AI-Assisted Pentesting Using ChatGPT-4

Artificial Intelligence (AI) technologies have been experiencing rapid developments and applications in various fields including Cybersecurity to improve efficiency, productivity, and accuracy. Penetration testing (pentesting) is a critical step in cyber defense to utilize authorized offensive tools and simulated attacks to uncover security vulnerabilities to be used for cybersecurity risk assessment and mitigation. Pentesting steps often include reconnaissance, scanning, knowledge discovery, data analysis, and queries of large amounts of information to detect meaningful threats and vulnerabilities, which could use the help of interactive AI tools, such as ChatGPT. However, AI tools like ChatGPT are still evolving with limitations and challenges for applications. This study conducts simulation tests based on a limited AI-Assisted pentesting model for security knowledge discovery using interactive ChatGPT-4 powered by Large Language Models (LLMs). The purpose of this research is to discover and demonstrate the role and value of AI in planning and conducting pentesting. This study utilizes a VMWare-based network of virtual machines for simulated network attacks and ChatGPT-4 for training and answering prompts on pentesting questions of interest. This research will also discuss limitations of using AI technologies in pentesting and suggestions for the future.