┌─────────────────────────────────────┐
│ Your Pentesting OS (Parrot/Kali) │
│ │
│ ┌───────────┐ ┌──────────────┐ │
│ │ Local LLM │◄──►│ Assistant │ │
│ │ (Ollama) │ │ Framework │ │
│ └───────────┘ └──────┬───────┘ │
│ │ │
│ ┌─────────────┼────────┐ │
│ ▼ ▼ ▼ │
│ Nmap Nikto Burp │
│ Metasploit SQLMap ... │
└─────────────────────────────────────┘
┌─────────────────────────────────────┐
│ Your Pentesting OS (Parrot/Kali) │
│ │
│ ┌───────────┐ ┌──────────────┐ │
│ │ Local LLM │◄──►│ Assistant │ │
│ │ (Ollama) │ │ Framework │ │
│ └───────────┘ └──────┬───────┘ │
│ │ │
│ ┌─────────────┼────────┐ │
│ ▼ ▼ ▼ │
│ Nmap Nikto Burp │
│ Metasploit SQLMap ... │
└─────────────────────────────────────┘
┌─────────────────────────────────────┐
│ Your Pentesting OS (Parrot/Kali) │
│ │
│ ┌───────────┐ ┌──────────────┐ │
│ │ Local LLM │◄──►│ Assistant │ │
│ │ (Ollama) │ │ Framework │ │
│ └───────────┘ └──────┬───────┘ │
│ │ │
│ ┌─────────────┼────────┐ │
│ ▼ ▼ ▼ │
│ Nmap Nikto Burp │
│ Metasploit SQLMap ... │
└─────────────────────────────────────┘
# Install Ollama
curl -fsSL https://ollama.com/install.sh | sh # Pull a model that's good at reasoning and code
# Mistral 7B is a solid starting point for modest hardware
ollama pull mistral # Verify it's running
ollama list
# Install Ollama
curl -fsSL https://ollama.com/install.sh | sh # Pull a model that's good at reasoning and code
# Mistral 7B is a solid starting point for modest hardware
ollama pull mistral # Verify it's running
ollama list
# Install Ollama
curl -fsSL https://ollama.com/install.sh | sh # Pull a model that's good at reasoning and code
# Mistral 7B is a solid starting point for modest hardware
ollama pull mistral # Verify it's running
ollama list
# Quick sanity check — ask it something security-related
curl http://localhost:11434/api/generate -d '{ "model": "mistral", "prompt": "Explain what a SYN scan does in one paragraph", "stream": false
}' | python3 -m json.tool
# Quick sanity check — ask it something security-related
curl http://localhost:11434/api/generate -d '{ "model": "mistral", "prompt": "Explain what a SYN scan does in one paragraph", "stream": false
}' | python3 -m json.tool
# Quick sanity check — ask it something security-related
curl http://localhost:11434/api/generate -d '{ "model": "mistral", "prompt": "Explain what a SYN scan does in one paragraph", "stream": false
}' | python3 -m json.tool
import subprocess
import requests
import json
import shlex OLLAMA_URL = "http://localhost:11434/api/generate" def ask_llm(prompt, model="mistral"): """Send a prompt to the local Ollama instance.""" resp = requests.post(OLLAMA_URL, json={ "model": model, "prompt": prompt, "stream": False }) return resp.json()["response"] def run_nmap(target, flags="-sV"): """Run nmap with given flags. Target must be validated first.""" # Basic input validation — never trust LLM output directly if any(c in target for c in [";", "|", "&", "`"]): raise ValueError("Suspicious characters in target") cmd = f"nmap {shlex.quote(flags)} {shlex.quote(target)}" print(f"[*] Running: {cmd}") # Always show what's being executed result = subprocess.run( shlex.split(cmd), capture_output=True, text=True, timeout=300 ) return result.stdout # Example workflow
target = "192.168.1.0/24" # Your authorized test target
scan_output = run_nmap(target) analysis = ask_llm( f"Analyze this Nmap scan output. Identify open services, " f"potential vulnerabilities, and suggest next steps.\n\n{scan_output}"
)
print(analysis)
import subprocess
import requests
import json
