Skip to content

11. Pentesting in the age of AI 🤖

Traditionally it was "running commands one by one, by hand," which demanded both knowledge and time. Used well, AI can draft everything from enumerating vulnerabilities to proposing the attack order in one go, lowering the barrier. But the final judgment is the human's — that's the iron rule.

The flow of using AI

flowchart LR
    A["① Information gathering<br>nmap/whatweb/curl<br>(collect facts with tools)"] --> B["② Hand it to AI<br>tech info + vulnerability DBs"] --> C["③ AI proposes<br>candidate vulnerabilities<br>in priority order + matching modules"] --> D["④ Human verifies<br>confirm with check → exploit"]
    style A fill:#2d333b,stroke:#3fb950,stroke-width:2px,color:#e6edf3
    style B fill:#2d333b,stroke:#58a6ff,stroke-width:2px,color:#e6edf3
    style C fill:#2d333b,stroke:#58a6ff,stroke-width:2px,color:#e6edf3
    style D fill:#2d333b,stroke:#f85149,stroke-width:2px,color:#e6edf3
  1. Information gathering (as before, collect facts with tools. Don't leave this to AI) Use nmap -sV / whatweb / curl -I to gather the running software and versions.
  2. Hand it to AI Throw the technical information you gathered at the AI, together with the vulnerability DBs (CVE / NVD / Exploit-DB / Rapid7).

    Example: "For this stack (Struts2 2.3.30 / Jetty 9.2.11), list the likely known vulnerabilities in order of severity and feasibility, and point out any matching Metasploit modules."

  3. AI proposes It drafts the likely candidate vulnerabilities, in priority order + with matching modules. Research and ranking that used to take hours comes out in an instant.
  4. Human verifies (most important) Confirm with check, verify the scope, and proceed by validating one at a time.

The iron rule: narrow down with AI, confirm with tools, judge as a human

flowchart LR
    AI["AI<br>narrow down candidates<br>(fast; hypotheses)"] --> M["Tools<br>confirm with check<br>(turn into facts)"] --> H["Human<br>judge and execute<br>(take responsibility)"]
    style AI fill:#2d333b,stroke:#58a6ff,stroke-width:2px,color:#e6edf3
    style M fill:#2d333b,stroke:#d29922,stroke-width:2px,color:#e6edf3
    style H fill:#2d333b,stroke:#f85149,stroke-width:2px,color:#e6edf3

AI "takes a guess," tools "confirm the facts," and the human "makes the responsible judgment." This division of roles reconciles speed with safety.

Benefit Limit (never take at face value)
✅ Enumerating and ranking vulnerabilities is instant ⚠️ AI produces "plausible lies" → verifying with check is mandatory
✅ The barrier is lowered ⚠️ Mistakenly aiming at an out-of-scope target is serious → keep to scope mechanically
✅ It can catch candidates you'd overlook ⚠️ Responsibility for the judgment, execution, and outcome is always the human's

⚠️ Even when you use AI, the scope of your authorization doesn't widen by a single millimeter. AI is a tool that speeds up the work; it's no substitute for permission, ethics, or the law. Always "only targets you own, or that you've been authorized to test in writing."