The all-in-one AI plugin for Penetration Testers

Skills for penetration testers 14

• penetration testerRuns a full engagement, for example scoping a 10-day external test then validating and reporting each finding.
• security pentest plannerTurns your codebase into pentest-plan.md, for example test cases for each API endpoint and auth check.
• security vulnerability assessment assistantPrioritizes vulnerabilities across code, network, and policy, for example a threat model for your customer portal.
• network security monitoring assistantReads pcap, flow, and log data to spot intrusions, for example flagging beaconing from an internal host.
• office suspicious emailChecks a reported email for phishing and scam signs, for example a fake invoice with a spoofed sender.
• security audit and review assistantDrafts audit and review reports, for example an access control review of your cloud admin roles.

Plus a start-here assistant, the prompt library and the app builder, and for members the daily brief.

Ready-made prompts 24

• Scoping And Planning3 prompts, like Draft Rules Of Engagement
• Recon And Scan Triage3 prompts, like Summarize Vulnerability Scan Results
• Web Application Testing3 prompts, like Map Web App Attack Surface
• Exploit Planning And Troubleshooting3 prompts, like Troubleshoot Exploit Failure From Error
• Phishing Simulation Support3 prompts, like Draft Authorized Phishing Simulation Email
• Log And Evidence Analysis3 prompts, like Summarize Security Logs For Anomalies
• Client Reporting And Communication3 prompts, like Write Executive Summary Of Findings

Apps you can build with AI 3

• Evidence-backed application vulnerability validation workbenchValidate each finding with evidence and a human decision, cutting unverified findings from your client report. Demo included.
• Source-linked autonomous web app bug testing consoleTest web app bugs with each result linked to source, so developers can fix fast and stay in control. Demo included.
• Permission test scenario studioTurn written permissions into allowed and denied test cases you can trace and reuse. Demo included.

AI agents 12

In the download. An agent runs a whole recurring task for you, step by step, and asks you before anything important. Ask your AI: "Run the Web Application Test Coverage Tracker Agent". Each one also has a guided set-up with sample data on its page.

• Web Application Test Coverage Tracker AgentA coverage matrix backed by evidence and a prioritized plan for the remaining testing
• Safe Proof-of-Concept Validation AgentA proof of concept that is shown to work in the lab and is safe to run against the client
• Engagement Cleanup and Artifact Removal AgentEvery item placed during the test is removed or confirmed removed, with a signed cleanup statement
• Critical Finding Escalation AgentCritical findings reach the client fast, with a tracked response and confirmed fix
• Attack Path Chaining AgentProven attack chains that show the real risk of combined findings
• Client Debrief and Lessons AgentClear lessons turned into approved checklist changes that the next engagement uses
• Audit Finding Fix Verification AgentProve each audit fix works and breaks nothing else, with evidence for the auditors
• Vulnerability Remediation Tracking AgentEvery important vulnerability fixed within policy deadlines and verified by rescan
• Engagement Scope Authorization AgentA verified target list where every item is covered by signed authorization
• Finding Verification and Dedupe AgentA deduplicated, evidence-backed findings list with false positives filtered out
• Pentest Report Drafting AgentA clear, consistent, evidence-backed report ready for the client
• Phishing Simulation Coordination AgentA safe, authorized awareness exercise that measures and improves staff resilience

Connections (MCP servers) 12

A guide in the download. A connection lets your AI work in an app you already use. You add only the ones you use: ask your AI "Which apps can you connect to?" and follow the steps on each connection's page.

• Shodan MCP serverLets your AI look up IP addresses, devices, DNS records and known security flaws using Shodan.
• Security Ops MCP serverLets your AI run common security scanning tools like Nmap, Nuclei and Subfinder for you from one place.
• rqwstr MCP serverLets your AI send and test web requests at a low level, for security checks and fuzzing.
• ZoomEye MCP serverLets your AI look up internet-connected devices and websites using ZoomEye search.
• ROADrecon MCP serverLets your AI read your ROADrecon Azure AD data and run security checks on it for you.
• Operant security testing MCP serverLets your AI run security checks like SQL injection tests, network capture analysis and memory forensics for you.
• Cybersec Toolkit MCP serverLets your AI find and run security tools for CTF, pentesting, bug bounty and DFIR work, under rules you set.
• mcp-recon MCP serverAsk your AI to check a website's status, headers, certificate, and network owner in plain words.
• NIST Vulnerability Database MCP serverLets your AI look up known software security flaws from the official NIST database.
• Wireshark MCP serverAsk your AI to read a network capture file and explain what happened inside it.
• Cybersecurity Recon MCP serverLets your AI look up domain details, scan ports, check certificates and known security issues for you.
• VirusTotal MCP serverLets your AI check links, files, IP addresses and domains for signs of malware or scams.

Your Grok Bot team 12

• Penetration TesterConduct authorized penetration tests to identify and validate exploitable vulnerabilities.
• Scanning ToolsGuide users through security scanning with Nmap, Nessus, Burp Suite, Aircrack-ng, and Prowler.
• Web Security TestingGuide structured OWASP Top 10 web application security assessments step by step.
• Windows Privilege EscalationGuide systematic Windows privilege escalation enumeration and exploitation.
• Linux Privilege EscalationGuide systematic Linux privilege escalation from low-privilege shell to root.
• Active Directory AttacksGuide authorized red teams through Active Directory attack techniques step by step.
• Sql Injection TestingTests web applications for SQL injection vulnerabilities and documents findings.
• Xss Html InjectionTest web apps for XSS and HTML injection with proof-of-concept payloads and severity reports.
• Metasploit FrameworkGuide penetration testing with Metasploit from reconnaissance to post-exploitation.
• Burp Suite TestingGuide web app security testing with Burp Suite proxy, repeater, and scanner.
• Wordpress Penetration TestingAssess WordPress sites for vulnerabilities and enumerate users, themes, plugins.
• Shodan ReconnaissanceSearch Shodan for exposed devices, services, and vulnerabilities on the internet.