PentestGPT: An LLM-empowered Automatic Penetration Testing Tool
Gelei Deng, Yi Liu, V\'ictor Mayoral-Vilches, Peng Liu, Yuekang Li,, Yuan Xu, Tianwei Zhang, Yang Liu, Martin Pinzger, Stefan Rass

TL;DR
PentestGPT is an innovative LLM-powered tool designed to automate penetration testing by addressing the limitations of LLMs in understanding complex scenarios, demonstrating significant performance improvements and real-world applicability.
Contribution
This paper introduces PentestGPT, a novel multi-module LLM-based system that enhances automation and effectiveness in penetration testing tasks.
Findings
PentestGPT outperforms baseline LLMs with a 228.6% task completion increase.
It effectively addresses real-world penetration testing challenges.
The tool has gained significant community support on GitHub.
Abstract
Penetration testing, a crucial industrial practice for ensuring system security, has traditionally resisted automation due to the extensive expertise required by human professionals. Large Language Models (LLMs) have shown significant advancements in various domains, and their emergent abilities suggest their potential to revolutionize industries. In this research, we evaluate the performance of LLMs on real-world penetration testing tasks using a robust benchmark created from test machines with platforms. Our findings reveal that while LLMs demonstrate proficiency in specific sub-tasks within the penetration testing process, such as using testing tools, interpreting outputs, and proposing subsequent actions, they also encounter difficulties maintaining an integrated understanding of the overall testing scenario. In response to these insights, we introduce PentestGPT, an LLM-empowered…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsSoftware Engineering Research · Web Application Security Vulnerabilities · Advanced Malware Detection Techniques
