Pentesting with an Agent
Made by AI agents — script drafted from the book, AI narration, animation written as code — and steered by the author, Rasmus Bornhøft Schlünsen.
What the film says
Your app is live. Within minutes of a server going online, bots start knocking on its doors. Most developers find their weak spots the hard way, after someone else does. In exercise six, you get there first: you attack your own app, before anyone else can.
But one rule comes before everything. Only test what you own, or what you have written permission to test. Never production, always a copy or a local instance. Pointing this at someone else's system is illegal almost everywhere. If in doubt, don't run it.
So you start with a practice target. OWASP Juice Shop is a pretend smoothie shop, built full of holes on purpose, running only on your own machine. Because its weaknesses are known, you can check whether your agents find the real ones.
Your pentester is Shannon, an open source tool that runs a whole team of security agents. One maps the app: its pages, forms and logins. One reads the source code, looking for risky patterns. Others try to prove each weakness is real, not just suspect it. When an attempt is blocked, they learn from it and adjust.
About an hour later, a reporting agent hands you a professional security report. Every finding has a severity score, the evidence, and how to fix it. And treat the report as untrusted too: it quotes what the app said back, so never let another agent run what it quotes.
Now it's your turn. Agents can report problems that aren't there, so check every critical finding yourself, using the steps in the report. If you can reproduce it, it's real. If not, note it and move on. Your judgment is what turns the agents' output into something you can act on.
Then fix what's broken. Keep user input out of your database queries, escape what you show on the page, verify every login token. Then scan again, to confirm each fix holds. Finally, point it at your own travel app. A simple static site gives attackers very little to grab.
You brought the target, the permission, and the judgment. The agents brought the probing, the proof, and the report. The stakes are higher now: a hole here means someone could steal your users' data. So describe, review, iterate, and understand enough to stay in control. Next up: exercise seven, testing as a safety net.