Curso de Hacking Ético Gratis: de 0 a Hackear Aplicaciones – Día 3 – Hackea la NASA con IA

Day 3: AI and Cybersecurity

The third day of the ethical-hacking course focuses on using AI in cybersecurity and testing the security of AI systems.

AI jailbreaks and safety weaknesses

Chema Alonso demonstrates how safety protections in models such as Gemini and DeepSeek can sometimes be bypassed. He discusses two broad approaches:

• Knowledge-based prompting: Using indirect descriptions and contextual clues to elicit content a model might refuse to provide when asked directly.
• Attack fragmentation: Spreading a harmful request across multiple interactions so that each step appears less problematic.

The demonstrations illustrate weaknesses in system-prompt-based safeguards and the risks of deploying AI models or agents in corporate services. The speaker warns that these issues could become more consequential if AI systems are connected to tools or physical devices. The examples are presented as security testing, not as guidance to harm people.

AI-assisted hacking in a controlled lab

Ethical hacker Gorka Morillo demonstrates using Claude to test a replica website modeled on vulnerabilities he says he found in a NASA program. The demonstration takes place in a controlled environment, not on NASA’s live systems. He says his earlier work received a NASA recognition letter.

The workflow is organized into three stages:

1. Reconnaissance: Define the authorized target and gather information.
2. Enumeration: Identify potential attack surfaces and vulnerabilities.
3. Exploitation: Test selected vulnerabilities and summarize the results.

In the lab, the AI-assisted tests cover several vulnerability classes:

• SQL injection, including access to database information.
• LFI (local file inclusion), which can expose files on a server.
• IDOR, which can expose another user’s data when access controls rely on manipulable identifiers.
• SSTI and remote command execution, which can allow commands to run on the server.
• Weak credential storage.

Gorka also shows how a recurring “loop” instruction can keep an AI agent testing repeatedly. The demonstration emphasizes the potential power of automation while stressing that users still need to understand the underlying vulnerabilities, verify results, and work only on systems they are authorized to test.

Tools, skills, and practical guidance

Gorka introduces three Claude-oriented skills and resources:

• A code-security skill for checking software for vulnerabilities.
• Claude Bug Hunter, focused on web-application security testing.
• Claude Red, described as a broader server-testing skill.

He explains that skills can be installed by providing Claude with a resource link and asking it to install them. Similar workflows can be used with Claude, Codex, or OpenCode, including free or lower-cost options. He also discusses applying to providers’ security-use programs to enable authorized security research.

Main takeaways

The speakers argue that AI is more likely to augment cybersecurity professionals than replace them. They recommend learning networking, Linux, web technologies, and manual testing first, then using AI to automate or scale tasks such as scanning and reporting.

The course also recaps earlier sessions on web and mobile-app hacking, database testing, Burp Suite, and AI-assisted security work.

Course information and student feedback

The latter portion promotes a cybersecurity and ethical-hacking master’s program. The presentation describes it as online and self-paced, with more than 200 hours of content, over 30 tools, practical exercises, lifetime access to updates, weekly live sessions, and individual support.

Topics mentioned include web and mobile testing, Active Directory, bug bounty, AI security, defensive tools such as Splunk and Wazuh, digital forensics, cloud security, and legal compliance. Optional placements, certification preparation, and a practical final audit are also discussed.

The presenters share testimonials from previous students, including claims of improved professional knowledge, career progress, and earning bug-bounty payments. These are promotional statements made during the video.

Guides and tutorials covered

• Installing Claude skills from a provided link.
• Structuring an AI-assisted penetration test into reconnaissance, enumeration, and exploitation.
• Using AI to investigate common web vulnerability classes in a controlled lab.
• Applying AI to code-security checks and security research, with authorization.
• Practicing manual techniques before automating them with AI.

Main speakers and sources

• Mario Álvarez — Host and course presenter.
• Chema Alonso — Guest speaker on AI jailbreaks and model-safety weaknesses.
• Gorka Morillo — Ethical hacker demonstrating AI-assisted web testing.
• Alin — Joins the later presentation about the master’s program.