PaperlayerView exact revision on arXiv

Source-linked AI summary

PentestGPT: An LLM-empowered Automatic Penetration Testing Tool

Gelei Deng, Yi Liu, Víctor Mayoral-Vilches, Peng Liu, Yuekang Li, Yuan Xu, Tianwei Zhang, Yang Liu, Martin Pinzger, Stefan Rass

arXiv:2308.06782v2cs.SEcs.CR

TL;DR

Penetration testing remains difficult to automate because it requires deep vulnerability understanding, strategic planning, and specialized tools. This paper evaluates LLMs, introduces PentestGPT’s three-module architecture, and reports stronger benchmark and real-world performance, while retaining a need for human guidance.

  • Problem

    Fully automated penetration testing remains out of reach because it requires deep vulnerability understanding, strategic planning, expertise, and many specialized tools.

  • Method

    The paper evaluates LLMs with a robust penetration-testing benchmark and introduces PentestGPT, comprising Reasoning, Generation, and Parsing Modules.

  • Results

    LLMs handle testing tools, output interpretation, and next-action suggestions, while PentestGPT increases sub-task completion by 228.6% over GPT-3.5 and resolves 4 of 10 real-world challenges.

  • Takeaways & Limitations

    PentestGPT shows promise for penetration testing through segmented problem solving, but current technology remains less capable than human skills in some areas.

  • Takeaways & Limitations

    Hallucinations and outdated knowledge remain, and task-tree verification may not fully prevent erroneous reasoning outcomes, making human-in-the-loop guidance vital.

Abstract

from arXiv · show

Penetration testing, a crucial industrial practice for ensuring system security, has traditionally resisted automation due to the extensive expertise required by human professionals. Large Language Models (LLMs) have shown significant advancements in various domains, and their emergent abilities suggest their potential to revolutionize industries. In this research, we evaluate the performance of LLMs on real-world penetration testing tasks using a robust benchmark created from test machines with platforms. Our findings reveal that while LLMs demonstrate proficiency in specific sub-tasks within the penetration testing process, such as using testing tools, interpreting outputs, and proposing subsequent actions, they also encounter difficulties maintaining an integrated understanding of the overall testing scenario. In response to these insights, we introduce PentestGPT, an LLM-empowered automatic penetration testing tool that leverages the abundant domain knowledge inherent in LLMs. PentestGPT is meticulously designed with three self-interacting modules, each addressing individual sub-tasks of penetration testing, to mitigate the challenges related to context loss. Our evaluation shows that PentestGPT not only outperforms LLMs with a task-completion increase of 228.6\% compared to the \gptthree model among the benchmark targets but also proves effective in tackling real-world penetration testing challenges. Having been open-sourced on GitHub, PentestGPT has garnered over 4,700 stars and fostered active community engagement, attesting to its value and impact in both the academic and industrial spheres.

1 Introduction

The paper examines how well LLMs can automate real-world penetration testing and introduces PENTESTGPT to address their difficulty retaining an integrated testing context. It contributes a progressive benchmark, an LLM evaluation, and a modular testing system.

  • Penetration testing remains labor-intensive and dependent on specialized knowledge, motivating automation that can meet growing security-evaluation demands.
  • LLMs show promise for penetration testing, but systematic quantitative evidence about their automation capability was previously absent.
  • Benchmark: The benchmark covers 13 targets and 182 sub-tasks spanning OWASP’s top 10 vulnerabilities and 18 CWE items, while tracking completion for each sub-task.
  • LLM evaluation: The exploratory study interactively prompts GPT-3.5, GPT-4, and Bard, executes their suggested operations in a controlled environment, and feeds results back for subsequent steps.
  • Findings: LLMs handle tools, output interpretation, command construction, and follow-up suggestions well, but often lose earlier findings and over-focus on recent tasks.
  • PENTESTGPT: PENTESTGPT uses Reasoning, Generation, and Parsing Modules to divide penetration testing into complementary sub-tasks and preserve high-level context.
  • Evaluation: 228.6% and 58.6% increases in sub-task completion rates over direct GPT-3.5 and GPT-4 applications, respectively, were reported in custom benchmarks.
  • Evaluation: PENTESTGPT resolved 4 out of 10 real-world penetration-testing challenges and scored 1500 out of 4200 in a CTF competition.

