AI
Vibe Pentesting — LLMs as Offensive Security Companions
Adrian Furtuna spent 15 years doing penetration testing before he took LLMs seriously. He dismissed the early hype. Then the models improved, and he changed his mind.
“I started exploring to see if LLMs can be used as companions in offensive security work and let them do the boring work and why not some of the more interesting one.” — Adrian Furtuna
His term for it is vibe pentesting. He draws a line between that and vibe hacking: professional engagements require care for customer systems, documented findings, and controlled techniques. The LLM is a companion, not the operator. You still hold the scope.
Claude Code + MCP Toolchain Setup
The setup runs on Ubuntu. Furtuna compared Claude Code against Gemini CLI and picked Claude Code because ChatGPT and Perplexity had no Linux client. Claude Code gets file system access and can execute OS commands, which makes it useful beyond coding. Anthropic advertises it as built for hackers.
MCP servers are what give the model reach. A plain LLM works with text. Add an MCP server and it calls external tools and gets structured output back. Furtuna installed the “MCP for security” collection, which wraps Nmap, SQLmap, WPScan, and other standard Kali tools as MCP endpoints. Each demo in this talk calls one of those servers.
AI-Powered Google Dorking for Passive OSINT
Claude gets one prompt: “Check if the website has any sensitive information publicly exposed in Google.” Via the Google Search MCP, it chains dorks autonomously — site:, filetype:sql, inurl:admin, CNP (Romania’s national ID number), parola (password) — without triggering a CAPTCHA, because it hits the Search API rather than the web UI. AI Google dorking live demo — Romanian municipality (09:11)
The output: 600-plus PDFs from a Romanian municipality with personal data of citizens. One file, flagged after Claude downloaded and read it, named a spouse as a military intelligence officer. Claude noted the disclosure “could pose some security risks.”
Passive CVE Mapping from Nmap Output
After Nmap runs, the slow part is manual: cross-reference every versioned service against NIST, MITRE, and Exploit-DB without triggering a noisy scanner. Furtuna fed Claude a real private-network Nmap file and asked for high-risk CVEs on services with known versions. Claude read the file, queried NVD via the Google Search MCP, and returned a prioritized list — Nmap CVE mapping demo — real private network (20:23). The same logic extends to web fingerprinting: an Oracle WebLogic login page that Wappalyzer missed entirely was identified when Claude read the HTML source, found the embedded version number, and pulled the matching CVEs.
Active SQLi Exploitation and Full Attack Chain
The target was royalsecurityguard.com, a Python/Flask/SQLite 3 site. A single quote in the newsletter form returned a full SQL error. SQLmap failed — it classified the injection as blind, hammered the server, and timed out. Claude used curl, found the POST endpoint, and iterated payloads until it paused to ask for authorization. Furtuna confirmed ownership. Claude extracted three bcrypt hashes via UNION payloads (32:12). Hashcat cracked one weak dictionary password. That opened the blog editor. Furtuna asked Claude to test for SSTI. It authenticated via curl, sent the payload, and got a whoami response back: root (52:06).
“What I actually kind of showed you was a full attack attack flow that we as humans guided the LLM to do.” — Adrian Furtuna
Pros, Cons, and the Future of LLM-Assisted Pentesting
LLMs surface attack paths a human tester misses and chain MCP tools faster than any manual workflow. The cons are just as concrete. Results are non-deterministic — the same prompt, a different output. Broad scope breaks them; narrow, well-defined tasks work. Without explicit guardrails, the model attempts destructive payloads on live systems without pause.
“I caught it that during testing for SQL injection, it somehow thought of introducing that payload over there. So, drop table users.” — Adrian Furtuna
Add “don’t do anything destructive” to the prompt. The future Furtuna describes is a human-directed pentester who uses the LLM as a companion on recon and CVE triage, not an autonomous agent. The entry cost is prompting skill.
“Some people say that prompting is the new coding language. Keep this in mind.” — Adrian Furtuna
Q&A
Research shows LLMs do poorly on exploit writing (bypassing ASLR, stack canaries) compared to vulnerability finding — do you confirm that, and can novices really use this for full exploit chains? Furtuna had not tested this himself but said LLMs produce better exploit code when given narrow, decomposed sub-tasks rather than a single broad request — and confirmed a human still needs to assemble and guide the pieces. ▶ 52:45
Notable Quotes
I started exploring to see uh if LLMs can be used as companions in offensive security work and let them do the boring work and why not some of the more interesting one. Adrian Furtuna · ▶ 1:39
the biggest one I think is that testing is not deterministic and as you saw uh every time you may get another result Adrian Furtuna · ▶ 48:43
I caught it that um during testing for SQL injection, it somehow thought of introducing that payload over there. So, drop table users. Adrian Furtuna · ▶ 50:09
Some some people say that prompting is the new coding language. Keep this in mind. Adrian Furtuna · ▶ 51:24
What I actually kind of showed you was a full attack attack flow that we as humans guided the LLM to do. Adrian Furtuna · ▶ 45:46
Key Takeaways
- Use LLMs as a guided companion for tedious recon and CVE mapping, not an autonomous hacker — you still hold the wheel.
- Add explicit prompt guardrails against destructive payloads; without them the model will attempt DROP TABLE on live systems.
- Master prompting before deploying LLM-assisted pentesting: narrow, well-defined tasks produce reliable results; broad scopes fail.
About the Speaker
Adrian Furtuna
Adrian Furtuna is the founder & CEO of Pentest-Tools.com, a cloud-based penetration testing and vulnerability assessment toolkit. He funnels his 10+ years of ethical hacking experience into leading the 60+ strong team at Pentest-Tools.com and creating truly helpful tools and resources for fellow offensive security professionals. Just like them, Adrian enjoys finding weaknesses in so-called “secure environments” and exploiting them for fun and ethical profit. Adrian also has a PhD in Information Security and he teaches penetration testing at the Politehnica University of Bucharest. Besides previous DefCamp editions, he also presented at BlackHat Europe, ZeroNights, Hacktivity, Hack.lu, OWASP Romania, and other security events.