Appendix C. AI Setup Prompt Collection 🤖¶
A collection of copy-paste-ready prompts for getting an AI (a command-capable AI assistant like Claude Code / ChatGPT, etc.) to help you with setup. Paste the blocks below as-is and the AI will walk through the steps for you.
⚠️ Read before you use these - Review for yourself what each command does before it runs when the AI tries to execute it. - Use the tools you install (nmap / Metasploit / Kali, etc.) only against your own property or targets you're authorized to test. - AI can get things wrong (hallucinate). The final judgment is yours as a human. - Steps vary depending on your environment (OS, chip, existing config), so tell the AI about your environment.
Prompt 1: Install the full toolset (Pattern A)¶
You are an assistant helping me set up my Mac (Apple Silicon / macOS).
I want to build a "local practice environment for learning penetration testing," so please proceed through the following in order.
Assumptions and rules:
- The scope is only practice containers inside my own machine. Do not touch anything external or anyone else's assets.
- Before running each command, explain in one line what it does, then run it.
- Don't reinstall anything already present; just verify it.
What I'd like you to do:
1. Check whether Homebrew is installed (if not, just explain how to install it)
2. Install nmap (if missing) and show its version
3. Check whether Docker is running (if not, point me to Docker Desktop)
4. Pull the official Metasploit Docker image metasploitframework/metasploit-framework
5. Finally, list what was installed and report completion
When you're done, tell me that the next stage is "standing up a practice target."
Prompt 2: Stand up a practice target¶
On my Mac (with Docker running), please stand up some "deliberately vulnerable practice targets" for learning pentesting,
locally (exposed on 127.0.0.1 only).
Rules:
- Always bind to 127.0.0.1 and do not expose anything to external networks.
- Before standing them up, check that the ports you'll use are free.
Targets to stand up:
1. Vulhub's Struts2 S2-045 (vulhub/struts2:2.3.30) on 127.0.0.1:8088
2. OWASP Juice Shop (bkimminich/juice-shop) on 127.0.0.1:3000
After startup, verify each returns an HTTP response and tell me the URLs to access them.
When done, also tell me how to stop them (docker stop / rm).
Prompt 3: Run Kali Linux in a UTM VM (Pattern C)¶
Please help me get Kali Linux running as a UTM virtual machine on my Mac (Apple Silicon / macOS).
I've heard there are a lot of gotchas on Apple Silicon, so I want to proceed without getting stuck.
Assumptions and rules:
- Kali is for my learning. Attack targets are limited to my own practice environment only.
- For the parts that need GUI clicks, give me specific instructions on what to click and where.
- Explain each command before running it.
The order I'd like you to follow:
1. Install UTM (brew install --cask utm)
2. Explain how to obtain the Kali ARM64 (Apple Silicon) Installer ISO
(after downloading, verify integrity with a SHA256 check)
3. Recommend VM specs (ARM64 / RAM 4096 / CPU 4 / disk 40GB / virtio-ramfb)
4. [Important] The installer has a known bug where it goes to a black screen (Display output is not active),
so proceed from the start with the "install via serial console" method
(add a Serial device and operate the installer in the Terminal window)
5. Explain the installer choices (Language = English, Partitioning = Guided, Write changes = Yes, etc.)
6. After installation, through the cleanup of removing the ISO and serial device
If a black screen or import error comes up along the way, tell me the cause and the workaround.
Prompt 4: When the reverse shell doesn't come back (Pattern B)¶
After I exploit a practice target in Metasploit, check passes, but I get
"Exploit completed, but no session was created" and no meterpreter comes back.
My environment is a practice target on macOS + Docker.
Don't jump to a cause by guessing — first isolate "where the target container can reach back to"
and identify the cause based on evidence. Then, using the approach of
"turning the attacker (Metasploit) into a container too and placing it on the same Docker network as the target,"
guide me through reconfiguring things so the reverse shell comes back.
Rule: the scope is my local practice environment only. Nothing points externally.
Prompt 5: Get vulnerability candidates from recon results (using AI)¶
Below are the recon results I gathered against my own practice environment.
List the known vulnerabilities likely to apply to this setup, ordered from highest severity and exploitability,
and point out whether Metasploit has a corresponding module.
[Recon results]
(Paste the output of nmap -sV, plus the software names, versions, headers, etc.
that whatweb / curl -I revealed, here)
Conditions:
- This is against my authorized practice environment and is in scope.
- Treat the candidates strictly as hypotheses, and make clear that they often need to be confirmed with check.
- Don't be definitive; also list the points that should be verified.
💡 For the detailed thinking behind Prompt 5, see ../ai-assisted-pentest.md.
Principles for using these prompts¶
flowchart LR
P["Paste the prompt"] --> R["AI proposes steps/commands"]
R --> C["Human reviews the content"]
C --> E["Run it once you're satisfied"]
style P fill:#2d333b,stroke:#58a6ff,stroke-width:2px,color:#e6edf3
style R fill:#2d333b,stroke:#58a6ff,stroke-width:2px,color:#e6edf3
style C fill:#2d333b,stroke:#d29922,stroke-width:2px,color:#e6edf3
style E fill:#2d333b,stroke:#f85149,stroke-width:2px,color:#e6edf3AI is a tool for doing the work faster. The review and the judgment must always be done by a human.