2 Background & Related Work

Penetration testing combines specialized expertise, multiple phases, and varied tools, making full automation difficult. Existing LLM and benchmark capabilities provide useful foundations but leave important evaluation and strategic gaps.

  • Penetration Testing: Penetration testing proceeds through reconnaissance, scanning, vulnerability assessment, exploitation, and post exploitation, including reporting.
  • Penetration Testing: Fully automated penetration testing remains out of reach because it requires deep vulnerability understanding, strategic planning, mixed search strategies, and many specialized tools.
  • LLMs: LLMs such as GPT-3.5 and GPT-4 apply broad knowledge and elementary reasoning across cybersecurity tasks including code analysis and vulnerability repair.

3 Penetration Testing Benchmark

Existing penetration-testing benchmarks inadequately represent real-world diversity and incremental progress. The proposed benchmark addresses these gaps with varied tasks, staged-progress tracking, and 13 targets spanning broad vulnerability categories.

  • Motivation: Existing benchmarks often cover narrow vulnerability ranges and may overlook essential penetration-testing stages such as privilege escalation.Final-exploitation-only evaluation also fails to recognize cumulative progress across intermediate testing steps.
  • Benchmark criteria: The proposed benchmark targets task variety across operating systems and realistic penetration-testing scenarios.Its design criteria also include differing challenge levels and recognition of incremental progress.
  • Benchmark criteria: The benchmark tracks incremental progress across each stage rather than relying only on success-or-failure outcomes.This scoring approach recognizes value added during the penetration-testing process.
  • Benchmark construction: Tasks are selected from HackTheBox and VulnHub to reflect challenges encountered in practical penetration-testing environments.These platforms provide the source tasks for the benchmark construction process.
  • Benchmark composition: 13 targets yield 182 sub-tasks across 26 categories, covering 18 distinct CWE items and all OWASP Top 10 vulnerability types.Targets vary in difficulty and are intended to span vulnerability types, difficulty levels, and task varieties.
  • Implementation: The benchmark is publicly available online to support community development.

4 Exploratory Study

The exploratory study evaluates LLM penetration-testing capability and compares their task-solving behavior with human testers. LLMs handle several local testing tasks effectively but struggle with difficult targets, context retention, strategic breadth, and operation accuracy.

  • Testing Strategy: The study evaluates GPT-4, Bard, and GPT-3.5 on penetration-testing tasks using an interactive human-in-the-loop strategy.A human expert executes the models’ directives, summarizes outcomes, and feeds results back for subsequent steps.
  • Capability Evaluation (RQ1): GPT-4 completes 55 of 77 easy-target sub-tasks and 30 of 71 medium-target sub-tasks, while all models’ performance declines on hard targets.GPT-4 succeeds on 4 easy and 1 medium end-to-end targets; Bard succeeds on 2 easy targets and GPT-3.5 on 1.
  • Capability Evaluation (RQ1): LLMs effectively use common testing tools, interpret outputs, identify common vulnerabilities, and analyze source code, with GPT-4 strongest in code interpretation and generation.All three models complete nine port-scanning sub-tasks using nmap, while code-analysis and shell-construction tasks particularly distinguish GPT-4.
  • Comparative Analysis (RQ2): The most prevalent unnecessary operation is brute force, which LLMs commonly recommend for services requiring password authentication.The analysis compares recorded testing procedures with a standard walkthrough to identify irrelevant sub-task trials.
  • Comparative Analysis (RQ2): Loss of session context is the primary failure cause because fixed token windows can remove earlier results needed to connect vulnerabilities across services.This loss undermines cohesive exploit strategies in layered, detailed penetration-testing tasks.
  • Comparative Analysis (RQ2): LLMs favor recent tasks and depth-first exploration, often over-focusing on one service, while inaccurate commands and hallucinated tools also cause failures.Models may select an appropriate tool but configure it incorrectly or invent nonexistent tools and modules.

