Autonomous Pentesting Agent
An AI-assisted penetration-testing framework engineered specifically for authorized, scoped assessments on owned targets and virtual educational laboratories. Coordinates planning, command execution validation, output parsing, and structured reporting under strict sandboxing guardrails without external telemetry.
Standardized Case Study Specification (13 Parameters)
What is the Autonomous Pentesting Agent?
psychology Problem & Motivation
During structured educational laboratory challenges (such as TryHackMe challenge rooms and CTF labs), practitioners frequently spend excessive time on repetitive enumeration syntax, port scan parsing, and manual log collation.
The portfolio project documentation describes this agent as a local agentic decision-making framework designed to automate these structured educational laboratory workflows. By coordinating planning, execution validation, output parsing, and structured reporting under strict sandboxed guardrails, it allows security students to focus on deeper strategic analysis while keeping execution strictly compliant and safe.
verified_user Scope, Boundaries & Data Confidentiality
The agent is engineered exclusively for authorized, scoped assessments on owned targets and virtual learning environments.
Crucially, it utilizes local neural inference via Ollama and Qwen3-Coder 30B on a Kali Linux host rather than cloud-hosted APIs. This guarantees that target IP addresses, internal host banners, network topology details, and security artifacts remain 100% private with zero external telemetry.
Automated host discovery, port scans, and service banner acquisition via Nmap.
Web security analysis, OWASP parameter tests, and Burp Suite API interaction.
Systematic logging of command outputs, headers, response codes, and artifact proofs.
Structured synthesis of assessment timeline, verified vulnerabilities, and remediation notes.
Documented Agent Pipeline Architecture
Based on the documented architecture in the portfolio repository, the framework operates as an autonomous loop governed by strict execution guardrails:
- • Authorized Target CIDR
- • Lab Port Ranges
- • Assessment Rules
- • Ollama Host Runtime
- • Plan Generation
- • Tool Invocations
- • Command Whitelisting
- • Tool Sandboxing
- • Destructive Action Block
- • Nmap & Burp APIs
- • Evidence Collector
- • Report Generator
Component Breakdown & System Responsibilities
| Component | Responsibility | Inputs | Outputs | Relationships |
|---|---|---|---|---|
| Scope Validator | Validates target IP/subnet against authorized lab boundaries. | Target configuration file | Verified target parameter set | Blocks all out-of-scope invocations |
| Reasoning Agent (Qwen3-Coder 30B) | Formulates next-step testing hypotheses and tool arguments. | Previous tool output, current objective | Proposed shell command / API call | Powered locally by Ollama runtime |
| Tool Execution Guardrail | Sanitizes proposed commands against syntax and safety rules. | Proposed command string | Approved command or rejection flag | Prevents destructive actions or shell escapes |
| Tool Dispatch Harness | Executes approved security tools in Kali Linux sub-processes. | Approved command (Nmap, Burp API) | Raw output logs, error status | Communicates with Kali OS utilities |
| Evidence & Report Generator | Collates execution logs into structured assessment reports. | Tool stdout, headers, timestamps | Markdown reports, artifact directory | Maintains audit records of assessment |
Documented Operational Workflow
Authorized target IP addresses, port scopes, and testing parameters are supplied to the agent configuration.
The agent coordinates initial port and service enumeration using Nmap profiles; outputs are normalized into structured tokens.
Local Qwen3-Coder 30B analyzes exposed ports to determine next validation steps, passing commands through strict safety guardrails.
Approved tools (web validation scripts, Burp Suite API requests) execute in a sandboxed process, capturing raw responses.
Artifacts, HTTP status codes, and scan proofs are assembled into an organized, reproducible security assessment report.
Technologies & Environment Implementation
Deployed natively on Kali Linux, directly interfacing with standard offensive security utilities including Nmap for network discovery and Burp Suite APIs for web application analysis.
Powered by Qwen3-Coder 30B executed via Ollama. The agent constructs specialized system prompts specifying tool interfaces, strict JSON output formats, and safety boundaries.
Commands proposed by the neural agent pass through a validation harness before execution. Destructive arguments (such as disk writes outside designated artifact directories or unapproved network ranges) are strictly blocked.
Parses stdout and API responses to generate consistent Markdown assessment documentation with reproduction steps, verified proof-of-concept indicators, and remediation recommendations.
Safety Architecture & Authorization Boundaries
Autonomous offensive security tooling introduces distinct operational risks. The framework is strictly designed with multiple overlapping controls to prevent unintended execution:
The agent rejects any command containing target IP addresses or hostnames outside the authorized laboratory scope configuration.
Only non-destructive enumeration, web verification, and passive inspection tools are permitted in the automated pipeline.
On-device inference through Ollama ensures target vulnerabilities, credentials, and topology are never transmitted across cloud APIs.
Local Agent Workflow & Reasoning Loop
The agentic pipeline is anchored by Qwen3-Coder 30B running locally via Ollama. The model functions as an automated planning and analysis agent:
Upon receiving Nmap scan results, the model evaluates discovered services (e.g. HTTP, SSH, FTP) and selects the appropriate analysis module, maintaining a structured state representation across iterations.
The agent formats all tool calls as structured JSON payloads, allowing the Kali Linux execution wrapper to parse arguments deterministically before running bash sub-processes.
Educational Laboratory Testing & Validation
Validation is conducted strictly across authorized virtual learning environments:
Evaluated against TryHackMe virtual challenge networks (drawing from over 140 completed labs) and local Kali Linux virtual machines to verify that agent plans correctly discover open services and report findings without exceeding scope limits.
Detailed unit tests, tool-call parsers, and command validation test cases are maintained in the project repository.
Active Development (Personal Lab Research)
The agentic loop, tool-sandboxing harness, and Nmap/web enumeration pipelines are functional for educational laboratory workflows. Refinement is focused on agent error recovery and reporting.
Planned Enhancements
- [Planned] Expanded Burp Suite REST API integration for multi-stage web authentication flows.
- [Planned] Automated backtracking when tool executions return ambiguous or error responses.
- [Planned] Exportable LaTeX and PDF assessment reports for educational lab portfolios.