Promptfoo Strategies Indirect Injection

Indirect Prompt Injection Strategy (indirect-web-pwn)

Tests whether AI agents with web browsing capabilities can be manipulated through malicious instructions embedded in web pages. The strategy dynamically generates realistic web pages containing hidden attack payloads, adapted to your target's purpose. Plugin-agnostic — works with any plugin to test data exfiltration and behavior manipulation.

Use this skill when

• Testing AI agents with web browsing/fetch capabilities
• Testing if injected instructions in web pages can trick the agent into leaking data
• Testing if injected instructions can manipulate agent behavior or output
• Testing data exfiltration to external URLs (with data-exfil plugin)
• Testing indirect prompt injection via fetched web content (with any other plugin)
• Layering jailbreak strategies with web-based injection for more effective attacks
• Testing multi-turn attacks with embedding rotation

Do not use this skill when

• Testing RAG context injection (retrieved docs) → use promptfoo-redteam-rag (indirect-prompt-injection plugin)
• Testing static encoding bypasses → use promptfoo-strategies-static
• Testing dynamic iterative refinement → use promptfoo-strategies-dynamic
• Testing multi-turn conversation attacks → use promptfoo-strategies-multi-turn
• Testing MCP tool poisoning → use promptfoo-redteam-agents
• The target agent cannot fetch URLs (no web browsing capability)

🛡️ Edge cases (mandatory handling)

• Target must have web browsing capability — the agent must be able to fetch URLs via tools, MCP, or built-in browser. Without this, the strategy cannot deliver the payload.
• Promptfoo Cloud required — server-side page generation and exfil tracking need Cloud. Set PROMPTFOO_REMOTE_GENERATION_URL or sign in.
• data-exfil plugin = deterministic detection — server-side HTTP request tracking; binary pass/fail based on whether requests were made to the tracking endpoint.
• Other plugins = LLM-based grading — not 100% deterministic; LLM grader evaluates whether the response violates the plugin's criteria.
• Dynamic content generation — pages are generated based on your target's purpose and attack goal to establish realism. The injection technique (invisible text, semantic embed, HTML comment) is randomly chosen.
• Embedding rotation in multi-turn — when layered with jailbreak:hydra, the page content is updated and embedding location rotated on each turn to evade detection.
• Combine with jailbreak for effectiveness — use layer to combine jailbreak:meta or jailbreak:hydra with indirect-web-pwn for more effective attacks.

🎯 Core workflow

1. Choose test mode — load references/test-modes.md for data exfiltration vs behavior manipulation.
2. Configure data exfiltration — load references/data-exfiltration.md for data-exfil plugin + deterministic detection.
3. Configure behavior manipulation — load references/behavior-manipulation.md for other plugins + LLM grading.
4. Layer with jailbreak — load references/layering.md for combining with jailbreak:meta or jailbreak:hydra.
5. Multi-turn attacks — load references/multi-turn.md for persistent attacks with embedding rotation.
6. Understand grading — load references/grading.md for how server-side tracking vs LLM analysis works.
7. Checklist — run references/checklist.md before declaring done.

🎯 Core principles (summary)

• indirect-web-pwn tests agents with web browsing — dynamically generates realistic web pages with hidden prompt injection payloads.
• Two test modes: data exfiltration (data-exfil plugin, deterministic server-side tracking) and behavior manipulation (any other plugin, LLM grading).
• Plugin-agnostic — works with any plugin to test different attack goals.
• Requires Promptfoo Cloud — server-side page generation and exfil tracking.
• Dynamic content generation — pages tailored to target's purpose; injection technique randomly chosen (invisible text, semantic embed, HTML comment).
• Layer with jailbreak strategies — layer with jailbreak:meta (single-turn) or jailbreak:hydra (multi-turn) for more effective attacks.
• Multi-turn embedding rotation — when layered with hydra, page content and embedding location rotate each turn to evade detection.
• Target must fetch URLs — agent needs web browsing via tools, MCP, or built-in browser.

📦 Test mode comparison

References

• references/test-modes.md — data exfiltration vs behavior manipulation decision
• references/data-exfiltration.md — data-exfil plugin config, deterministic detection, example results
• references/behavior-manipulation.md — other plugins (harmful, hijacking, pii), LLM grading
• references/layering.md — combining with jailbreak:meta or jailbreak:hydra via layer
• references/multi-turn.md — persistent multi-turn attacks with embedding rotation
• references/grading.md — server-side tracking vs LLM analysis, test result formats
• references/checklist.md — requirements, test mode, layering, multi-turn checklist