PentestGPT Co-Pilot

Your interactive study companion for the ALX Cybersecurity Professional Programme.

Module 2: Fundamentals

The Lab Environment

Before you can hack, you must build. This aligns with your IT Fundamentals and Containerisation lessons.

1. Docker Setup

PentestGPT uses Docker to ensure a consistent "Attack Box", preventing "it works on my machine" issues.

Dockerfile: Builds an Ubuntu 24.04 machine.
Tools: Pre-installs nmap, netcat, curl, etc.

2. Build Commands

# Compile your "Attack Box"
make install

# Enter the container
make connect

Concept Check: If make install fails, debug it! Is it a permission issue? This is a critical IT skill.

Module 3: Offensive Security

The "Shadowing" Technique

Don't just watch the AI. Use it to compare your work against an automated Red Team agent.

Step 1: You Try First

Pick a target (e.g., HackTheBox) and spend 30 minutes trying to solve it yourself.

Step 2: Run the Co-Pilot

pentestgpt --target <Target_IP> --resume

Step 3: Compare Notes

Watch the dashboard. Did it run nmap with different flags? Did it find a directory you missed with gobuster?

Guided Exercise: Web Recon

Scenario: Targeting 10.10.11.234

pentestgpt --target 10.10.11.234 --instruction "Focus on web enumeration first. Look for hidden directories."

Module 4: Defensive Security

Auditing the Attacker

Switch hats. Imagine you are the Blue Team defending against PentestGPT.

The Audit Trail

PentestGPT generates a log file. This is your evidence.

cat /workspace/pentestgpt-debug.log

Threat Hunting Questions

Timeline: When did the attack start and finish?
IOCs: What IP addresses did the agent connect to? What User-Agent did it use?
Detection: Would your firewall rules have blocked its reverse shell attempts?

Module 5: Strategic Security

Reporting & Compliance

A pentest is only as good as its report. This aligns with GRC (Governance, Risk, Compliance).

The Walkthrough

pentestgpt --list-sessions

Review the output. Does it explain the Business Impact? A good report doesn't just say "I found XSS"—it explains how that leads to account takeover.

Setup Guide

Cloud Setup & Safety

Yes, you can use GitHub Codespaces to try out PentestGPT safely.

1. Technical Setup

Since PentestGPT runs in Docker, it is compatible with Codespaces:

export OPENAI_API_KEY="sk-..."
pip install -r requirements.txt
python3 main.py

⚠️ CRITICAL WARNING: Acceptable Use Policy

GitHub's Terms of Service strictly prohibit using infrastructure for unauthorized scanning or cyberattacks.

DO NOT run nmap or exploits against random public IPs from Codespaces.
SAFE USAGE: Attack local Docker containers (Metasploitable/DVWA) or run internal benchmarks.

2. Recommendation

For active pentest shadowing, use a local VM (Kali Linux) or a dedicated security testing VPS.

Quick Reference Cheatsheet

Start Test: pentestgpt --target <IP>
Resume: pentestgpt --target <IP> --resume
Instruction Hint: pentestgpt --target <IP> --instruction "..."
Debug Mode: pentestgpt --target <IP> --debug

Navigation Menu