Neura Market
PentestGPT logo

PentestGPT

Free

6.4k

FreeFree tier
Type
Open Source
Visit Website GitHub (40 stars)

About PentestGPT

PentestGPT is an open-source AI-powered autonomous penetration testing agent, published at USENIX Security 2024. It uses a multi-stage pipeline that feeds findings from one phase into the next: for CTF challenges it progresses through reconnaissance, exploitation, and walkthrough; for penetration tests it goes through asset discovery, vulnerability identification, and report generation. The agent can operate autonomously using Claude Code or Codex, or interactively in legacy mode supporting a wide range of LLMs including OpenAI, Anthropic, Google Gemini, DeepSeek, xAI, Qwen, Moonshot, and local Ollama. Features include AI-powered challenge solving, real-time live walkthrough, multi-category support (Web, Crypto, Reversing, Forensics, PWN, Privilege Escalation), session persistence, and an extensible modular architecture.

Key Features

Multi-stage pipeline (recon → exploit → walkthrough for CTF; asset discovery → vulnerability identification → report for pentests)
Autonomous agent driving Claude Code or Codex without human intervention
Interactive legacy mode supporting OpenAI, Anthropic, Google Gemini, DeepSeek, xAI, Qwen, Moonshot, and local Ollama
AI-powered challenge solver for penetration testing and CTFs
Live walkthrough tracking steps in real-time
Multi-category support: Web, Crypto, Reversing, Forensics, PWN, Privilege Escalation
Real-time feedback with live activity updates
Session persistence – save and resume penetration testing sessions
Extensible and modular architecture

Pros & Cons

Pros
  • Open source and free to use
  • Published at USENIX Security 2024 (academic recognition)
  • Multi-stage pipeline ensures thorough and structured testing
  • Supports a wide variety of LLMs via legacy mode
  • Session persistence enables long-running assessments without losing progress
  • Modular design allows easy extension and customization
Cons
  • Requires Python 3.12+ and uv package manager for installation
  • Autonomous mode requires additional CLI tools (Claude Code or Codex) to be installed and authenticated
  • Setup complexity may be high for non-technical users
  • Interactive legacy mode is separate from the autonomous agent pipeline

Best For

Automated penetration testing of web applications and networksCapture The Flag (CTF) challenge solvingSecurity assessments with asset discovery and vulnerability identificationGenerating penetration test reports

FAQ

What LLMs does PentestGPT support?
The autonomous agent mode supports Claude Code and Codex. The interactive legacy mode supports OpenAI, Anthropic, Google Gemini, DeepSeek, xAI, Qwen, Moonshot, and local Ollama.
Is PentestGPT free?
Yes, PentestGPT is open source and free to use.
How does the multi-stage pipeline work?
For CTF mode, the pipeline proceeds through reconnaissance, exploitation, and walkthrough. For penetration test mode, it goes through asset discovery, vulnerability identification, and report generation. Each stage feeds its findings into the next.
Can I save and resume a session?
Yes, PentestGPT supports session persistence, allowing you to save and resume penetration testing sessions.
What categories of challenges does it support?
It supports Web, Crypto, Reversing, Forensics, PWN, and Privilege Escalation categories.