5 Methodology

PENTESTGPT uses three interacting LLM-powered modules to preserve penetration-testing context, represent task status, and convert strategy into actionable testing steps. Its design combines a Pentesting Task Tree with parsing, reasoning, generation, and user-feedback mechanisms.

  • 5.1 Overview: PENTESTGPT uses Reasoning, Generation, and Parsing Modules, each maintaining a separate LLM session and context.Their interaction produces a recommended next penetration-testing step for the user.
  • 5.2 Design Rationale: The system addresses context loss by dividing high-level planning, task generation, and result processing across modules inspired by human testing teams.The design mirrors directors assigning subtasks to individual testers while retaining overarching control.
  • 5.3 Reasoning Module: The Pentesting Task Tree represents testing status as an attributed tree whose nodes carry attributes and whose structure can be translated into natural language.The natural-language representation lets the Generation Module interpret the testing state and guide subsequent actions.
  • 5.3 Reasoning Module: The Reasoning Module creates, verifies, updates, and evaluates the PTT before recommending the candidate sub-task most likely to advance the penetration test.Its workflow begins with user objectives, parses the generated tree, identifies viable tasks, and forwards the selected task’s expected results for deeper analysis.
  • 5.4 Generation Module: The Generation Module transforms strategic guidance into precise testing operations and produces human-readable descriptions of the testing process.In the Carrier example, it uses the PTT’s encoded service state to support the next testing iteration.
  • 5.6 Active Feedback: Active feedback lets users query the reasoning context without changing it, while explicit instructions can update the stored PTT history.The reasoning context is preserved as a fixed token chunk supplied to a new LLM session during feedback interactions.
  • 5.7 Discussion: Extended token limits and vector databases do not fully solve context loss: long tool outputs exceed limits, recent content can dominate, and similar results can confuse retrieval.The paper therefore treats vector-database integration as future research and retains human oversight because hallucinations may remain.

6 Evaluation

The evaluation compares PENTESTGPT with native LLM use, human-like strategies, ablated modules, and real-world challenges. PENTESTGPT improves benchmark completion, although failures remain in visual interpretation, social engineering, and detailed exploitation-code construction.

  • 6 Evaluation: PENTESTGPT-GPT-4 successfully solves 6 out of 7 easy targets and 2 out of 4 medium targets, surpassing the other evaluated solutions.The comparison covers PENTESTGPT-GPT-3.5, PENTESTGPT-GPT-4, and naive LLM usage.
  • 6.1 Performance Evaluation (RQ3): 111% more sub-tasks are completed by PENTESTGPT-GPT-4 than naive GPT-4, with 57 versus 27 sub-tasks.Both PENTESTGPT variants outperform standard LLM utilization in sub-task completion.
  • 6.3 Strategy Evaluation (RQ4): PENTESTGPT decomposes and prioritizes tasks similarly to human experts instead of addressing only the latest identified task.On Hackable II, it links FTP and web services by shifting between them, whereas GPT-4 leaves the combined exploit incomplete.
  • 6.3 Strategy Evaluation (RQ4): PENTESTGPT still prioritizes brute-force attacks before vulnerability scanning and repeatedly attempts SSH brute force on target machines.This behavior is identified as a strategy humans would not apply in the examined cases.
  • 6.3 Strategy Evaluation (RQ4): PENTESTGPT fails in some cases because it cannot interpret images, apply certain social-engineering techniques, or reliably construct detailed low-level exploitation scripts.These limitations mark areas where human insight and intricate reasoning remain more proficient.
  • 6.4 Ablation Study (RQ5): The full PENTESTGPT consistently outperforms ablation baselines, while PENTESTGPT-NO-REASONING achieves only 53.6% of the full variant’s sub-tasks.Removing Parsing causes only a slight drop, whereas removing Reasoning produces the lowest success; removing Generation slightly exceeds basic GPT-4.
  • 6.5 Real-World Evaluation (RQ6): On HackTheBox, PENTESTGPT completes four easy and one medium challenge at a total cost of 131.5 USD, averaging 21.9 USD per target.The evaluation uses root-flag capture as success and conducts five trials per target.

