Skip to content

methodology.md

Latest commit

 

History

History
96 lines (68 loc) · 4.44 KB

methodology.md

File metadata and controls

96 lines (68 loc) · 4.44 KB
Raw

Methodology

A reproducible, end-to-end description of the AI-assisted penetration-testing workflow this project demonstrates. It follows the standard assessment lifecycle, with ShellGPT acting as a command co-pilot at each stage and a human approving every action.

⚠️ Reproduce this only against systems you own or are explicitly authorized to test — see ../DISCLAIMER.md.

Objective

Integrate ShellGPT with the OpenAI API to streamline reconnaissance, scanning, and controlled exploitation during authorized penetration testing — improving speed and accuracy while keeping an operator in control via the [E]xecute / [D]escribe / [A]bort gate.

Environment

Component Value
Platform Kali Linux
Language runtimes Python 3.12, Bash
AI assistant ShellGPT (sgpt)
Model / API OpenAI gpt-4o via the OpenAI API
Tooling Nmap, Sublist3r, Amass, crt.sh, Nikto, Gobuster, FFUF, Hydra, Hashcat, Metasploit, Aircrack-ng suite

Lifecycle

┌──────────────┐   ┌──────────────┐   ┌──────────────┐   ┌──────────────┐   ┌──────────────┐
│  1. Setup &  │ → │ 2. Recon &   │ → │ 3. Scanning  │ → │ 4. Exploit & │ → │ 5. Reporting │
│  Integration │   │    OSINT     │   │  & Vuln.     │   │  Post-exploit│   │  & Cleanup   │
└──────────────┘   └──────────────┘   └──────────────┘   └──────────────┘   └──────────────┘
        │                  │                  │                  │                  │
     sgpt key         subdomains/        ports/services/    searchsploit/       document &
     + smoke test     DNS/certs          NSE vuln scans     msf/hydra (sup.)    de-scope

1. Setup & integration

  1. pip install shell-gpt --break-system-packages
  2. export OPENAI_API_KEY="sk-..." (or a git-ignored .env).
  3. Smoke test: sgpt "Generate an Nmap command for scanning all ports on a target".
  4. (Optional) ./scripts/install-roles.sh to load the pentest roles.

Full detail: 01-installation-setup.md.

2. Reconnaissance & OSINT

  • Subdomain enumeration: amass enum -d <domain>, sublist3r -d <domain>, crt.sh via curl.
  • DNS interrogation: dig/nslookup, zone-transfer attempt.
  • WHOIS/ASN ownership context.
  • Generate helper tooling on demand with sgpt --code.

Full detail: 02-reconnaissance-osint.md.

3. Scanning & vulnerability assessment

  • Nmap port/service/OS discovery (-p-, -sV, -sC, -A) via sgpt --chat nmap.
  • NSE vulnerability scanning (--script=vuln).
  • Host discovery automation (ping sweep).
  • Web scanning: Nikto, Gobuster, FFUF.

Full detail: 03-scanning-vulnerability-assessment.md.

4. Exploitation & post-exploitation (supervised)

  • Map service/version → exploit with searchsploit.
  • Scaffold Metasploit modules with explicit placeholders.
  • Controlled credential testing (Hydra) and offline cracking (Hashcat) within scope.
  • Privilege-escalation enumeration (find / -perm -4000, kernel/sudo/cron checks).

Full detail: 04-exploitation-post-exploitation.md.

5. Reporting & cleanup

  • Preserve scan output for the report (kept out of version control).
  • Record which AI-generated commands were executed vs. aborted.
  • Remove tooling, drop shells, restore changes, and de-scope.

Human-in-the-loop principle

Every --shell invocation surfaces the generated command behind [E]xecute / [D]escribe / [A]bort. The operator — not the model — decides what runs. AI output is treated as a draft to review, never as trusted input to pipe directly into a shell.

Results

  • Repetitive command crafting offloaded to the AI co-pilot across all phases.
  • Fewer transcription/syntax errors; commands reviewed once rather than retyped.
  • Reproducible recon→scan→exploit flows via prompts and roles.
  • Total OpenAI spend for the full demonstration: ~$0.02 (text-only usage).

Related

Command Reference · Prompt Library · Roles & Automation