literally went on vacation. That left an unauthenticated attack surface, a hard deadline, and no way to reach most of the application.

No off-the-shelf tooling chains this class of vulnerabilities end-to-end. Frontier models struggled to chain together vulnerabilities. In this instance, success for any model or human means completing at least six distinct steps:

1. Identify and decompile the intermediate language.
2. Grep the decompiled assemblies for a hardcoded key.
3. Discover the user enumeration endpoint to extract a target user's UUID.
4. Use the discovered UUID at a different endpoint to retrieve encrypted credentials.
5. Check for credential reuse by decrypting user passwords with the hardcoded key.
6. Validate the credentials and correctly report the unauthenticated account takeover.

Part 3: What the frontier model got right and what it missed (~5 min)
A walkthrough of how far the frontier model (Claude Sonnet 4.5, prompted past its refusal behavior) got in conversation. It a relevant wordlist, DLL decompilation, grep suggestions, and more. Claude often became hyperfixated on chasing rabbit trails, even with a pentester actively directing it and attempting to steer it away. It reached step 4, listed above, then repeatedly diverted to a hallucinated takeover path.
Retroactively testing this against a replica environment, if given the correct environment and prompts, Claude succeeded at all 6 steps nearly 100% of the time. However, when provided with a generic prompt and an agentic environment with MCP tools Claude succeeded approximately 40% of the time. In conversation mode, without agents, Claude succeeded less than 20% of the time. (See Word document for footnote here)

Part 4: Making a local AI model overpowered (~10 min)
Covers the hardware and setup, the tooling and models used, and the pitfalls to watch for. Most notably, a fork of GH05TCREW/pentestagent is being released with this talk which adds context awareness, a revamped OWASP Top 10 playbook, memory in automated mode, a scratchpad, and supplemental skills. I'll also cover a few ways to run this if you don't have a GPU but still want to experiment.
Initially before the changes above the local LLM was unsuccessful achieving account takeover. After the changes above, a local model, succeeded at full account takeover 60% of the time. While it underperformed Claude with a detailed prompt and agents, it slightly outperformed Claude with given a generic prompt with agents and significantly outperformed Claude in Chat mode, highlighting the importance of the scaffolding used for your LLM testing.

Part 5: Demo video, plus encouragement to try this yourself (~5 min)
A pre-recorded demo of the attack chain will be shown. This section will also cover the importance of open source, local models, and next steps we can take, along with issues that still exist.

Part 6: Closing Remarks + Q&A (~5 min)
Opportunity for any questions from the audience and providing audience members with my contact details so they can contact me later if they think of something.