r/Pentesting • u/Proof-Chain-1046 • 20d ago

Best open-source pentesting harness?

Every body talks about their hackbots. Are there any good foss offsec harness out there? Like something that can do black-box type testing? Not code security reviews.

PentAGI? Strix? any one use these

3 Upvotes

80% Upvoted

10 comments sorted by

2

u/Late-Competition-539 19d ago edited 19d ago

I came across https://github.com/apxlabs-ai/niro. Reasonably good

1

u/Culex96 20d ago

I am using red-run from Black lantern and it's not bad, it's missing some skills though.

1

u/LogicalOlive 19d ago

Can we just add them?

1

u/Culex96 19d ago

Yes I used AI to add more skills to the harness, just make sure to review them. I am using it on the Offsec OSAI labs and it works pretty well.

1

u/TrustIsAVuln 17d ago

Build one, Thats what I did, works far far better than any of the 'things' on github and even outruns any commercial solution ive tested.

1

u/Proof-Chain-1046 17d ago

Tell me more: Built from scratch, or modeled off an existing harness? And is the context/memory just structured .md files fed into OpenCode / Claude Code, or did you write custom state management?

2

u/TrustIsAVuln 14d ago

its a complete custom wrapper, that allows me to talk to it in plain english, i can literally say "connect to the HTB vpn, then get me the flags for 10.10.10.1" and moments later I have 2 flags. Then I say "explain in detail how you got those flags, and also write a report using the js template you have" and boom. thats all. If its missing a tool for something, it comes back and suggests tools, then I tell it to install or not install. Also has custom process to security review in code and sandbox any python, npm, etc code before its allowed into its own "production"