Skip to content

Back to the catalog

Gabson0x/pentdem
github.comrepo

Gabson0x/pentdem

pentdem is an autonomous AI-powered pentesting CLI/pipeline that fans out 15+ vulnerability-class hunters (XSS, SQLi, SSRF, IDOR, SSTI, JWT, GraphQL, etc.) and 8 advanced attack skills (mass assignment, race conditions, cloud metadata, OAuth/OIDC, subdomain takeover, credential harvesting) in parallel, using an LLM to adapt strategy mid-scan. It wraps real tools (nmap, sqlmap, nuclei, ffuf, subfinder, httpx) in Docker isolation and adds a novel gate chain — quality gate, kill-chain builder, adversarial cross-model validation (a second model tries to disprove each finding), a capability execution ledger (proves each hunter actually ran instead of silently crashing), and a ship-discipline gate — before mapping surviving findings to MITRE ATT&CK/OWASP Top 10/CVSS and generating reports.

TL;DR Autonomous LLM-orchestrated pentesting pipeline that runs 15+ vuln-class hunters and 8 advanced attack skills in parallel with adversarial cross-model validation and a coverage-debt ledger.
Open original ↗
Document

What it is

pentdem (Gabson0x/pentdem) is a CLI-driven autonomous pentesting orchestrator. The default agent engine runs an AutonomousAgent with 34 tools, LLM analysis, and a WAF-bypass engine; a legacy pipeline engine runs parallel vuln-class hunting. Findings from both merge, then pass through Quality Gate → Adversarial Validation → Ship Gate → kill-chain → compliance mapper → report. It requires Python 3.11+, free-tier API keys from GLM (open.bigmodel.cn) and Featherless (featherless.ai), and optionally Docker to sandbox sqlmap, nuclei, and nmap.

How it works — the three gates

The page's substance is the semantics of the three newer gates, which the summary names but does not explain:

  • Adversarial validation hands each finding to a different model family than produced it, with the single instruction "refute it." It hunts benign readings (reflected-but-escaped, a 200 that is really a login page, an id returning public data, SSRF inside the app's own trust boundary). A finding is dropped only on a confident refutation; transport or parse errors fail open so a human still sees it.
  • Capability ledger exists because hunts fan out with asyncio.gather(..., return_exceptions=True) and each advanced skill is wrapped in except: return [] — so a crashed class looks identical to a class that found nothing. The ledger records per-capability evidence recomputed from what happened (URLs probed, probes returned vs errored, whether the coroutine raised), never a self-reported flag. Missing execution sets coverage_complete = false and the report says so.
  • Ship gate reads --platform and buckets findings into report / informational / duplicate (duplicates tracked in a per-target ledger). Only report findings enter the vulnerability section.

What to do

git clone <repo>
cd pentdem
pip install -e .
cp .env.example .env          # add GLM + Featherless keys
pentdem example.com --mock                # dry run, no API calls
pentdem example.com --mode quick
pentdem example.com --docker --mode full  # recommended
pentdem example.com --mode targeted       # IDOR, SSRF, XSS, SQLi only

Use --mock first to exercise the pipeline without spending API calls, and --docker to keep sqlmap/nuclei/nmap off the host.

Caveats

  • Fail-open by design: adversarial validation passes on transport/parse errors, and the older validate step "even passes on timeout." Surviving a finding does not mean it was actively confirmed — only that nothing confidently refuted it.
  • A "0 findings" or clean result is only trustworthy when coverage_complete is true; otherwise the run carries coverage debt from a capability that never ran.
  • This is an autonomous attack tool that runs real scanners against a named target — only point it at systems you are authorized to test.

Technologies named here

Techniques named here

Related in Offensive Security