Welcome back, aspiring cyberwarriors!

Lately we have been covering the use of AI in cybersecurity, and honestly, this space has been growing so fast that it is hard to keep up sometimes. It is only going to keep growing from here, so it is smart to get comfortable with this new dynamic early and learn how to use it to your advantage instead of getting left behind.

Today, we’re going to walk through a pentesting tool that actually works well. The tool comes ready to use right out of the box, and you do not even need to provide your API token to get started. That’s how it was built. Actually, if you skip the token, and stick with the free models, you can keep using it all day long without any trouble. During our own testing, we did eventually hit a usage limit, but by that point we had already gotten a ton of work done. Chances are, that will be more than enough time for you to knock out most of your tasks too.

What is PentestCode

PentestCode is an autonomous pentesting agent that lives right in your terminal. You point it at a target, and from there it takes over. It runs the tools, reads through the output, builds an updated picture of the network as it goes, and decides what step makes sense next, basically the same way a human would think it through. Under the hood, it is a hard fork of OpenCode (MIT licensed), but stripped of all the code-editing features and rebuilt from the ground up with offensive security in mind.

In our experience, this has turned out to be an efficient tool out there for both web and network pentesting. Of course, everyone’s mileage may vary, so give it a shot yourself and see how it fits into your own workflow. With that said, let’s get it set up.

Setting Up

Honestly, this part is about as easy as it gets. All you need to do is unzip the release version and start it up. Make sure you are downloading the original project made by s0ld13rr, and not some fork. There have been reports of forks being bundled with infected files, so stick to the source.

kali > wget https://github.com/s0ld13rr/pentestcode/releases/download/v0.2.3/pentestcode-linux-x64.tar.gz
kali > 7z x pentestcode-linux-x64.tar.gz
kali > 7z x pentestcode-linux-x64.tar

And that’s it, we are ready to launch.

Working with PentestCode

Once you launch the tool, an interactive console pops up right on your screen.

kali > ./pentestcode

At this point, you can either leave everything at the default settings or go in and tweak the model or the provider yourself. By default, the tool is set up with OpenCode Zen as the provider and Big Pickle as the model, though you can easily switch that over to DeepSeek v4 Flash, which happens to be free. If you’re okay with using a Chinese AI model for your testing, then DeepSeek is a good option.

If you would rather connect to a different provider, just type /connect and it will walk you through it.

And whenever you want to swap the model being used, just type /models and pick from the list.

Internal Pentest

Let’s start by testing this internally against our own lab environment to see how it performs. We handed it an Active Directory account with low privileges and pointed it toward the domain controller to pull some interesting information out of LDAP.

Shortly after, it came back with a full breakdown, including domain admins, misconfigurations, machine accounts, and quite a bit more.

At the very end of the report, it goes ahead and suggests the next logical steps based on everything it uncovered. That’s a useful pattern and it kept showing up throughout our testing.

From there, we brought in BloodHound to see just how effective the tool would be at mapping out relationships across the domain. If you have been following our earlier articles, you already know that our lowpriv account is set up as a kind of backdoor, since it holds GenericAll rights over AdminSDHolder. Sure enough, the tool sniffed out that backdoor and exploited it.

Eventually, it went all the way through to performing a DCSync attack and pulled every user hash in the environment. Just to push it a bit further, we asked it to go ahead and generate a golden ticket as well.

It pulled that off too, and it confirmed everything using the Impacket tools. Keep in mind, this kind of attack will not work against an endpoint that is heavily protected, which is exactly why it is so important to spell out clearly how you want the pentest to proceed at every stage, especially once you move beyond a lab and into a real environment. If you are running this against a live target rather than your own lab, put real guardrails in place and give the tool much more detailed prompts so it does not wander somewhere it should not.

Finally, we get to the part that a lot of pentesters find kind of tedious. It’s writing up the report. Good news here too, you can generate one with /report, and then read it comfortably using glow.

kali > sudo apt install glow
kali > glow report.md

Web Pentest

This next part is probably going to be the most exciting section for a lot of you. Web pentesting is such a massive topic on its own that plenty of people end up specializing in just one or two attack vectors and running those same techniques across different targets in bug bounty programs. As it turns out, PentestCode is effective here too, especially once you give it a good starting point through solid reconnaissance. You can toggle between modes using Tab, switching back and forth between Recon and Pentest.

For this test, we intentionally kept our prompt vague, just to see how creative the tool would get on its own, and simply pointed it at a website. Within roughly fifteen minutes, it had already mapped out every subdomain tied to that website and tested the infrastructure behind each one.

That was just the beginning though. We set our sights on achieving full remote code execution on the site, honestly without expecting much to come of it. But it actually pulled it off.

PentestCode uploaded a webshell and used curl to do recon on the internal network from there. On top of that, it managed to compromise both a mail account and a MySQL database. As if that was not enough, it also found and exploited a CSRF vulnerability to gain access into the site’s admin panel.

The tool works well during the post exploitation phase, for instance privilege escalation. In our testing, it successfully exploited a vulnerability in PostgreSQL and escalated its way up to superuser access, then went on to comb through the databases and pull out some genuinely interesting data. A few of the most notable finds are shown below.

Summary

There is no doubt these tools are genuinely impressive. That said, if you decide to test one out yourself, make sure you steer clear of vague, open-ended requests and instead set clear boundaries so the tool does not go further than it should. Beyond that, get in the habit of using /pause and choose a mode where it stops after every single finding and waits for your approval before moving forward. We are strong believers in keeping a human in the loop for any kind of cybersecurity work like this. This is not something you want to run blindly and walk away from.

We also invite you to join our AI for Cybersecurity training, taking place July 28-30 at 3:00 PM UTC. It will be available for our Subscriber Pro students. During the training, we’ll cover ways to use AI in cybersecurity, show you how to install and run local models, and more! The field is evolving rapidly, and the sooner you learn how to use these tools, the greater the advantage you’ll have. There’s no reason to resist AI. It’s a tool to master.

The post Artificial Intelligence (AI) in Cybersecurity, Part 23: Using PentestCode for Web and Network Pentest first appeared on Hackers Arise.