import shlex OLLAMA_URL = "http://localhost:11434/api/generate" def ask_llm(prompt, model="mistral"): """Send a prompt to the local Ollama instance.""" resp = requests.post(OLLAMA_URL, json={ "model": model, "prompt": prompt, "stream": False }) return resp.json()["response"] def run_nmap(target, flags="-sV"): """Run nmap with given flags. Target must be validated first.""" # Basic input validation — never trust LLM output directly if any(c in target for c in [";", "|", "&", "`"]): raise ValueError("Suspicious characters in target") cmd = f"nmap {shlex.quote(flags)} {shlex.quote(target)}" print(f"[*] Running: {cmd}") # Always show what's being executed result = subprocess.run( shlex.split(cmd), capture_output=True, text=True, timeout=300 ) return result.stdout # Example workflow
target = "192.168.1.0/24" # Your authorized test target
scan_output = run_nmap(target) analysis = ask_llm( f"Analyze this Nmap scan output. Identify open services, " f"potential vulnerabilities, and suggest next steps.\n\n{scan_output}"
)
print(analysis)
import subprocess
import requests
import json
import shlex OLLAMA_URL = "http://localhost:11434/api/generate" def ask_llm(prompt, model="mistral"): """Send a prompt to the local Ollama instance.""" resp = requests.post(OLLAMA_URL, json={ "model": model, "prompt": prompt, "stream": False }) return resp.json()["response"] def run_nmap(target, flags="-sV"): """Run nmap with given flags. Target must be validated first.""" # Basic input validation — never trust LLM output directly if any(c in target for c in [";", "|", "&", "`"]): raise ValueError("Suspicious characters in target") cmd = f"nmap {shlex.quote(flags)} {shlex.quote(target)}" print(f"[*] Running: {cmd}") # Always show what's being executed result = subprocess.run( shlex.split(cmd), capture_output=True, text=True, timeout=300 ) return result.stdout # Example workflow
target = "192.168.1.0/24" # Your authorized test target
scan_output = run_nmap(target) analysis = ask_llm( f"Analyze this Nmap scan output. Identify open services, " f"potential vulnerabilities, and suggest next steps.\n\n{scan_output}"
)
print(analysis) - NDAs and MSAs — client data leaving your controlled environment
- Compliance requirements — PCI-DSS, HIPAA, and SOC 2 all have opinions about where data goes
- Your own operational security — if you're testing a target, you probably don't want a third party knowing about it - A local LLM runtime — Ollama is the most common choice for running models like Llama, Mistral, or CodeLlama on your own hardware
- A coordination layer — something that takes your natural language input, decides which tools to run, and feeds results back to the LLM
- Standard pentesting tools — the same Nmap, Metasploit, Nikto, etc. you already use - Accept your natural language input ("scan this subnet for web servers")
- Translate that into actual tool commands (nmap -sV -p 80,443,8080 192.168.1.0/24)
- Execute the commands safely
- Feed the output back to the LLM for analysis
- Suggest next steps based on findings - Does it sandbox command execution? You don't want an LLM with unrestricted shell access
- Does it actually run locally? Check that no API calls are being made to external services
- How does it handle context? Scan output can be massive — the tool needs to summarize or chunk it intelligently
- Is it transparent? You should see every command before it runs - Air-gap when possible. For the most sensitive engagements, run your AI assistant on a machine with no internet access after downloading the model
- Audit your tools. Before using any open-source AI pentesting assistant, read the source. Check for telemetry, external API calls, or data exfiltration
- Log everything. Keep a record of what the AI suggested vs. what you actually ran. This matters for your pentest report
- Don't blindly trust output. The AI is a junior analyst that reads fast but makes things up. Verify everything
