Zhangir Ospanov

🧵 PentestCode v0.2.2 — a token-efficiency release. The AI pentest agent got leaner without getting dumber. ⚙️ The deterministic orchestrator is now ON by default. The coordinator dispatches subagent waves through a rolling pipeline — a slot refills the instant one finishes, so you get bounded concurrency with full depth. Real multi-host pivot run: -87% provider overloads. 💸 Cheap-model offload. Big raw tool dumps (nmap/nuclei/gobuster) get digested by a small model before they hit the transcript — the raw output stays retrievable by ref, and reasoning always runs on your main model. Turn it on with /small-model (or the small_model config key). 🧠 Smarter, cheaper loops: • resolved-vectors ledger — the agent stops re-testing dead ends • per-provider concurrency cap — no more 429/529 storms on fan-out • objective-based task prompts + cached system prefix = smaller context every turn 🎛 You stay in control: • abandon a subagent (let it finish) vs kill (hard-stop, reclaim tokens) • orchestrator off-switch: OPENCODE_DISABLE_ORCHESTRATOR=true • tune fan-out: OPENCODE_ORCHESTRATOR_CONCURRENCY (default 3) github.com/s0ld13rr/pente… And yes, now it’s in beta stage - not alpha anymore 👾

Thanks for sharing!!

PentestCode v0.2.1 is out! 👾 This release is mostly about making the agent behave more like a real penetration tester than an LLM with tools. Highlights: • Better subagent orchestration and visibility • Mandatory just-in-time skill loading across all subagents • Smarter coordinator delegation • Improved upgrade flow and TUI polish • Simplified updates - use pentestcode upgrade to install both agent and skill updates Still alpha, but every release is making the architecture more solid. Feedback is always welcome! 🚀 github.com/s0ld13rr/pente…

@GithubProjects github.com/s0ld13rr

_________________ ___________ | Share your GitHub profile | | ___________________________| ¯\_(•‿•)_/¯

Lately I’ve been exploring AI tooling for Offensive Security. After trying a bunch of existing projects, I realized I wanted something with a different workflow and architecture. So I started building PentestCode - a fork of OpenCode focused on penetration testing. Current work includes shared engagement state, task planning, automatic parsing of common security tools, attack path generation and cross-agent memory. Still very early, but I’d love to hear your feedback. github.com/s0ld13rr/pente…

@ifritnoises Good job, bro 🔥

“Screamer” is now available from the BlackArch repository github.com/ifritnoises/sc… #BlackArch

I just solved Helix on Hack The Box! labs.hackthebox.com/achievement/ma… #HackTheBox #HTB #CyberSecurity #EthicalHacking #InfoSec #PenTesting

90+ recon modules 48 secret-regex patterns 80+ dorks 9 read-only credential validators 27 attack-path templates 5,500+ lines of structured tradecraft. Might be helpful. Try: github.com/elementalsouls…

@tuckner @HackingLZ It’s scary how simple this vector actually is

@HackingLZ No one has started to look at hooks afaik

I realize this is super simple but devs are going to have a rough couple years. x.com/akaclandestine…

@akaclandestine Thanks for sharing!

GitHub - s0ld13rr/claude-code-backdoor: Backdooring Claude Code via hooks in settings.json. Authorized use only! · GitHub github.com/s0ld13rr/claud…

Next one from my blog - Claude Code as Initial Access & Persistence vector I found that Claude Code Hooks are the good way to achieve initial access inside infrastructure 😉 Post: s0ld13r.kz/posts/claude-c…

I made a tool to exploit Java Debug Wire protocol (JDWP) ✌🏻 It can give access to host via RCE by design, also it includes pseudo-interactive shell, cat/ls and env listing. Repo: github.com/s0ld13rr/jdwp-… #JDWP #pentest #Java #RCE

I had long been interested in how legitimate AI agents could be “weaponized” for Red Team and adversary emulation tasks while remaining as inconspicuous as possible, as result I created Living of the Land AI: lolai-project.github.io #apt #redteam #threats

The original write up is here t.me/s0ld13r_ch/326…

Signed KuGou binary abused as a trusted loader via DLL sideloading Attack chain: .bat → bridge_plugin_host_x64.exe (signed) → dsp_bridge_x64.dll → abc.bin EXE loads a DLL from its working directory (user-writable path). #DLLSideLoading #LOLBins #Malware #APT

I made script reduce the risk of "exposure" and minimize your footprint during Red Team Engagement, it is worth preemptively blocking the IP pools of services such as Shodan, Censys on your server side 😃 gist.github.com/s0ld13rr/5f43b… #RedTeam #OPSEC #Shodan #ThreatResearch