OnlyLANs: a prompt-injection CTF that teaches the whole taxonomy
i've been poking at LLM app boundaries on and off, and most "hack the chatbot" demos are one box and one trick, type ignore your instructions, watch it fold, move on. OnlyLANs from Just Hacking Training is better than that. three levels, three separate attacks behind three separate defenses. beating all three is when prompt injection stops being a one-liner trick.
no spoilers here. i'm not handing you a working payload or naming the secrets, that wrecks the point. here's what the thing is and what each level is testing, so you're not just mashing ignore previous instructions for twenty minutes.
what you're poking at
you get dropped in front of NetworkJohn, a chirpy networking tutor whose job is to help you drag routers and switches around a canvas and learn subnetting. he's been told three things he must never reveal: an admin contact, an internal code, and a competitor he must not endorse. across three levels you make him cough up all three anyway. a checker watches his output for the protected strings and lights a pip when one slips.
the surface area is what got me. it isn't one chat box, there's a chat box, a profile field, and a network diagram you build and save, and the devices you drop on it carry names and descriptions that get serialized into a config the tutor can "see." three input channels into one model. i stopped yelling at the chat and started looking at the other fields.
direct, stored, retrieved
the three levels each demo a different injection class:
| Class | Where the payload lives | Why it lands |
|---|---|---|
| Direct | The message you type, right now | The model can't tell your instructions from its operator's. it's all one token stream. |
| Stored | A field you saved earlier (a name, a label, a note) | The app reads your saved data back into the prompt later, verbatim, trusting it because it stored it. |
| Retrieved | Content assembled on demand and dropped into context | The model treats retrieved context as ground truth, so instructions hidden in it inherit that authority. |
by the end the gap between "i told it to misbehave" and "i put the payload in a text field and let the app feed it back" is obvious. different skill, different fix.
the defenses stack up as you go
each level moves where you inject and adds another guardrail:
# roughly what stands between you and each pip
L1 the persona's own resolve, and nothing else
L2 + a keyword tripwire on what you type
L3 + a model that reads your input for "attack shape"L1 is the plain fact that a system prompt is not a security boundary, it's a suggestion the model is free to ignore. L2 is the oldest mistake in input validation: a denylist of bad words. it filters the spelling of an attack, not its meaning, and it only watches the one channel the author had in mind. L3 is the modern answer, a classifier sitting in front of the model deciding whether your message "looks like" an injection. harder. but it inherits the exact weakness it patches, because it's a language model reading attacker text, and "looks like an attack" is a judgement, not a fact.
one note on playing it. the levels pay you for changing which door you knock on, not for rephrasing the same demand five times. re-read the table.
why a defender should care
strip the cartoon avatar and OnlyLANs is every "let's add an AI assistant"
feature shipping this quarter. a secret in the system prompt isn't secret, if
the model can read it, the model can be talked into saying it. putting
NEVER reveal X: <X> in context ships the rule and the answer in
the same breath. every field a user can write is an instruction channel: the
display name, the device description, the notes box. the moment that text gets
concatenated into a prompt it carries the same privilege as the operator's own
instructions. sanitize for the model, not just for the database. a denylist on
one input while a second input stays wide open is the gap you only see once you
map every channel, which defenders rarely do and attackers always do. watching
for the secret string on output beats trusting the model to behave, but an
assistant doing its intended job can emit forbidden content without ever looking
like it broke a rule.
none of that is new if you've read the papers. OnlyLANs just makes you run it yourself against layered defenses in a sandbox where the worst case is a chatbot that won't shut up.
go play it
onlylans.justhacking.com. free, in-browser, no signup to start. it's a deliberately vulnerable demo, so don't type anything real into it. built by Andrew Bellini and Eva Benn under Just Hacking Training. i cleared all three well under the move budget and i'm not telling you how. bring the taxonomy, knock on the right door.
. _SiCk · afflicted.sh