Abstract
Artificial Intelligence (AI) technologies have been experiencing rapid developments and applications in various fields including Cybersecurity to improve efficiency, productivity, and accuracy. Penetration testing (pentesting) is a critical step in cyber defense to utilize authorized offensive tools and simulated attacks to uncover security vulnerabilities to be used for cybersecurity risk assessment and mitigation. Pentesting steps often include reconnaissance, scanning, knowledge discovery, data analysis, and queries of large amounts of information to detect meaningful threats and vulnerabilities, which could use the help of interactive AI tools, such as ChatGPT. However, AI tools like ChatGPT are still evolving with limitations and challenges for applications. This study conducts simulation tests based on a limited AI-Assisted pentesting model for security knowledge discovery using interactive ChatGPT-4 powered by Large Language Models (LLMs). The purpose of this research is to discover and demonstrate the role and value of AI in planning and conducting pentesting. This study utilizes a VMWare-based network of virtual machines for simulated network attacks and ChatGPT-4 for training and answering prompts on pentesting questions of interest. This research will also discuss limitations of using AI technologies in pentesting and suggestions for the future.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
D.N. Railkar, S. Joshi, A comprehensive literature review of artificial intelligence in the field of penetration testing, in Intelligent Systems and Applications, Lecture Notes in Electrical Engineering, ed. by A.J. Kulkarni et al., vol. 959, (2023), pp. 75–85. https://doi.org/10.1007/978-981-19-6581-4_7
P. Wang, H. D’Cruze, Lessons on the power of knowledge for cyber defense from Sun Tzu’s the Art of War. Issues Inf. Syst. 21(3), 105–116 (2020)
M. Dsouza, How artificial intelligence can improve pentesting (2018). Available: https://hub.packtpub.com/how-artificial-intelligence-can-improve-pentesting/
A. Mamgai, Generative AI with cybersecurity: Friend or foe of digital transformation? (2023). Available: https://www.isaca.org/resources/news-and-trends/industry-news/2023/generative-ai-with-cybersecurity-friend-or-foe-of-digital-transformation
A. Happe, J. Cito, Getting pawn’d by AI: Penetration testing with Large Language Models, in ESEC/FSE ‘23, San Francisco, CA, USA, 3–9 Dec 2023 (2023)
G. Deng, et al., PENTESTGPT: An LLM-empowered automatic penetration testing tool (2023). Available: https://doi.org/10.48550/arXiv.2308.06782
B. Schneier, The coming AI hackers, in The Cyber Projecct: Council for the Responsible Use of AI, (Harvard Kennedy School, 2021)
R. Kaur, D. Gabrijelcic, T. Klobucar, Artificial intelligence for cybersecurity: Literature review and future research directions. Inf. Fusion 97, 1–29 (2023)., 101804
A. Froehlich, AI pen testing promises, delivers both speed and accuracy (2020). Available: https://www.techtarget.com/searchsecurity/tip/AI-pen-testing-promises-delivers-both-speed-and-accuracy
J. Pope, Human vs AI in pen testing (2023). Available: https://cybersmartconsulting.com/ai-in-pen-testing/
M. Gupta, K. Aryal, L. Praharaj, From ChatGPT to ThreatGPT: Impact of generative AI in cybersecurity and privacy. IEEE Access 11(2023), 80218–80245 (2023)
S. Temara, Maximizing penetration testing success with effective reconnaissance techniques using ChatGPT. Res. Sq., 1–10 (2023). https://doi.org/10.21203/rs.3.rs-2707376/v1
S. Wilson, Cybersecurity and Artificial Intelligence: Threats and Opportunities (Contrast Security, 2023)
M. Al-Hawawreh, A. Aljuhani, Y. Jararweh, Chatgpt for cybersecurity: Practical applications, challenges, and future directions. Clust. Comput. 2023(26), 3421–3436 (2023)
X. Zhan, Y. Xu, S. Sarkadi, Deceptive AI ecosystems: The case of ChatGPT, in ACM Conference on Conversational User Interfaces (CUI ‘23), Eindhoven, Netherlands, 19–21 July 2023 (2023)
CYFIRMA, ChatGPT AI in security tessting: Opportunities and challenges (2023). https://www.cyfirma.com/outofband/chatgpt-ai-in-security-testing-opportunities-and-challenges/
OpenAI, GPT-4 (2023). Available: https://openai.com/research/gpt-4
OpenAI, GPT-4 Technical Report (2023). Available: https://arxiv.org/abs/2303.08774
J. Liu, Welcome to LlamaIndex (2022). Available: https://gpt-index.readthedocs.io/en/stable/
J. Liu, Simple Directory Reader (2022). Available: https://gpt-index.readthedocs.io/en/latest/examples/data_connectors/simple_directory_reader.html
LangChain, Inc., LangChain – Introduction (2023). Available: https://python.langchain.com/docs/get_started/introduction
J. Liu, PromptHelper (2022). Available: https://gpt-index.readthedocs.io/en/latest/api_reference/service_context/prompt_helper.html
NMAP.ORG, Nmap: Discover your network (2023). Available: https://nmap.org/
WIRESHARK.ORG, About Wireshark (2023). Available: https://www.wireshark.org/about.html
VulnHub, BWAPP: BEE-BOX (v1.6) (2023). Available: https://www.vulnhub.com/entry/bwapp-bee-box-v16,53/
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2024 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this paper
Cite this paper
Wang, P., D’Cruze, H. (2024). AI-Assisted Pentesting Using ChatGPT-4. In: Latifi, S. (eds) ITNG 2024: 21st International Conference on Information Technology-New Generations. ITNG 2024. Advances in Intelligent Systems and Computing, vol 1456. Springer, Cham. https://doi.org/10.1007/978-3-031-56599-1_9
Download citation
DOI: https://doi.org/10.1007/978-3-031-56599-1_9
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-56598-4
Online ISBN: 978-3-031-56599-1
eBook Packages: EngineeringEngineering (R0)