# Discovering AI Applications and LLM Endpoints

> Techniques for identifying exposed AI/LLM endpoints, APIs, and model interfaces during recon, including fingerprinting frameworks, discovering hidden routes, and mapping AI attack surfaces.

- **URL:** https://hackindex.io/platforms/ai/reconnaissance/discovering-ai-applications-and-llm-endpoints
- **Path:** AI Platforms > Reconnaissance
- **Up:** [Reconnaissance](https://hackindex.io/platforms/ai/reconnaissance.md)
- **Published:** 2026-03-18
- **Updated:** 2026-08-11

AI applications expose themselves differently from traditional web services. LLM endpoints often live under predictable paths, return distinctive response structures, and leak provider information in headers and error messages. The goal here is to map every AI-enabled surface within scope before touching anything actively: chat interfaces, completion APIs, embedding endpoints, agent frameworks, and any AI-powered feature bolted onto existing applications.

## Passive Reconnaissance to Discover LLM Endpoints

Start with passive sources before sending a single request to the target. Historical URLs from crawlers and the Wayback Machine frequently surface AI endpoints that have since been removed from navigation but remain live:

```bash
gau $TARGET_DOMAIN | grep -iE 'chat|completion|embedding|llm|ai|model|inference|predict|generate|prompt|gpt|claude|gemini'
# https://target.com/api/v1/chat/completions
# https://target.com/ai/embed
# https://target.com/api/generate
```

```bash
waybackurls $TARGET_DOMAIN | grep -iE 'chat|completion|embedding|llm|model|inference|prompt'
```

## Crawl for AI Endpoints

katana crawls the application and follows JavaScript-rendered content where traditional crawlers miss dynamically loaded AI features:

```bash
katana -u https://$TARGET_DOMAIN -jc -d 3 -o katana-output.txt
```

```bash
cat katana-output.txt | grep -iE 'chat|completion|embedding|llm|ai|model|inference|predict|generate|prompt'
```

## Brute-Force Common AI Endpoint Paths

AI frameworks and providers expose endpoints under predictable paths. Build a targeted wordlist from common patterns and brute-force with ffuf:

```bash
cat > /tmp/ai-paths.txt << 'EOF'
api/chat
api/v1/chat
api/v1/chat/completions
api/completions
api/v1/completions
api/generate
api/v1/generate
api/embed
api/v1/embeddings
api/embeddings
api/v1/models
api/models
v1/chat/completions
chat
chat/completions
openai/deployments
openai/v1/chat/completions
llm/chat
llm/completions
ai/chat
ai/generate
ai/embed
api/ai/chat
api/inference
api/predict
api/v1/predict
EOF
```

```bash
ffuf -u https://$TARGET_DOMAIN/FUZZ -w /tmp/ai-paths.txt -mc 200,201,400,401,403,405,422 -o ffuf-ai-endpoints.json
```

Include 400, 401, 403, and 422 in the match codes. These status codes confirm the endpoint exists even when access is denied:

- **200/201**: open access, proceed directly
- **400**: endpoint exists, expects a different request format
- **401**: authentication required, target for token brute-force or key reuse
- **403**: authorization check in place, test for bypass
- **422**: strong indicator of an LLM API expecting a specific JSON body

## Scan with Nuclei AI Templates

nuclei has templates specifically for detecting AI services, exposed model APIs, and misconfigured LLM endpoints:

```bash
nuclei -u https://$TARGET_DOMAIN -tags ai,llm,openai,ml -o nuclei-ai-results.txt
```

```bash
nuclei -u https://$TARGET_DOMAIN -tags ai,llm,openai,ml -severity medium,high,critical
```

## Identify AI Features in JavaScript

Modern AI applications load model provider SDKs and call AI APIs from the frontend. Extract JavaScript files and search for AI provider references:

```bash
katana -u https://$TARGET_DOMAIN -jc -d 2 | grep '\.js$' | httpx -mc 200 | xargs -I{} curl -sk {} | grep -iE 'openai|anthropic|azure.openai|bedrock|gemini|groq|mistral|ollama|langchain|llamaindex|openrouter'
```

Provider names in JavaScript bundles reveal which AI service the application uses. A reference to `azure.openai` means the application proxies through Azure OpenAI Service. `bedrock` means AWS. `anthropic` means direct API calls to Claude. Each has slightly different endpoint structures and authentication patterns that inform the next steps.

## Check for Proxy Pass-Through Endpoints

Many applications proxy AI provider APIs rather than exposing them directly. Send a minimal completion request to candidate endpoints and observe the response structure:

```bash
curl -sk -X POST https://$TARGET_DOMAIN/api/v1/chat/completions -H 'Content-Type: application/json' -d '{"model":"gpt-4","messages":[{"role":"user","content":"hi"}]}' | python3 -m json.tool
# {
#     "error": {
#         "message": "Invalid API key",
#         "type": "invalid_request_error",
#         "code": "invalid_api_key"
#     }
# }
```

An OpenAI-format error response on a target's own domain confirms the endpoint is a proxy to an AI provider. The error type and structure identify the backend provider even when access is denied. This endpoint is a target for authentication bypass and API key extraction in later phases.

## References

- [lc/gau on GitHub](https://github.com/lc/gau) - GetAllUrls: passive URL collection from multiple sources
- [projectdiscovery/katana on GitHub](https://github.com/projectdiscovery/katana) - Fast web crawler with JavaScript rendering support
- [projectdiscovery/nuclei on GitHub](https://github.com/projectdiscovery/nuclei) - Template-based vulnerability scanner including AI and LLM detection templates