Ishan Nim — Offensive Security — Field notesField notes from Ishan Nim on offensive security, AI security, red teaming, exploit research and dark web monitoring.https://ishan-nim.infoen-usd4rknim@gmail.com (Ishan Nim)d4rknim@gmail.com (Ishan Nim)Copyright 2026 Ishan NimTired of proxies? Try AI-Intruderhttps://ishan-nim.info/blog/ai-intruderhttps://ishan-nim.info/blog/ai-intruderI moved the proxy into the browser and gave it an analyst that never gets bored. A short hunt for reflected XSS and SQL injection, without leaving the tab.Tue, 16 Jun 2026 00:00:00 GMTWeb Securitybrowser extensionreflected XSSSQL injectionpassive scanningLLM triaged4rknim@gmail.comBefore you ship an internal AI, read thishttps://ishan-nim.info/blog/why-ai-security-mattershttps://ishan-nim.info/blog/why-ai-security-mattersA model trained on your own data will answer questions about your own data — including the ones you did not intend. The risks in enterprise AI, and how to test for them.Tue, 04 Mar 2025 00:00:00 GMTAI SecurityLLM penetration testingprompt injectionOWASPdata leakageenterprise AId4rknim@gmail.comA six-step application security roadmaphttps://ishan-nim.info/blog/appsec-roadmaphttps://ishan-nim.info/blog/appsec-roadmapSecurity does not arrive at 100% in one go. Six stages, from laying the foundations at 30% coverage through to zero trust and continuous operation.Sat, 08 Feb 2025 00:00:00 GMTAppSecapplication securityzero trustcloud securitypenetration testingthreat modellingd4rknim@gmail.comA practical guide to dark web monitoringhttps://ishan-nim.info/blog/dark-web-monitoringhttps://ishan-nim.info/blog/dark-web-monitoringLeaked credentials are sold somewhere before they are used against you. Why individuals and companies should be watching, and how to actually go about it.Sat, 08 Feb 2025 00:00:00 GMTDark Webdark webdata breachcredential leakOSINTthreat intelligenced4rknim@gmail.comWorking through the OWASP Top 10 for LLM Applicationshttps://ishan-nim.info/blog/owasp-llm-top-10https://ishan-nim.info/blog/owasp-llm-top-10OWASP's report organises the vulnerabilities specific to LLM applications into ten items. How each one actually shows up in a real application, and what to fix first.Fri, 11 Oct 2024 00:00:00 GMTAI SecurityOWASPLLMprompt injectionsupply chainexcessive agencyd4rknim@gmail.comPrompt injection — talking a model out of its own ruleshttps://ishan-nim.info/blog/prompt-injectionhttps://ishan-nim.info/blog/prompt-injectionEver been talked into doing all the chores by a sibling? That is prompt injection, and it is currently one of the hardest problems in applied AI security.Fri, 11 Oct 2024 00:00:00 GMTAI Securityprompt injectionLLMsystem promptGandalfAI securityd4rknim@gmail.comHow large language models actually workhttps://ishan-nim.info/blog/how-llms-workhttps://ishan-nim.info/blog/how-llms-workPre-training, fine-tuning, transformers and self-attention. Understanding the mechanism is what lets you judge where a model breaks and where the risk sits.Sat, 28 Sep 2024 00:00:00 GMTAI SecurityLLMtransformergenerative AIself-attentionmodel biasd4rknim@gmail.comCybersecurity awareness in Japan — the gap nobody is closinghttps://ishan-nim.info/blog/japan-cybersecurity-awarenesshttps://ishan-nim.info/blog/japan-cybersecurity-awarenessJapanese companies are digitising fast, and security is the part that keeps getting left behind. Why the knowledge gap exists, and where to start closing it.Mon, 23 Sep 2024 00:00:00 GMTJapanJapandigital transformationpenetration testingred teamingCIA triadd4rknim@gmail.comSeven ways to protect WordPress from SQL injectionhttps://ishan-nim.info/blog/wordpress-sql-injectionhttps://ishan-nim.info/blog/wordpress-sql-injectionSQL injection is one of the most damaging attacks a WordPress site faces. The measures that actually work, in order of how much they matter.Sun, 15 Sep 2024 00:00:00 GMTWeb SecurityWordPressSQL injectionWAFprepared statementsleast privileged4rknim@gmail.com