3 results for “pentesttools”
Getting IBM to say “critical” and “thank you” in one report? Specter managed both.
Specter, the autonomous pentesting engine behind AI Pentests, found a critical vulnerability through IBM’s bug bounty program on HackerOne. IBM’s team confirmed the impact and acknowledged it publicly.
How it works: https://pentest-tools.com/features/ai-pentests
All the HackerOne thanks so far: https://hackerone.com/pentesttools_specter?type=user
Good news, everyone!
We’re back at DefCamp, sponsoring once again, and this time our booth has a special guest: Specter, the autonomous engine behind our AI Pentests.
Fair warning, it comes with references. The US DoD, UK Ministry of Defence, IBM, Booking.com, and others have acknowledged its findings on HackerOne. This guy is eager to meet you and be put to the test.
The rest of the crew will be there too: the researchers who hunt 0-days, the engineers who turn them into exploit modules and, of course, the swag (if you’re fast enough).
📍 Nov 19–20, Palace of the Parliament, Bucharest
https://pentest-tools.com/events/defcamp-2026
----------------
🛠️ Tool
===================
ARTEX is an open-source, AI-driven autonomous penetration testing system built on a Go backend and a Next.js frontend. The repository covered here is an English translation fork of the upstream project Autumn-27/ARTEX, which was originally written in Chinese. Per the fork's README, every user-facing and code-level string was translated: the UI, backend text, LLM prompts, comments, scripts, and documentation. Behavior is unchanged, and licensing and terms of use are inherited from upstream.
Key capabilities
• Dashboard with an activity stream, task list, and token usage tracking
• Per-task execution trace covering sessions and tool calls
• Exploration chain visualization as a graph
• Findings and asset management, including a force-directed asset coverage graph that highlights tested nodes and supports collapsible nodes
• Traffic recording
• Human-in-the-loop chat and interception approvals, meaning the agent requests approval before acting
• A global approval-records page; per-task approval cards expand to full details, a rendering that follows AegisHook's approval detail component
• Agent management and LLM configuration through the UI
Asset sync with ScopeSentry
ScopeSentry, from the same upstream author, feeds ARTEX directly. Enter the ScopeSentry address and API key on the Asset sync page, pick targets and asset types scoped by project or task (domain, subdomain, IP, port, site, endpoint), and import in one click. Assets merge under the company asset scope and land in the asset graph for agents to explore. That avoids running collection twice across two tools.
Technical implementation
Requirements: a PostgreSQL database, and an LLM key for exploration (ANTHROPIC_API_KEY or OPENAI_API_KEY), also configurable in the UI. Backend in Go, frontend in Next.js. The screenshots (dashboard, sessions, exploration chain, assets, traffic, logs) suggest the system is designed to be inspected while it runs; most agent pentest tools either hide the loop or dump it into a log file.
Installation caveat
The published Docker image, autumn27/artex, is produced by upstream's CI and is the Chinese build. docker compose up -d and the prebuilt release archives all yield the Chinese interface. To run the English build you must compile from source: build on Windows, build a single binary on Linux or macOS, or build your own Docker image. The fork ships a DOCKER.md covering that path.
Retained Chinese strings
A few Chinese strings are kept deliberately, each documented with a comment: ICP filing numbers and their detection, the legacy [模型] reason prefix (matched alongside the new [model] prefix so rows written by an older database still classify correctly), quota-exhausted markers returned by Chinese LLM gateways, the full-width comma in split() character classes, and test fixtures that prove non-ASCII/GBK handling. If you plan to strip localization or adapt the parsing, read those comments first, they are load-bearing.
Assessment
The feature set sits between an agent runtime and a pentest management platform: task tracking, asset graph, findings, approvals, traffic capture. The approval and interception layer is the part worth evaluating first, since it determines whether agent actions stay within your authorization scope. Token usage per task is exposed on the dashboard, so cost profiling is feasible. Note: capabilities here are taken from the project README, haven't tested personally.
References: upstream repository Autumn-27/ARTEX, this English fork on GitHub, AegisHook for the approval component, ScopeSentry for asset collection.
🔹 ARTEX #tool #pentesting #LLM #AIAgents
🔗 Source: https://github.com/hasamba/ARTEX-EN