PentestGPT
NormalDescription
An automated penetration testing agentic framework powered by large language models for security testing and vulnerability discovery.
Key Features
- AI-powered autonomous penetration testing agent with agentic pipeline for intelligent security assessment
- Docker-first isolated environment with 100+ security tools pre-installed and reproducible setup
- Session persistence to save and resume penetration testing sessions across multiple runs
- Multi-category support covering Web, Crypto, Reversing, Forensics, PWN, and Privilege Escalation challenges
- Real-time live walkthrough tracking with interactive TUI and keyboard shortcuts for pause, resume, and help
- Local LLM support via OpenAI-compatible API endpoints for LM Studio, Ollama, and other self-hosted models
Use Cases
💡 Autonomous vulnerability discovery and penetration testing against web applications and network targets
💡 CTF challenge solving with AI-assisted reasoning across multiple security categories
💡 Security research and benchmarking with 104 XBOW validation benchmarks and cost/time tracking
💡 Training and education for penetration testers by demonstrating AI-driven testing workflows
Strengths & Limitations
✅ Strengths
- • High community interest (15.2k stars)
- • Permissive open-source license (MIT)
- • Established track record (3 years in production)
- • Responsive to issues, low backlog
Categories
Quick Start
Install Docker and configure an LLM provider (Anthropic API key, Claude OAuth, or OpenRouter). Clone the repo with --recurse-submodules, then run 'make install' to build the Docker image. Run 'make config' to set up authentication, and 'make connect' to enter the container. Use 'pentestgpt --target <IP>' to start an interactive penetration test, or add '--non-interactive' for automated runs.