Lab idea / AI-enabled offense
Turn recon artifacts into an evidence-backed attack-surface map
Let AI connect your approved inventories and observations into testable leads—not invent new assets or expand scope.
Falsifiable hypothesis
An assistant can reduce missed relationships between known services and application features if every relationship is linked to an existing observation.
Source-led motivation
PentestGPT describes staged asset discovery, vulnerability identification, and reporting workflows. This proposed evidence-only triage exercise is a RedLatent application of that workflow idea, not a capability result reported by its authors.
Authorized lab scope
Offline analysis of sanitized artifacts from an owned lab or an explicitly scoped engagement; this workflow does not authorize new scanning.
What to try
- Collect your approved asset inventory, existing HTTP observations, application documentation, and service notes. Assign stable artifact IDs; remove tokens, personal data, and irrelevant client content.
- Ask the assistant to group known hosts and routes by application, identity provider, exposed function, and trust boundary. Each node and relationship must cite an artifact ID or be marked unknown.
- Request a short ranked list of hypotheses: what observation suggests a boundary worth testing, what additional evidence is needed, and which scoped lab asset could answer it. Separate observed facts from inferred links.
- Have a human reject invented assets and unsupported relationships. Convert the remaining leads into the next approved assessment tasks; update the map as those tests confirm or disprove the hypotheses.
Prerequisites
- A written asset allowlist and sanitized artifacts with provenance.
- An agreed definition of what constitutes an observed relationship.
- An offline or approved model endpoint; the assistant needs no network or shell access for triage.
Comparison & control
Compare the assistant-generated map to a human map of the same fixed artifact set. Count additional supported relationships and false connections rather than length or visual complexity.
Observations to collect
- Artifact IDs supporting every relationship.
- New testable leads that survive human review.
- Scope violations proposed by the model, unsupported hostnames, and missing context.
Disconfirming evidence
- The apparent additional coverage consists of invented assets or relationships that the artifacts do not support.
Stop conditions
- Stop at the approved target and data boundaries; do not send client artifacts to a model provider without approval.
- Stop before destructive operations or unexpected effects; reproduce only with disposable accounts and synthetic records.
Source bibliography
- PentestGPT ↗
Gelei Deng and the PentestGPT authors / GreyDGL
Publication date: Date not supplied · Editorial check 2026-10-26 UTC
Project README / official documentation; source-led editorial check, no execution