AI Pentesting Copilots

# Install Caido (Linux/macOS)
curl -sSL https://caido.io/install | bash

# Or download from https://caido.io/download
# Available for Linux, macOS, Windows, Docker

# Start Caido
caido

# Start with AI features enabled
caido --ai-assist

# Docker installation
docker pull caido/caido:latest
docker run -p 8080:8080 caido/caido:latest

# caido-config.yaml — AI assistant settings
ai:
  enabled: true
  provider: openai          # openai | anthropic | local
  model: gpt-4o
  api_key: ${OPENAI_API_KEY}
  features:
    traffic_analysis: true   # Auto-analyze proxied traffic
    param_discovery: true    # AI-powered parameter fuzzing
    smart_replay: true       # Intelligent request replaying
    vuln_detection: true     # Passive vulnerability hints
  context_window: 128000     # Token context for analysis
  temperature: 0.2           # Low temp for precise analysis

# BurpGPT — Install via BApp Store or manual JAR
# 1. Open Burp Suite → Extensions → BApp Store
# 2. Search "BurpGPT" → Install
# 3. Or download JAR from github.com/aress31/burpgpt

# Configure in Burp → Extensions → BurpGPT → Settings
# Set provider: OpenAI / Azure OpenAI / Local (Ollama)
# Set model: gpt-4o / gpt-4o-mini / local model
# Set API key and save

# ReconAIzer — Install from BApp Store or GitHub
# 1. Burp → Extensions → Add → Select reconaizer.jar
# 2. Set OpenAI API key in extension tab
# 3. Right-click any request → "Send to ReconAIzer"

# Custom prompt template (BurpGPT)
# Analyze the following HTTP request/response pair.
# Identify: SQLi, XSS, SSRF, IDOR, auth bypass, info disclosure.
# Rate severity: Critical / High / Medium / Low / Info.
# Provide proof-of-concept payloads where applicable.

# HackerGPT v2 — chat.hackerai.co
# No installation needed — web-based interface
# Free tier: 50 messages/day, GPT-4o-mini
# Pro tier: Unlimited, GPT-4o, tool integrations

# Supported workflows:
# • Bug bounty recon assistance
# • Vulnerability report drafting
# • Payload generation & encoding
# • Tool command reference (nmap, ffuf, sqlmap, etc.)
# • CVE analysis & exploit guidance
# • OWASP Top 10 testing checklists

# Example prompt:
# "Analyze this HTTP response for IDOR vulnerabilities
#  and suggest bypass techniques for the UUID-based
#  access control on /api/v2/users/{id}/documents"

# PlexTrac AI — pentest reporting platform
# Access: app.plextrac.com (commercial license)

# Key AI features:
# • WritingAssist — auto-generates finding descriptions
# • RiskScoring — AI-powered CVSS + business impact
# • Remediation — tailored fix recommendations
# • Deduplication — merges duplicate findings across engagements
# • Executive Summary — auto-generates exec summaries

# API integration for CI/CD pipelines
curl -X POST https://api.plextrac.com/v2/findings \
  -H "Authorization: Bearer $PLEXTRAC_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "SQL Injection in Login Form",
    "severity": "critical",
    "ai_enhance": true,
    "auto_remediation": true
  }'

# AttackForge AI — pentest management platform
# Access: attackforge.com (commercial license)

# AI-powered features:
# • Vulnerability correlation across engagements
# • Automated report generation with customizable templates
# • AI-assisted finding triage and prioritization
# • Smart workflow automation
# • Risk trend analysis across projects

# AttackForge CLI integration
af-cli finding create \
  --project "Q1-2025-WebApp" \
  --title "Broken Access Control" \
  --severity critical \
  --ai-enhance \
  --auto-correlate

# Claude with MCP Tools — leveraging HexStrike or custom MCP servers
# See: /offensive-ai/02-hexstrike/ for full MCP setup

# claude_desktop_config.json
{
  "mcpServers": {
    "security-copilot": {
      "command": "python3",
      "args": ["./mcp_security_server.py"],
      "env": {
        "NMAP_PATH": "/usr/bin/nmap",
        "NUCLEI_PATH": "/usr/bin/nuclei",
        "WORDLISTS": "/usr/share/seclists"
      }
    }
  }
}

# With MCP, Claude can directly:
# • Run nmap/nuclei/ffuf scans
# • Parse and correlate results
# • Generate findings with CVSS scores
# • Write complete pentest reports
# • Chain tools in multi-step workflows

#!/usr/bin/env python3
"""AI Security Copilot — Custom implementation using OpenAI function calling."""

