标题： 自主渗透测试：使用大语言模型解决夺旗挑战 显示英文标题

标题： Autonomous Penetration Testing: Solving Capture-the-Flag Challenges with LLMs

摘要： 本研究评估了GPT-4o通过连接到OverTheWire的Bandit夺旗游戏，自主解决初级水平进攻性安全任务的能力。在25个与单命令SSH框架技术兼容的关卡中，GPT-4o在没有辅助的情况下解决了18个，另外两个在最少提示后解决，总体成功率为80%。该模型在涉及Linux文件系统导航、数据提取或解码以及简单网络的单步挑战中表现出色。该方法通常一次就能生成正确的命令，并且速度超过了人类。失败的情况涉及需要持久工作目录、复杂网络侦察、守护进程创建或与非标准外壳交互的多命令场景。这些限制突显了当前架构的不足，而不是缺乏通用漏洞利用知识。结果表明，大型语言模型（LLMs）可以自动化初学者渗透测试工作流程的很大一部分，可能会降低攻击者的技能门槛，并为使用LLMs作为快速侦察助手的防御者提供生产率提升。此外，未解决的任务揭示了安全设计环境中可能挫败简单LLM驱动攻击的具体领域，为未来的加固策略提供了信息。除了进攻性网络安全应用外，结果还表明将LLMs集成到网络安全教育中作为实践辅助的潜力。 显示英文摘要

摘要： This study evaluates the ability of GPT-4o to autonomously solve beginner-level offensive security tasks by connecting the model to OverTheWire's Bandit capture-the-flag game. Of the 25 levels that were technically compatible with a single-command SSH framework, GPT-4o solved 18 unaided and another two after minimal prompt hints for an overall 80% success rate. The model excelled at single-step challenges that involved Linux filesystem navigation, data extraction or decoding, and straightforward networking. The approach often produced the correct command in one shot and at a human-surpassing speed. Failures involved multi-command scenarios that required persistent working directories, complex network reconnaissance, daemon creation, or interaction with non-standard shells. These limitations highlight current architectural deficiencies rather than a lack of general exploit knowledge. The results demonstrate that large language models (LLMs) can automate a substantial portion of novice penetration-testing workflow, potentially lowering the expertise barrier for attackers and offering productivity gains for defenders who use LLMs as rapid reconnaissance aides. Further, the unsolved tasks reveal specific areas where secure-by-design environments might frustrate simple LLM-driven attacks, informing future hardening strategies. Beyond offensive cybersecurity applications, results suggest the potential to integrate LLMs into cybersecurity education as practice aids.