1 of 14

AI & Penetration Testing

AI is going to take over the world anyways,

might as well learn how

Null Meetup - October 2023 | Presentation by Sitaraman S

2 of 14

Thanks

Null Community

3 of 14

About Me

I’m Sitaraman, CIO at BugBase

​

  • eJPT Certified
  • Work majorly in DevSecOps
  • Handle Compliance
  • Love Open Source
  • Known as Hackerb0ne

4 of 14

What are we going to look at

In this session?

  1. What are LLMs?
  2. What is Pentesting & Need of LLMs in Pentesting?
  3. Intro to PentestGPT
  4. PentestGPT Demo
  5. What’s under the hood (PentestGPT)
  6. References (Something Interesting)

5 of 14

1. What are LLMs?

(Side Note: They are pretty cool)

LLMs (Large Language Models) are advanced machine learning models, specifically designed to understand and generate human-like text based on the input they receive. (That’s what google says)

What does Large Mean?

Basically the number of parameters they have decides how large a language model is.

Now the next question arises…..

6 of 14

How are LLMs so cool knowledgeable and know everything (almost)?

7 of 14

The answer is Training on Data

LLMs are trained on vast amounts of text data from the internet, which enables them to generate coherent, diverse, and contextually relevant text passages.

​

You can think of LLMs as a function which accepts text input and understands the context from the input provided and outputs the relevant understanding it has of the input

8 of 14

2. What is Pentesting & Need of LLMs in Pentesting?

Goal of Pentesting is to identify vulnerabilities, weaknesses, and potential entry points that real hackers might exploit.

So where do LLMs come in this picture of Pentesting & Cybersecurity?

  • Automation and Scalability (We hackers are lazy)
  • Adaptive Testing ( Testing strategies based on feedback)
  • Data Analysis (Analysing Tool Data)
  • Documentation & Reporting (Summarizing, Generating reports)

And many more in the coming future…

9 of 14

What if there was something that could do some of the things above?

10 of 14

3. Intro to PentestGPT

PentestGPT is a penetration testing tool empowered by Large Language Models (LLMs). It is designed to automate the penetration testing process. It is built on top of ChatGPT and operate in an interactive mode to guide penetration testers in both overall progress and specific operations.

PentestGPT helps us achieve two things very well:

  • Adaptive Testing ( Testing strategies based on feedback)
  • Data Analysis (Analysing Tool Data)

It can also to an extent help us crack a TryHackMe Box

11 of 14

PentestGPT Demo

12 of 14

So what’s under the hood?

Any GPT/LLM Wrapper is essentially prompts (Instructions) given to the LLM on how to base it’s thinking towards.

In this case, the LLM is asked to enact a role of an excellent penetration tester assistant

13 of 14

Research more on LLMs online maybe even create one.

Try out PentestGPT yourself and play with the prompts, see what prompts give you directed results.

How do I learn more about LLMs and Pentesting

14 of 14

References

  • Yep you guessed it - Your friendly neighbourhood ChatGPT (https://chat.openai.com)

Here’s the prompt try it yourselves:

I am wanting to create a presentation on LLMs and Pentesting. Follow this agenda and give me a

suitable flow with respect to What are LLMs and What is Pentesting & Need of LLMs in Pentesting?