import json
import subprocess
import openai

client = openai.OpenAI()  # Uses OPENAI_API_KEY env var

# Define security tools the AI can invoke
TOOLS = [
    {
        "type": "function",
        "function": {
            "name": "nmap_scan",
            "description": "Run an Nmap scan against a target host or network",
            "parameters": {
                "type": "object",
                "properties": {
                    "target": {"type": "string", "description": "Target IP or hostname"},
                    "scan_type": {
                        "type": "string",
                        "enum": ["-sV", "-sC", "-sS", "-A", "-O"],
                        "description": "Nmap scan type flag"
                    },
                    "ports": {"type": "string", "description": "Port range, e.g. 1-1000"}
                },
                "required": ["target"]
            }
        }
    },
    {
        "type": "function",
        "function": {
            "name": "nuclei_scan",
            "description": "Run Nuclei vulnerability scanner with templates",
            "parameters": {
                "type": "object",
                "properties": {
                    "target": {"type": "string", "description": "Target URL"},
                    "templates": {
                        "type": "string",
                        "description": "Template tags: cves,misconfig,exposures,takeovers"
                    },
                    "severity": {
                        "type": "string",
                        "enum": ["info", "low", "medium", "high", "critical"],
                        "description": "Minimum severity filter"
                    }
                },
                "required": ["target"]
            }
        }
    },
    {
        "type": "function",
        "function": {
            "name": "ffuf_fuzz",
            "description": "Run ffuf directory/parameter fuzzing",
            "parameters": {
                "type": "object",
                "properties": {
                    "url": {"type": "string", "description": "Target URL with FUZZ keyword"},
                    "wordlist": {"type": "string", "description": "Path to wordlist"},
                    "method": {"type": "string", "enum": ["GET", "POST"], "default": "GET"}
                },
                "required": ["url"]
            }
        }
    },
    {
        "type": "function",
        "function": {
            "name": "analyze_response",
            "description": "Analyze an HTTP response for security issues",
            "parameters": {
                "type": "object",
                "properties": {
                    "url": {"type": "string", "description": "URL to fetch and analyze"},
                    "check_headers": {"type": "boolean", "default": True},
                    "check_cookies": {"type": "boolean", "default": True}
                },
                "required": ["url"]
            }
        }
    }
]


def execute_tool(name: str, args: dict) -> str:
    """Execute a security tool and return output."""
    if name == "nmap_scan":
        cmd = ["nmap", args.get("scan_type", "-sV")]
        if "ports" in args:
            cmd += ["-p", args["ports"]]
        cmd.append(args["target"])
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
        return result.stdout

    elif name == "nuclei_scan":
        cmd = ["nuclei", "-u", args["target"], "-silent"]
        if "templates" in args:
            cmd += ["-tags", args["templates"]]
        if "severity" in args:
            cmd += ["-severity", args["severity"]]
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
        return result.stdout

    elif name == "ffuf_fuzz":
        wordlist = args.get("wordlist", "/usr/share/seclists/Discovery/Web-Content/common.txt")
        cmd = ["ffuf", "-u", args["url"], "-w", wordlist, "-mc", "200,301,302,403"]
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
        return result.stdout

    elif name == "analyze_response":
        import requests
        resp = requests.get(args["url"], verify=False, timeout=10)
        analysis = f"Status: {resp.status_code}\nHeaders:\n"
        security_headers = [
            "Content-Security-Policy", "X-Frame-Options",
            "X-Content-Type-Options", "Strict-Transport-Security",
            "X-XSS-Protection", "Referrer-Policy"
        ]
        for h in security_headers:
            val = resp.headers.get(h, "MISSING")
            analysis += f"  {h}: {val}\n"
        return analysis

    return f"Unknown tool: {name}"


def run_copilot(user_message: str, target_context: str = "") -> None:
    """Run the AI security copilot with tool-calling loop."""
    system_prompt = """You are an expert penetration tester AI copilot.
You have access to security tools: nmap, nuclei, ffuf, and HTTP analysis.
Plan your approach methodically:
1. Enumerate the attack surface
2. Identify potential vulnerabilities
3. Validate findings with targeted scans
4. Provide actionable findings with severity ratings
Always explain your reasoning before executing tools."""

    messages = [
        {"role": "system", "content": system_prompt},
        {"role": "user", "content": f"Target context: {target_context}\n\n{user_message}"}
    ]

    while True:
        response = client.chat.completions.create(
            model="gpt-4o",
            messages=messages,
            tools=TOOLS,
            tool_choice="auto"
        )
        msg = response.choices[0].message
        messages.append(msg)

        if msg.tool_calls:
            for tc in msg.tool_calls:
                args = json.loads(tc.function.arguments)
                print(f"[*] Executing: {tc.function.name}({args})")
                result = execute_tool(tc.function.name, args)
                messages.append({
                    "role": "tool",
                    "tool_call_id": tc.id,
                    "content": result[:8000]  # Truncate large outputs
                })
        else:
            print(msg.content)
            break


if __name__ == "__main__":
    run_copilot(
        "Perform a security assessment of the target web application.",
        target_context="Target: 10.10.10.50, Scope: *.target.htb, Auth: unauthenticated"
    )

#!/usr/bin/env python3
"""Local AI Security Copilot using Ollama — no API keys needed."""

import json
import subprocess
import requests

OLLAMA_URL = "http://localhost:11434/api/chat"
MODEL = "llama3.1:70b"  # Or mixtral, codestral, etc.

def chat_with_tools(messages: list) -> dict:
    """Send messages to local Ollama model."""
    resp = requests.post(OLLAMA_URL, json={
        "model": MODEL,
        "messages": messages,
        "stream": False,
        "options": {"temperature": 0.1, "num_ctx": 32768}
    })
    return resp.json()["message"]

def security_copilot(query: str) -> None:
    """Offline security copilot — runs entirely on local hardware."""
    system = """You are a penetration testing assistant running locally.
Analyze security findings, suggest next steps, and help write reports.
You have no internet access — focus on analysis and methodology."""

    messages = [
        {"role": "system", "content": system},
        {"role": "user", "content": query}
    ]

    response = chat_with_tools(messages)
    print(response["content"])

# Usage:
# security_copilot("Analyze these nmap results and suggest attack vectors: ...")