Agent Zero for Ethical Hacking
Hi everyone! I am a cybersecurity professional and have been messing around with using Agent Zero as an automated penetration testing agent since Agent Zero was merged with the hacking edition. I am testing against the intentionally vulnerable OWASP Juice Shop web application which is also running in docker). After learning docker concepts, then Agent Zero concepts, I was able to push Agent Zero pretty far in solving Juice Shop challenges. However, the sequential nature of Juice Shop challenge solving was taking a long time and thus I started looking into using subordinate agents for each challenge (with custom profiles for each, pentestmanager, reconspecialist, pentester). Alas, Agent Zero is not architected to support simultaneous agent swarms at this point. I then pivoted to a custom single agent using the Task Scheduler to create simultaneously executing tasks (using TaskType.AD_HOC, and then run_task with dedicated_context=true) and this appears to be working well so far. I also went to through the journey of attempting to use local LLMs via LM Studio before finally listening to folks here and instead using free LLMs on OpenRouter (currently using Chimera). I still hold hope that I can self-host a ridiculously large opensource LLM, in a private cloud if needed. Abliterated LLMs are particularly useful for ethical hacking and local LLMs are useful for sandboxing cyberlab activities when commercial LLM decline actions. However, there does not appear to be an Agent Zero setting (evironment variable or setting dialog) to adjust LLM timeout value, and slow LLM responses invariably lead to timeout errors. It would be fun to develop the solution to the point where it can target any cyber range system (e.g. infrastructure, edge device) and the agent follows industry penetration testing framework stages and actions from PTES (Penetration Testing Execution Standard), NIST SP 800-115, and OSSTMM, etc.