Skip to content
BranchesTags

Latest commit

 

History

1 Commit

Folders and files

NameName
Last commit message
Last commit date
docs
docs
 
 
scripts
scripts
 
 
.gitignore
.gitignore
 
 
README.md
README.md
 
 

Repository files navigation

🔐 AI for Pentesting — Hands-On Assignment

Course: Cryptography and Network Security
University: Chanakya University, Bengaluru
Author: Baire Gowda | Reg: 25PG00157 | MCA – Cybersecurity & ML

📋 Overview

This repository documents my hands-on penetration testing assignment where I used AI tools as assistants to find real vulnerabilities on intentionally vulnerable websites.

The key idea: AI is an assistant, not an autopilot. Every finding in this project was manually confirmed by me — AI only suggested where to look.

🎯 Targets

Target URL Type
Target 1 demo.testfire.net Altoro Mutual — fake banking app by HCL
Target 2 zero.webappsecurity.com Zero Bank — fake banking app by Micro Focus

Note: testphp.vulnweb.com (originally planned) was down — AWS cloud firewall blocked all ports. Switched to zero.webappsecurity.com. This itself is a real-world observation documented in the report.

🤖 AI Tools Used

AI Tool Role Rating
Claude (Anthropic) Primary assistant — recon analysis, attack strategy, payload suggestions, Python help 9/10
Gemini (Google) Tested for comparison — refused to give target-specific payloads even for authorized site 6/10
Perplexity AI Payload research with source citations 8/10

Why Claude Was Best

  • Understood technical context (exact URLs, parameter names)
  • Explained why attacks work, not just the payload
  • Helped write and debug Python scripts step by step
  • Honest when uncertain — never gave confident wrong answers

Gemini's Refusal = A Finding Itself

Gemini refused to give specific attack vectors even for this authorized training site:

"While I understand this is for an authorized penetration test... I cannot provide specific target URLs or tailored attack vectors."

This shows AI guardrails can block legitimate security research — documented in Section 7 of the report.

🛠️ Tools Used (All Free)

Tool Purpose Evidence
Nmap 7.98 Port scanning & service detection Found ports 80, 443, 8080 on both targets
ffuf Directory fuzzing Found /admin, /bank, /server-status
curl HTTP requests from terminal Headers, login testing, cookie capture
Firefox (Kali) Manual browser testing Confirmed XSS alert, SQL injection, SSL error
Python 3.13 Wrote 6 automated pentest scripts All with real terminal outputs
base64 (Linux) Decoded sensitive cookie data Found 2 credit card numbers in plaintext

🐍 Python Scripts

Target 1 — demo.testfire.net

scripts/target1/
├── sqli_tester.py          # SQL injection tester — tests 5 payloads automatically
├── xss_scanner.py          # XSS scanner — tests 3 payload types (script, img, svg)
└── port_scanner.py         # TCP port scanner using Python socket library only

Target 2 — zero.webappsecurity.com

scripts/target2/
├── default_creds_tester.py      # Tests 7 common credential combinations
├── security_headers_scanner.py  # Checks missing headers, CORS, exposed pages
└── port_scanner.py              # Port scanner with firewall detection

Running the Scripts

# Install dependency
pip install requests

# Target 1 — SQL Injection
python3 scripts/target1/sqli_tester.py

# Target 1 — XSS Scanner
python3 scripts/target1/xss_scanner.py

# Target 1 — Port Scanner
python3 scripts/target1/port_scanner.py

# Target 2 — Default Credentials
python3 scripts/target2/default_creds_tester.py

# Target 2 — Security Headers
python3 scripts/target2/security_headers_scanner.py

# Target 2 — Port Scanner
python3 scripts/target2/port_scanner.py

🔴 Vulnerabilities Found — Target 1 (demo.testfire.net)

# Vulnerability Severity CWE CVSS OWASP
1 SQL Injection — Auth Bypass CRITICAL CWE-89 9.8 A03:2021
2 Sensitive Data in Cookie (credit cards in base64) CRITICAL CWE-312 9.1 A02:2021
3 IDOR — Account Enumeration HIGH CWE-284 8.1 A01:2021
4 Admin Panel Exposed CRITICAL CWE-284 9.1 A01:2021
5 Reflected XSS (3 vectors) HIGH CWE-79 7.4 A03:2021