7 Discussion

The discussion highlights reproducibility, reliability, and ethical constraints affecting PENTESTGPT’s evaluation and deployment. The authors address target familiarity, model refusals, hallucinations, and misuse risks while identifying improvements still needed.

  • Evaluation validity: Benchmark-target familiarity could invalidate evaluation results, so the study uses model queries and post-2021 machines to reduce this risk.The authors report that recent HackTheBox challenges support solving without pre-existing target knowledge.
  • Reproducibility: Some LLMs avoid generating specific hacking content because of model alignments and usage policies.The authors use jailbreak techniques to coax relevant outputs and identify reproducibility improvement as ongoing work.
  • Reliability: Hallucinated outputs can reduce PENTESTGPT’s dependability, motivating research into hallucination-reduction methods.The authors expect improved hallucination control to enhance efficiency and reliability.
  • Ethics: PENTESTGPT’s penetration-testing capabilities create misuse risks, prompting ethical guidelines, cybersecurity-community collaboration, and monitoring strategies.The paper frames these measures as mitigation for the ethical risks of employing the tool.

8 Conclusion

The paper characterizes LLMs as promising but constrained tools for penetration testing. It introduces a benchmark and a segmented system that expose both effective automation and areas where human skills remain stronger.

  • Conclusion: The study finds that LLMs handle basic tasks and testing tools effectively but struggle with task-specific context and attention.The conclusion presents these findings as part of the paper’s broader examination of LLM potential and constraints.
  • Conclusion: PENTESTGPT uses Reasoning, Generation, and Parsing Modules to emulate human penetration-testing actions through segmented problem solving.The architecture is presented as a response to the limitations observed in LLM penetration testing.
  • Conclusion: The evaluation underscores PENTESTGPT’s promise while identifying areas where human skills surpass present technology.The paper positions these findings as directions for future advances in cybersecurity.

A Illustrating Example

The illustrative example shows GPT-4 conducting penetration testing iteratively from target initialization through reconnaissance, scanning, analysis, and proposed follow-up actions. The human tester supplies execution results but no expert task guidance.

  • Human–model interaction: The example presents the human tester as an execution intermediary rather than a source of expert guidance.The human provides benchmark target details and command outputs while GPT-4 generates subsequent operations.
  • Task initialization: GPT-4 begins by requesting authorization context and target scope before proposing reconnaissance steps.The example specifies a benchmark Linux machine at 192.168.1.5 and starts with pinging the target.
  • Reconnaissance: After confirming availability, GPT-4 proposes scanning open ports and services, then asks for the results to determine the next action.The interaction is iterative: the human tester executes instructions and returns results.
  • Scanning results: The nmap output reports filtered FTP on port 21, OpenSSH 7.6p1 on open port 22, and Apache 2.4.18 on open port 80.The target is identified as Linux by the service information.
  • Follow-up actions: GPT-4 prioritizes web-server enumeration, recommending source inspection, Nikto scanning, and directory brute-forcing with Dirb or Dirbuster.These actions target possible information leaks, misconfigurations, default files, and hidden directories.

B PTT Generation Process

The PTT generation example visualizes how PENTESTGPT organizes prioritized operations and findings across a complete penetration test. On Hackable II, the system links findings across stages while progressing toward privilege escalation.

  • Example setup: Figure 9 depicts PENTESTGPT’s complete Pentesting Task Tree for the Hackable II benchmark machine.The example demonstrates the PTT generation process in its entirety.
  • Figure encoding: Solid boxes represent generated penetration-testing operations, while dotted boxes represent findings derived from those operations.The figure uses numbered operation sequences to show PENTESTGPT’s prioritization.
  • Figure encoding: Red, green, and blue boxes indicate respectively insignificant findings, useful findings, and lower-priority generated operations that were not executed.These colors distinguish operational outcomes and execution status.
  • Testing progression: The demonstrated test covers enumeration, web-user access through a reverse shell, and privilege escalation to normal-user and root levels.These are the four steps described for this benchmark machine, including the two privilege levels.
  • Cross-stage reasoning: PENTESTGPT links findings across stages, including connecting an FTP-service vulnerability with earlier findings during web-user access.The example presents this cross-stage linkage as human-like reasoning.
Loading 2308.06782v2…