AI workbench

Pentestas is not "a scanner plus a chat box." In + AI assist (hybrid) mode, the autonomous agent investigates high-value leads with the same workbench the scan detail page exposes to humans.

Human and AI share one timeline of requests. Anything the agent sends through Forge/Volley/OAST shows up in HTTP history next to crawler and verifier traffic.

Why this exists

Older agent designs called parallel exploit modules (run_sqli, …) that never touched the operator UI. That produced two timelines: what you saw in the tabs, and what the model actually did.

The workbench bridge fixes that. Prefer:

Read history — what already happened against this host.
Mutate in Forge — one custom request.
Fan out with Volley — payload sets at {{pos}} markers.
Confirm blind issues with OAST.
Pivot to Entra/Azure recon or AWS when the domain and credentials warrant it.
Report only with proof.

Tools the agent can use

Agent tool	UI tab equivalent	What it does
`history_search` / `history_get`	HTTP history	Search / fetch captured request–response pairs for this scan
`sitemap_list`	Site map	Tree of hosts/paths from real traffic
`repeater_send`	Forge	Craft and send a single request (auth + agent proxy preserved)
`intruder_run`	Volley	Template with `{{name}}` insertion points, payload sets, attack modes, optional grep
`oast_mint` / `oast_poll`	OAST	Allocate a callback URL and poll DNS/HTTP hits
`surface_status`	—	Which cloud pivots are available for this scan
`pivot_azure_recon`	Azure black-box	Domain-only Entra/Azure recon (no password spray)
`pivot_aws_audit`	AWS audit	Runs only when AWS keys/role are already on the scan

Classic module tools (run_sqli, run_xss, …) remain available when a structured module is the right next step; workbench tools are preferred for investigation.

When the workbench phase runs

On hybrid scans with an LLM configured:

Heuristic modules finish (crawl + detectors + verifiers).
If there are HIGH / CRITICAL leads (or an operator hint forces workbench), the engine starts a workbench agent phase.
Claude investigates within a bounded turn budget, writing findings only when evidence supports them.
AI analysis / attack-chain synthesis still run as usual for narratives and chains.

Pure Internal Engine mode skips the workbench agent phase. You can still use all tabs manually.

Intruder (Volley) from the agent

The agent’s Intruder mirrors the Volley tab:

Template may be a raw HTTP block or URL + method + body.
Insertion points: {{pos}}, {{user}}, etc.
Modes: single / sniper, mirror / battering-ram, lockstep / pitchfork, combo / cluster-bomb.
Hard caps protect the target (payloads per set and total combinations are server-limited).
Results include status, length, timing, grep hits, and body snippets — the same signals you sort in the UI.

Multi-surface pivots

A web engagement often warrants a look at the target’s cloud identity surface. From the agent (or via multi-surface pivot):

Azure black-box recon — public domain only; federation, tenant ID, service fingerprints. Explicitly recon_only (no spray, no MFA hammering).
AWS audit — only if the scan already has AWS credentials in cloud_config.
Google Workspace — only with a configured service account on the scan.

surface_status returns which of these are available so the agent does not invent credentials.

Shared auth and scope

Workbench sends use the scan’s HTTP client:

Same cookies / tokens / auto-relogin as the crawler.
Same out-of-scope rejection (hosts outside allowed domains → blocked).
Same agent path for internal targets.

Operator control

You can force a workbench investigation mid-scan with an operator hint:

workbench: true
focus: /admin/
retest: SQLI @ /vulnerabilities/sqli/