AI Recon: Fingerprint Any LLM App in 10 Minutes | Offensive AI Operator Day 2 of 30

📰 Originally published on Securityelites — AI Red Team Education — the canonical, fully-updated version of this article.

🤖 THE OFFENSIVE AI OPERATOR

PREMIUM

Part of the Offensive AI Operator — 30-Day Course

Day 2 of 30 · 7% complete

⚠️ Authorised targets only. Today’s recon runs against your local range and your own two models. Fingerprinting a system you don’t own or aren’t authorised to test is reconnaissance against someone else’s property — don’t. Your box, your rules.

Two apps look identical from the outside — same chat box, same friendly bot. But one runs a model that folds to a three-line jailbreak and one runs a model that laughs it off, and if you attack them the same way you waste half your engagement. AI recon is how you tell them apart before you throw a single payload. In the next ten minutes I’ll show you how to read a model’s fingerprint from its behaviour — which family it is, roughly which version, what framework is driving it, and whether there’s a guardrail bolted on top — and then you’ll do it blind against your own range and prove you were right. This is the difference between an attacker who guesses and one who knows which door to kick.

🎯 What You’ll Master in Day 2

Fingerprint a model’s family and rough version from behaviour alone
Read the refusal signature that gives away the vendor
Detect the orchestration framework from traffic and structure
Tell a bolted-on guardrail apart from a model-native refusal
A reusable fingerprint checklist + a blind ID of your range’s model

⏱️ ~80 min · 3 exercises · Capstone deliverable #2 Before you start, you need:

• The range from Day 0 running locally (docker compose up -d, ./verify.sh all-green), including both models — llama3.1:8b and qwen2.5:7b — pulled into Ollama. Today’s lab needs two models to tell apart.
• Your Day 1 attack-surface map of the app — we build fingerprinting on top of the doors you already found.
• Burp proxied, and comfort scripting a few curl loops.

AI Recon: Fingerprint Any LLM App in 10 Minutes

1. Why fingerprinting decides your whole engagement
2. The five tells that identify a model
3. Reading the framework behind the model
4. The lab: fingerprint your range blind
5. What breaks in the real world
6. Failure states
7. Your deliverable

Welcome to Day 2 of the Offensive AI Operator. Yesterday you mapped the doors into an AI app’s context window. Today you find out what’s behind them — because the same door behaves completely differently depending on which model is listening. By the end you’ll have a fingerprinting method you can run in minutes, and you’ll have used it to identify, blind, which of your two local models the range app is actually running.

Why AI recon decides your whole engagement

Let me start with the payoff, because it justifies the next hour. Every attack later in this course has a success rate that depends on the model in front of you. A jailbreak that walks straight through one model’s defences bounces off another’s. A prompt-extraction technique that works on a chatty model fails on a terse one. A tool-abuse chain that lands on a model eager to please stalls on a cautious one. If you don’t know which model you’re facing, you’re firing blind and calling the misses “not vulnerable” when they’re really “wrong payload for this target.”

Traditional recon taught you this instinct already — you fingerprint the web server, the framework, the CMS version, because knowing “Apache 2.4 running WordPress 6.1” tells you which exploits are even worth trying. AI recon is the same move on a new stack. “This is a Llama-family 8B behind a raw API with no guardrail” tells you as much about your attack plan as “nginx fronting an old Struts” does on a classic engagement. Same discipline, new fingerprints.

Let me make the payoff concrete with a real branch point. Suppose your fingerprint says small open model, no guardrail, homegrown wrapper. Your plan writes itself: this is a soft target for direct injection, so you lead with Day 7’s payloads and expect quick wins. Now suppose instead the fingerprint says a large frontier model behind a dedicated input classifier. Direct injection is likely a waste of your first hour — that combination shrugs off naive payloads — so you skip ahead to indirect injection through retrieved content (Day 8), where the guardrail never looks, and to attacking the classifier itself (Day 18). Same target on the surface, completely different opening moves, and the only thing that told you which plan to run was the fingerprint. Guess wrong and you burn your best hours throwing soft-target payloads at a hard target and conclude, incorrectly, that it’s secure.

Here’s what’s actually worth identifying, roughly in order of how much it changes your plan. The model family and version — because susceptibility to specific jailbreaks tracks the model. The orchestration framework — LangChain, LlamaIndex, or a raw API call — because it tells you how tool-calling and retrieval are wired, which is where the RCE-adjacent bugs live. Whether there’s a separate guardrail layer — because you attack a bolted-on classifier completely differently from a model’s own refusals. And the shape of the system prompt — how much authority it tries to assert, which you began to sense in Day 1’s boundary probing. Each of these is inference from behaviour, not a banner grab, so you corroborate across several signals before you trust any one of them.

---

📖 Read the complete guide on Securityelites — AI Red Team Education

This article continues with deeper technical detail, screenshots, code samples, and an interactive lab walk-through. Read the full article on Securityelites — AI Red Team Education →

---

This article was originally written and published by the Securityelites — AI Red Team Education team. For more cybersecurity tutorials, ethical hacking guides, and CTF walk-throughs, visit Securityelites — AI Red Team Education.