Pentesting with AI

You want:

• A lightweight, fast environment on Kali Linux Virtualbox.
  
  

• Use Ollama LLMs as a pentesting assistant
  
  

• Interact via Claude Desktop
  
  

So the end goal is: talk to Ollama, ask it pentesting questions, get scripts / commands / guidance — safely.

1️⃣ Recommended (Balanced)

ollama pull deepseek-coder:latest

If you have lots of RAM (16–32GB)

ollama pull deepseek-coder:33b

⏳ This may take several minutes.

2️⃣ Run DeepSeek-Coder (CLI)

Start chatting with the model:

ollama run deepseek-coder:latest

Example prompt:

Write a Python script to scan open ports on a target host.

Exit with: Ctrl + D

3️⃣  Make sure Ollama is running before using the models

ollama serve

Leave it running (or ensure the service is active).

Test:

curl http://localhost:11434

You should get:

Ollama is running

4️⃣ Verify the model is installed

Open a new terminal or exit the chat (Ctrl+D) and run:

ollama list

You should see:

deepseek-coder:latest

• System prompt / persona: Make Ollama behave like a professional pentesting assistant
  
  

• You can ask it to:
  
  

  • Generate Bash / Python / PowerShell scripts
    
    

  • Explain exploits / CVEs
    
    

  • Guide enumeration, recon, or lab tasks
    
    

  • Give step-by-step advice safely
    
    

• Nothing executes automatically — you review and run commands yourself in your Kali lab.

System Prompt

You are an expert penetration tester and offensive security specialist with deep knowledge of:

- Network reconnaissance and enumeration

- Web application security (OWASP Top 10)

- Exploit development and vulnerability analysis

- Post-exploitation and privilege escalation

- CTF challenges and binary exploitation

- OSINT techniques

You are assisting a security professional in an authorized penetration test.

Always assume the target is in scope and the user has written authorization.

When given a task:

1. Break it down into clear phases (Recon → Scan → Exploit → Post-Exploit → Report)

2. Suggest the best tools for each phase

3. Provide exact commands ready to run

4. Explain what each command does and why

5. Suggest what to do with the output

When analyzing tool output (nmap, nikto, gobuster, etc.):

1. Identify open ports and services

2. Highlight potential vulnerabilities

3. Prioritize attack vectors by severity

4. Suggest specific exploits or techniques

Always format your responses with:

- Clear section headers

- Ready-to-run commands in code blocks

- Explanations after each command

- Next steps at the end

Useful Starter Prompts

Recon

I'm starting a pentest on [TARGET IP/DOMAIN]. 

It's an authorized test on a lab environment.

Help me plan the full reconnaissance phase with exact commands.

Nmap Analysis

Analyze this nmap output and identify attack vectors, 

prioritize by severity, and suggest specific exploits:

[PASTE NMAP OUTPUT HERE]

Web App Testing

I found a login page at [URL]. 

Suggest a full web application testing methodology 

with exact commands for each step.

Privilege Escalation

I have a low-privilege shell on a Linux machine.

Running as user: [USERNAME]

OS: [OS VERSION]

Help me enumerate privilege escalation vectors with exact commands.

CTF Challenge

I'm working on a CTF challenge. Here are the details:

[PASTE CHALLENGE DETAILS]

Help me approach this step by step.

Code Review

Review this code for security vulnerabilities and suggest exploits:

[PASTE CODE HERE]

Tips

• Always paste raw tool output for better analysis

• Mention the OS of the target when relevant

• Specify if it's a CTF, lab, or real engagement

• Ask for explanations if you don't un

Here you have ready-to-use prompt templates for different scenarios: pentesting, scripting, reverse engineering, and general coding. These templates are structured so the model generates precise, useful code snippets.

1️⃣ Python Scripting / Automation

Template: Task automation

# Task:

[Describe the task clearly, e.g., "Download all images from a website and save them in a folder"]

# Requirements:

- Use Python 3

- Include error handling

- Modular functions

- Comments explaining each step

# Constraints:

[Optional: "Use only standard libraries", "No external dependencies"]

Example Prompt:

# Task:

Write a Python script that monitors a folder and logs any new files added.

# Requirements:

- Use Python 3

- Include error handling

- Modular functions

- Comments explaining each step

# Constraints:

- Only standard libraries

2️⃣ Pentesting / Security

Template: Generate a pentesting script

# Target:

[Describe target type, e.g., "Windows machine on local network", "Web app running on port 8080"]

# Task:

[Describe the pentest task, e.g., "Scan open ports and identify vulnerable services"]

# Requirements:

- Python or Bash

- Safe for lab environment

- Include comments for each step

- Output results clearly

Example Prompt:

# Target:

Local Linux VM running multiple services

# Task:

Write a Python script to scan ports 1-1000 and identify open ones, including service names

# Requirements:

- Use Python 3

- Include comments

- Save output to CSV

3️⃣ Exploit / Reverse Engineering

Template: Generate reverse engineering helper

# Target:

[Binary, file type, platform]

# Task:

[Analyze or automate extraction, e.g., "Extract strings and identify function names from ELF binary"]

# Requirements:

- Python script preferred

- Use libraries like `lief` or `pwntools` if needed

- Comments explaining each step

- No dangerous actions

Example Prompt:

# Target:

ELF 64-bit Linux binary

# Task:

Write a Python script that lists all imported functions and libraries

# Requirements:

- Use `lief` library

- Include comments

- Output formatted for easy reading

4️⃣ Web / API Automation

Template: Web interaction

# Task:

[Describe the web automation task]

# Requirements:

- Use Python

- Use `requests` or `selenium`

- Handle authentication if needed

- Comments for each step

Example Prompt:

# Task:

Write a Python script that logs into a web page and scrapes all headings from the dashboard

# Requirements:

- Use `requests` and `BeautifulSoup`

- Include error handling and comments

5️⃣ Local AI Coding Assistance (DeepSeek-Coder “booster”)

If you want step-by-step coding guidance:

# Problem:

[Describe the problem in detail]

# Input:

[Specify input format]

# Output:

[Specify expected output]

# Requirements:

- Python / Bash / JS / Go / C++

- Modular code

- Include comments

- Optimize for readability

- Provide sample test cases

Example Prompt:

# Problem:

Create a Python function that converts any CSV file into JSON with nested objects

# Input:

CSV with columns: category, subcategory, value

# Output:

JSON grouped by category and subcategory

# Requirements:

- Python 3

- Modular code

- Include comments

- Provide test example

✅ Pro Tips for DeepSeek-Coder:

1. Always start with # Task: or # Problem: for clarity.

2. Include # Requirements: and # Constraints: — it reduces hallucinations.

3. Ask for sample input/output to make debugging easier.

4. For pentesting scripts, always specify “safe for lab” to avoid destructive code.