ok-helloworld/vibe-pentest

What it solves

Vibe Pentest is an AI-driven penetration testing tool designed to simulate the thinking process of human security experts. It automates the discovery of vulnerabilities in Web applications, APIs, and administrative backends, reducing the manual effort required for black-box security assessments and business logic vulnerability evaluations.

How it works

The tool employs a multi-agent parallel execution architecture where specialized AI agents are assigned different security testing roles. The process follows a structured pipeline:

1. Reconnaissance: Performs fingerprinting, backend entry scanning, and API pre-scanning.
2. Crawling: Uses GoSpider to map the application's structure and extract endpoints.
3. Parallel Testing: Deploys specific agents (e.g., injection-agent, api-agent, auth-agent, poc-agent) to simultaneously probe for different vulnerability classes based on the identified tech stack.
4. Analysis & Reporting: Analyzes attack chains, verifies evidence, and generates professional security reports in HTML and Word formats.

Who it’s for

It is primarily built for security service companies and individual white-hat hackers who need an automated yet thorough way to conduct authorized penetration tests.

Highlights

• Multi-Agent Architecture: Uses specialized agents for different vulnerability types (Injection, API, Auth, File, Business Logic, and POC verification).
• Low-Impact Mode: A specific configuration designed to find high-value vulnerabilities while minimizing the risk of disrupting the target system.
• Fingerprint-POC Linkage: Automatically matches identified technology stacks with relevant CVE/POCs to increase efficiency.
• Human-in-the-loop Authentication: Supports opening a browser via Playwright for the user to manually enter credentials for authenticated testing.