PwnBot
Python CLI penetration testing assistant with automated reconnaissance and local tool parsing.
"Turns plain-English security instructions into safe, sandboxed command execution."
What it is
A Python CLI chatbot built for authorized penetration testing workflows in lab environments and bug bounty programs. It integrates interactive LLM streaming across multiple Groq models with local command execution, automated reconnaissance scans via nmap, and output parsing for discovery tools.
What was hard
Safely managing local command execution from a chat interface without allowing shell injection. The execution runner enforces shell=False with shlex.split() across all non-interactive tool dispatches, while isolating interactive subshells (reverse listeners and TTY upgrades) to explicit /shell commands. Refactoring the original single-file script into a modular package required isolating mutable target state and token-trimmed conversation history into explicit classes without altering persistence formats.
What was measured
No empirical or statistical performance claims were measured for this project. Scope enforcement and structured output parsers (nmap XML and ffuf JSON) were verified with 32 unit tests in pytest.
What is still open
No empirical accuracy or latency benchmarks exist for model responses, exploit suggestions, or tool-parsing reliability. The project remains a personal lab utility without production deployment or evaluation metrics.