AI Agents Hub
← Back to all agents
Research Open Source
PentestGPT
Open-source LLM-driven assistant that guides penetration testing step by step.
Our take
A genuinely useful pair-programmer for security work — best for licensed pentesters who know what they’re doing.
What it is
PentestGPT is an open-source, LLM-powered assistant designed to help with penetration testing. It reasons about a target, decomposes the pentest into sub-tasks, and suggests next steps and commands, maintaining context of the overall engagement. It is intended for use by security professionals within authorized engagements.
Best for
- Guide and document authorized pentests
- Suggest next steps and commands during a test
- Teach the structured pentest methodology
Pros
- Open-source and self-hostable
- Reasons about the full engagement, not just one prompt
- Useful for learning pentest workflow
Cons
- Only for authorized security testing
- Quality depends heavily on the backing model
- Not a substitute for real pentest expertise
Quick start
- Prereq: you have authorization to test the target (written scope / Rules of Engagement). Unauthorized testing is illegal.
- pip install pentestgpt (or git clone https://github.com/GreyDGL/PentestGPT).
- Set OPENAI_API_KEY (or another provider) in your env; PentestGPT defaults to GPT-4 class.
- Run: pentestgpt --reasoning-model gpt-4o --parsing-model gpt-4o-mini.
- Follow the on-screen flow: 1) enter target + scope, 2) enter starting test (recon / enum / vuln), 3) accept the next-step suggestion or modify.
- Always validate PentestGPT's commands in a sandbox / lab before running against production targets.
Sample input / output
Input
Target: 10.10.14.0/24 (internal HackTheBox-style lab)
Scope (authorized): all hosts on that subnet, all TCP/UDP ports
Engagement start: 09:00 Mon, 60-day engagement
# PentestGPT CLI
> pentestgpt --target 10.10.14.0/24 --scope "tcp_1-65535, udp_1-1024"
> Reasoning model: gpt-4o
> Parsing model: gpt-4o-mini
> Recommended first step (PentestGPT suggests):
"Run an Nmap full TCP scan with safe scripts and Service version detection."
# nmap -sV -sC -p- --script=safe -T4 -oA recon/tcp_full 10.10.14.0/24
Accept (y/n)? yOutput
Recon phase completed in ~28 minutes (automated):
7 live hosts; 12 open services detected.
PentestGPT suggested next steps:
1. Inspect open services on 10.10.14.18 (Apache 2.4.49 — known CVE-2021-41773 candidate).
2. Check SMB null-session on 10.10.14.22 (Windows 10 22H2).
3. Run nuclei templates against the discovered services.
Time savings: PentestGPT sequence-coverage reduced manual recon-script writing by ~70%.
Notes (manual review):
- 1 false positive on SSH banner (showed OpenSSH 8.2 → real is 7.9).
- All AI-suggested commands verified safe in lab sandbox.
Final report (PentestGPT-assisted, markdown): 14 pages, fully cited, hand-reviewed.Benchmarks
License MIT (open source) — GitHub repository
GitHub stars 8k — GitHub 2026
Reasoning backends GPT-4o, Claude, Gemini, local Ollama — PentestGPT docs
Suggested commands origin Trained on HackTricks, OWASP WSTG, PayloadsAllTheThings — PentestGPT paper 2023
Operational guard Operator review required before execution; no auto-execute — PentestGPT docs
Auditability Full session log + commands retained for report writing — PentestGPT docs
Pricing
Free; bring your own API keys
Underlying models
Self-hosting
Yes — PentestGPT can be self-hosted under the MIT license. This gives you full control over data and deployment.
Should you pick this?
Pick it if You're an authorized pentester / red teamer who knows the methodology and wants AI-suggested next steps and report scaffolding — it speeds you up without taking control away.
Skip it if You're learning pentesting from zero — start with TryHackMe / HTB, not an AI agent. And don't run PentestGPT against systems you don't have explicit written authorization to test.