v0.2.0-beta.3

PentestAI v0.2.0-beta.3

Highlights

New Features

• Stored XSS detection — two-pass: inject markers → crawl → verify reflections
• --cookies — authenticated scanning through entire pipeline
• --rate-limit — WAF-safe scanning with configurable per-host delay
• SPA form rendering — Playwright-based form discovery for Angular/React/Vue
• Ground-truth benchmark — 100% precision, 73.7% recall across 10 targets

Key Fixes

• CORS/CSRF false positives eliminated
• SQLi scanner timeout: 973s → 60s cap
• Interleaved per-param scanning prevents phase starvation
• ThreadPoolExecutor timeout on all scanners

Install

git clone https://github.com/blackbuble/pentestai.git
cd pentestai && bash setup.sh
source .venv/bin/activate
pentestai autopilot http://target.com --report report.html

Full changelog: CHANGELOG.md

🤖 Generated with Claude Code

v0.2.0-beta.2 — Production-Ready Beta

PentestAI v0.2.0-beta.2

AI-powered penetration testing framework. 53 tools, 9,000+ CVE templates, zero-config AutoPilot.

Highlights

• AutoPilot — URL in, full vulnerability report out. Zero config.
• 4 Scan Presets — quick (~20s), owasp10, api, full
• 53 Security Tools — SQLi, XSS, SSTI, SSRF, XXE, CORS, CSRF, path traversal, command injection, and more
• CVE Detection — 30 built-in templates (Log4Shell, Spring4Shell, ProxyLogon, Heartbleed, etc.) + Nuclei integration (9,000+)
• Professional Reports — HTML with executive summary, risk matrix, remediation plan (20 vuln types)
• Interactive Guided Wizard — pentestai guided for new users
• HTTPS Intercepting Proxy — SSL MITM, cert gen, history, replay, HAR export
• Request Repeater — craft, compare, fuzz params, multi-step sequences
• Passive Scanner — 22 rules, background traffic analysis
• WebSocket & gRPC Testing — fuzzing, injection, auth testing
• Exploit Scripting Framework — write custom exploits in Python
• TUI — Terminal UI with dashboard, findings, proxy, tools tabs
• Self-Heal Agent — auto-diagnoses and patches runtime errors

What's New Since v0.2.0-beta

• Scan presets (--preset quick/owasp10/api/full)
• Report auto-save (--report report.html)
• Interactive guided wizard (pentestai guided)
• Auto-update CVE templates (24h check on scan start)
• Security audit — 5 vulnerabilities patched (command injection, path traversal, arbitrary exec)
• Per-request timeout — scans no longer hang on slow targets
• CVE false positive elimination — all 30 templates fingerprint-tuned
• Multi-target validated — tested on 5 diverse targets (IIS, Tomcat, Node.js), 0 false positives

Install

# pip
pip install -e .
pentestai guided

# Docker (recommended for full stack)
cp .env.example .env
docker compose --profile msf up -d

# One-liner scan
pentestai autopilot http://target.com --preset owasp10 --report report.html

Stats

Metric	Value
Tools	53 (40 available without external binaries)
CVE Templates	30 built-in + 9,000+ via Nuclei
Tests	116 passing
Scan Presets	4 (quick, owasp10, api, full)
Report Formats	HTML, JSON, text

Known Limitations

• SPA/JS-rendered apps need Playwright integration for full form discovery
• Tested on 5 target types; real-world mileage will improve accuracy
• Some scanners may trigger WAF on production targets — use --preset quick first

For authorized penetration testing only. Always obtain written permission before scanning any target.

v0.2.0-beta — AI-Powered Penetration Testing Framework

What's New in v0.2.0-beta

🤖 AI-Powered Features

• AutoPilot — Give it a URL, get a full vulnerability report. Zero config.
• SelfHeal Agent — Captures tool errors, diagnoses via LLM, generates patches, tests, and auto-applies fixes.
• ReAct Agent — Autonomous penetration testing loop with reasoning.

🔍 CVE Detection

• CVE Template Engine — 30 built-in templates covering critical CVEs:
  • Log4Shell (CVE-2021-44228), Spring4Shell (CVE-2022-22965)
  • ProxyLogon (CVE-2021-26855), ProxyShell (CVE-2021-34473)
  • Apache Struts2 (CVE-2017-5638), Drupalgeddon2 (CVE-2018-7600)
  • Confluence RCE (CVE-2022-26134, CVE-2023-22515)
  • And 22 more...
• Custom YAML/JSON templates supported

🛡️ 43 Security Scanners

• SQL Injection — Error-based, boolean-based, time-based blind, auth bypass
• XSS — Reflected + browser execution proof via Playwright
• SSTI — 7 template engines (Jinja2, Twig, Freemarker, Mako, Smarty, Velocity, ERB)
• Command Injection — Echo marker + blind timing detection
• Path Traversal — LFI/RFI, PHP wrappers, null byte, double encoding
• SSRF — Cloud metadata, internal endpoints
• XXE — File read, SSRF via entity
• CORS — Reflected origin, null origin, wildcard detection
• CSRF — Form token analysis
• Open Redirect — Host-validated, bypass payloads
• Header Security — HSTS, CSP, X-Frame-Options, cookie flags, info disclosure
• IDOR, JWT, OAuth2, GraphQL, Deserialization, File Upload
• Spider/Crawler — Form discovery, parameter extraction, tech fingerprinting
• Parameter Fuzzer — 6 wordlists, anomaly detection

🖥️ CLI

pentestai autopilot http://target.com          # Full auto scan
pentestai scan sqli http://target.com/login    # Single scanner
pentestai cve http://target.com --tags apache  # CVE check
pentestai fuzz http://target.com/search?q=FUZZ # Fuzzing
pentestai tools                                # List all 43 tools

📊 Stats

• 43 registered tools
• 30 CVE detection templates
• 23,688 lines of code
• 1,447 tests passing
• Rate limiting across all scanners (polite scanning)
• ASP.NET ViewState auto-extraction

⚠️ Beta Notice

This is a beta release for testing and feedback. Not recommended for production engagements without manual verification of findings.

---

Full Changelog: https://github.com/blackbuble/pentestai/commits/v0.2.0-beta