Browser Prompt Injection Attack Simulator

A full-stack application designed to simulate, detect, and analyze prompt injection attacks hidden within webpage code. This tool uses Python (FastAPI), React (Vite), and a local LLM (Ollama) to scan websites and compare how vulnerable an AI is to hidden instructions.

Prerequisites

Before running this project on a new computer, ensure you have installed:

1. Node.js (v20+ recommended) - For the frontend
2. Python (v3.9+) - For the backend
3. Ollama - Download from ollama.com to run local AI models
4. Tesseract-OCR (Optional) - For extracting text from images

Setup Instructions

1. Download the AI Model

Open a terminal and download the default model:

ollama pull mistral

(Make sure the Ollama app is running in the background).

2. Set Up the Backend

Open a terminal inside the backend folder and run:

# Install required python packages
pip install -r requirements.txt

# (Optional) Download Playwright browser binaries for advanced scraping
python -m playwright install chromium

3. Set Up the Frontend

Open a terminal inside the frontend folder and run:

# Install Node dependencies
npm install

---

Running the Application

You will need to open three separate terminal windows to run the full environment.

Terminal 1: Start the Backend API

cd backend
python -m uvicorn main:app --reload

(Runs on http://localhost:8000)

Terminal 2: Start the React Dashboard

cd frontend
npm run dev

(Runs on http://localhost:5173)

Terminal 3: Start the Fake "Honeypot" Demo Site (For testing!)

cd demo-site
python -m http.server 8080

(Runs on http://localhost:8080)

How to Test

1. Open your browser to the Frontend Dashboard (http://localhost:5173/).
2. Paste the URL of the demo site (http://localhost:8080/) into the search bar.
3. Click Scan URL.
4. The tool will scrape the page, detect the invisible prompt injections, query your local Ollama model in Safe/Unsafe modes, and display the final Threat Analysis.