Pentesting with an Agent
Attack your own app before anyone else does
Overview
Your app is live. It works. But does it hold up? Every application on the internet gets probed — bots scan for open ports within minutes of a server going live, and attackers look for the usual suspects: injection, broken authentication, exposed admin panels.
You'll attack your own application before anyone else does, using Shannon — an open-source (AGPL) AI pentesting agent. It maps the target, reads its source, attempts to confirm each vulnerability by exploiting it, and writes a professional report. You only ever point it at an app you own, never at production.
Shannon actively executes attacks against its target. It sends real payloads and attempts real exploits. You must only run it against applications you own or have explicit written authorisation to test, and never against production. Running it against someone else's system is illegal in most jurisdictions.
— from the exercise
By the end of this exercise.
- ✓OWASP Juice Shop running locally as a practice target (Docker, bound to localhost)
- ✓Shannon set up via npx @keygraph/shannon, with your provider's cyber-safeguards verification done first
- ✓A full autonomous scan: reconnaissance, source-code analysis, exploitation and validation, reporting
- ✓A security report (Markdown, PDF, JSON, SARIF) with CVSS scores, CWE IDs and remediation guidance
- ✓Critical findings verified by hand — false positives weeded out
- ✓An understanding of why the scanned app and the report are untrusted input to any agent
Terms you'll learn.
- SQL injection
- Attacker sends database commands through input fields to extract or modify data
- XSS
- Cross-site scripting — injecting JavaScript that runs in other users' browsers
- Authentication bypass
- Exploiting flaws to log in without valid credentials
- IDOR
- Insecure Direct Object Reference — accessing another user's data by changing an ID
- CVSS score
- Common Vulnerability Scoring System — rates severity from 0 (none) to 10 (critical)
- False positive
- A reported vulnerability that doesn't actually exist — always verify findings
- Untrusted input
- Everything the agent reads — pages, source, the report itself — can try to steer it
Sections in this exercise.
- 01What You'll Build
- 02What You'll Need
- 03Why Pentest Your Own App?
- 04Set Up a Practice Target
- 05Set Up Shannon
- 06Run Your First Scan
- 07Read the Report
- 08Understanding the Findings
- 09The Exploitation Feedback Loop
- 10Scan Your Own App
- 11Fitting It Into a Pipeline
- 12Watching It Work
You flipped the script — attacking your own application before anyone else could. AI agents mapped the attack surface, tried to prove each vulnerability, and wrote the report; you verified the findings and treated everything the agents read and wrote as untrusted. You now understand the attack surface of every web app you build.