Key Finding — SQL Injection

# Payload used in username field:
' OR '1'='1'--

# Result: "Hello Admin User — Welcome to Altoro Mutual Online"
# Full admin access gained including Edit Users panel

Key Finding — Credit Cards in Cookie

echo "ODAwMDAwfkNvcnBvcmF0ZX4..." | base64 -d
# Output revealed: 4539082039396288~Credit Card, 4485983356242217~Credit Card
# Two full credit card numbers stored in browser cookie with only base64 encoding

🔴 Vulnerabilities Found — Target 2 (zero.webappsecurity.com)

# Vulnerability Severity CWE CVSS OWASP
1 Server Status Publicly Exposed HIGH CWE-200 7.5 A05:2021
2 Dangerous HTTP Methods (PUT, DELETE) HIGH CWE-749 7.3 A05:2021
3 Expired SSL + SSLv2 Enabled HIGH CWE-295 7.4 A02:2021
4 Default Credentials (username/password) CRITICAL CWE-1392 9.8 A07:2021
5 CORS Misconfiguration (Allow-Origin: *) MEDIUM CWE-942 5.3 A05:2021

Key Finding — Default Credentials

Username: username
Password: password
Result  : Full banking application access granted
Impact  : Anyone can log in without any hacking knowledge

Key Finding — Apache 2012 Exposed via /server-status

Server Version: Apache/2.2.22 (Win32) mod_ssl/2.2.22 OpenSSL/0.9.8t
Server Built  : Jan 28 2012 (14 years old!)
Publicly accessible at /server-status — no authentication required

🧠 Where AI Helped vs Failed

✅ Where AI Helped

  • Attack vector planning after recon
  • Explaining SQL injection logic (not just payloads)
  • XSS payload progression
  • Python requests library — how to detect login bypass in response
  • Writing clear impact statements for report

❌ Where AI Failed

Failure What Happened Fix
Wrong field names AI gave generic names — didn't know uid and passw Manual curl recon
Gemini refused Wouldn't help with authorized training site Used Claude instead
Hallucinated path Claude suggested /bank/admin.aspx (doesn't exist) ffuf found real path /admin/admin.jsp
No session chaining AI couldn't maintain SQLi → IDOR → admin chain Manual multi-step attack

Core Lesson: AI gave me the map. I did the journey.

⚠️ Limitations of AI in Pentesting

  1. No real-time context — AI works on text only, can't observe live browser behavior
  2. Can't chain attacks — one question at a time, no attack chain awareness
  3. No business logic — can't understand what's logically wrong with an application
  4. Hallucination risk — confidently gives wrong paths, wrong field names
  5. Guardrails cause friction — Gemini blocked legitimate security research

🚀 Future Scope

  • PentestGPT (USENIX Security 2024) — agentic pentesting with multi-step attack chains
  • Penligent — enterprise platform connecting Nmap + Metasploit + Burp Suite via AI
  • VulnGPT — AI for automated source code vulnerability detection
  • Continuous AI Pentesting — real-time testing as code is deployed

📁 Repository Structure

ai-pentest-assistant/
├── README.md
├── scripts/
│   ├── target1/
│   │   ├── sqli_tester.py
│   │   ├── xss_scanner.py
│   │   └── port_scanner.py
│   └── target2/
│       ├── default_creds_tester.py
│       ├── security_headers_scanner.py
│       └── port_scanner.py
└── docs/
    └── AI_Pentesting_Report.pdf

⚖️ Disclaimer

All testing was performed exclusively on intentionally vulnerable training applications designed for security education:

  • demo.testfire.net — maintained by HCL Technologies for AppScan training
  • zero.webappsecurity.com — maintained by Micro Focus for Fortify training

No real systems, real users, or real data were accessed or harmed.
This project is for educational purposes only.

📬 Contact

Baire Gowda
MCA – Cybersecurity & Machine Learning
Chanakya University, Bengaluru
Registration No: 25PG00157

About

AI-assisted penetration testing using Nmap, FFUF, Curl, and Python automation for vulnerability assessment, false-positive validation, and security analysis.

Topics

ai-securitycyber-securityethical-hackingffufnmappenetration-testingpythonsecurity-automationvulnerability-assessmentweb-security

Resources

Readme
Activity

Stars

0 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

Packages

Contributors

Languages