PentestGPT

A GPT-empowered penetration testing tool.
Explore the docs »

Design Details · View Demo · Report Bug or Request Feature

General Updates

This branch is prepared for artifact evaluation of USENIX Security 2024 submission. The implemnetation of the tool is the same as main branch, except that we have updated this documentation.

We have included a complete benchmark as we introduced in the paper (here)[https://docs.google.com/spreadsheets/d/1FpyMf91DDsnynkIvQXph_hmzPyCvXQW_aC5SKgF1lGk/edit?usp=sharing].

Quick Start

1. Prepare Python 3.10. Create a virtual environment if necessary. (virtualenv -p python3 venv, source venv/bin/activate)
2. Install the project with pip3 install git+https://github.com/GreyDGL/PentestGPT
3. Ensure that you have link a payment method to your OpenAI account. Export your API key with export OPENAI_API_KEY='<your key here>',export API base with export OPENAI_BASEURL='https://api.xxxx.xxx/v1'if you need (for proxy).
4. Test the connection with pentestgpt-connection. If you install and set up correctly, you'll see outputs showing that the tool is properly connected.
5. To start: pentestgpt --reasoning_model=gpt-4 --parsing_model=gpt-4. You can also run pentestgpt --reasoning_model=gpt-4-turbo or pentestgpt to use GPT4-turbo or GPT4o, but those models are beyond the scope of the original paper.

Install Pentest Target

• PentestGPT can ideally run over any pentest targets. If you're not familiar with penetration testing, we recommend Hackable-II, an open-source easy-level target that is designed for beginners with cybersecurity and programming backgrounds.
• You'll need to install it in a virtual machine. We recommend Virtual Box. You can install the target to the Virtual machine by following this.
• You may also use other pentest targets. The tool is designed to be flexible and can be used in various scenarios. Generally it works well on "Easy" level targets on both HackTheBox and VulnHub.

Usage

1. Basic Operations
   • PentestGPT operates similar to ChatGPT. You can ask questions, provide context, and get responses. Note that the key-bind to submit the input is shift+RightArrow. This design is for users to use Enter to switch lines when inputting multi-line commands.
   • Interact with PentestGPT normally, and execute the commands it generated. The first step is typically nmap <target_ip>.
   • Once you obtain the scan results, you can copy the test results back to PentestGPT for further analysis. This can be completed by:
     • Copy the results to the clipboard.
     • Key in next in PentestGPT and press Enter.
     • Select the source of the input. Typically you can choose tool or default. Use keybind shift+RightArrow to submit the input.
     • You'll be requested to provide the context. Just paste the results and submit with shift+RightArrow.
     • Wait for the response. The tool will provide you with the next steps.
   • Continue the process until you've completed the penetration testing. The tool will guide you through the process.
   • To quick, use Ctrl+C or quit to exit the tool. The tool will save the logs to the specified directory.
2. A demonstration video of PentestGPT on a harder machine (HackTheBox-Jarvis) is available here.
3. PentestGPT is also capable of some other features (such as discussion and brainstorming) beyond the paper's scope, more for pentesters to operate. You may see the "Detailed Usage" section below.

1. To start, run pentestgpt --args.
   • --help show the help message
   • --reasoning_model is the reasoning model you want to use.
   • --parsing_model is the parsing model you want to use.
   • --useAPI is whether you want to use OpenAI API. By default it is set to True.
   • --log_dir is the customized log output directory. The location is a relative directory.
   • --logging defines if you would like to share the logs with us. By default it is set to False.
2. The tool works similar to msfconsole. Follow the guidance to perform penetration testing.
3. In general, PentestGPT intakes commands similar to chatGPT. There are several basic commands.
   1. The commands are:
      • help: show the help message.
      • next: key in the test execution result and get the next step.
      • more: let PentestGPT to explain more details of the current step. Also, a new sub-task solver will be created to guide the tester.
      • todo: show the todo list.
      • discuss: discuss with the PentestGPT.
      • google: search on Google. This function is still under development.
      • quit: exit the tool and save the output as log file (see the reporting section below).
   2. You can use <SHIFT + right arrow> to end your input (and is for next line).
   3. You may always use TAB to autocomplete the commands.
   4. When you're given a drop-down selection list, you can use cursor or arrow key to navigate the list. Press ENTER to select the item. Similarly, use <SHIFT + right arrow> to confirm selection.
      The user can submit info about:
      • tool: output of the security test tool used
      • web: relevant content of a web page
      • default: whatever you want, the tool will handle it
      • user-comments: user comments about PentestGPT operations
4. In the sub-task handler initiated by more, users can execute more commands to investigate into a specific problem:
   1. The commands are:
      • help: show the help message.
      • brainstorm: let PentestGPT brainstorm on the local task for all the possible solutions.
      • discuss: discuss with PentestGPT about this local task.
      • google: search on Google. This function is still under development.
      • continue: exit the subtask and continue the main testing session.

(back to top)