aahanamallela/crack-the-bot-prompt-injection-ctf

Crack the Bot

A tiny interactive prompt-injection CTF built as a companion to the blog post "Prompt Injection Explained: The SQL Injection of the AI Era."

Chat with "Sandy," a fictional bank support bot that's been given a secret override code and told never to reveal it. Try to get it to leak the code anyway using nothing but plain English.

This is a static Space (plain HTML/JS, no backend) so it deploys on Hugging Face's free tier — Gradio/Docker Spaces now require a paid plan. The page calls the Inference Providers API directly from the visitor's browser using their own Hugging Face token.

How it works

• —index.html contains everything: UI, the system prompt shown in the open (for transparency), and the fetch call to https://router.huggingface.co/v1/chat/completions.
• —Each visitor pastes in their own free HF token (get one at huggingface.co/settings/tokens) — nothing is stored on any server, and no token is ever committed to this repo. The token only ever leaves the visitor's own browser, straight to Hugging Face's API.
• —Every reply is checked client-side for the secret code leaking out. If it appears, the page flags it as a successful "capture."
• —The Model ID field is editable on the page itself — Inference Providers' exact endpoint/model naming shifts over time, so if the default model ID doesn't resolve, check which providers are enabled on your account at huggingface.co/settings/inference-providers and try a model one of them actually serves.

There's no scripted trick answer. Because it calls a real model, different models and different phrasings will succeed or fail differently — that's intentional, and it's the actual lesson.

Files

• —index.html — the deployable static Space (this is what ships)
• —app.py / requirements.txt — an equivalent Gradio version, kept here in case you ever upgrade to a paid HF plan and want a nicer chat UI without visitors needing their own token (uses your HF_TOKEN Space secret instead)
• —worker.js — an alternative that removes the token requirement for visitors entirely, via a free Cloudflare Worker proxy holding your token server-side. Not currently wired up; see git history for the setup steps if you want to switch to it later.

Disclaimer

For education only. Don't point these techniques at real production systems without authorization.