Skip to main content
The /pentest command starts a full blackbox penetration test of a running web application or API, identified by its URL. It needs no source code and no Symbiotic account. The command switches the agent into pentest (attack) mode, where the pentester agent collects the engagement details, checks authorization, and then runs the audit with the pentest tool set. The pentest plugin is enabled by default. Opt-out is documented in the plugin options.
Only run /pentest against systems you own or are explicitly authorized to test. The command asks for that authorization before it starts, and the agent refuses to continue if it is not given.

​
Usage

Run the command without arguments. The agent then collects the target and the engagement settings through the question tool. See Intake.
The help text documents /pentest <url>. The command template, however, tells the agent to collect the target from the operator and not to read it from the command arguments. In practice, the agent asks for the target even if you pass a URL. Enter the URL again when the intake question appears.
/normal only switches the agent back. It does not stop a run that is already in progress.

​
How it works

When you run /pentest, the following happens:
  1. The command is registered by the pentest plugin (commands.ts) and runs the pentester agent with a fixed prompt template (blackbox/command.ts).
  2. The agent calls the question tool once to collect the engagement details, and warns you that a full run can take tens of minutes and consume many requests and tokens. The run does not start until you confirm.
  3. The agent loads the blackbox-audit skill and runs the audit in phases, tracking progress with a live task list (todowrite).
  4. The agent submits validated findings with pentest_report and writes the report files to disk.

​
Intake

The agent asks the following questions in a single question call. You can type your own answer to any of them. If the scope answer is Not authorized, the agent stops and does not scan the target. After intake, the agent asks one follow-up question when authentication is needed:
  • Session cookie: the cookie as name=value, or the whole Cookie header if several are needed.
  • Bearer token in storage: the storage (localStorage or sessionStorage), the key, and the value.
  • Username and password: both values. The agent logs in through the browser using pentest_creds.
The agent also asks for the token refresh endpoint so that long runs do not lose the session. If you do not know it, the agent finds it by watching the login and token refresh network calls.

​
Scope

Every network tool takes a scope object built from the intake answers:
  • authorized: true is required. Nothing runs against a target without it.
  • allowHosts is empty by default, which means the target, its API, and its subdomains are in scope.
  • egress defaults to open, so SSRF can be proven. Set egress: "allowlist" to confine traffic to the listed hosts and to block internal address ranges.
  • rateLimit caps the combined request rate. Set it to false to run at full speed.
  • wordlist selects the ffuf wordlist: quick, thorough, or exhaustive.

​
Phases

The blackbox-audit skill drives the run through these phases:

​
Report

pentest_report writes the results to ~/.local/share/symbiotic/pentest/ by default. The data home can be changed with the PENTEST_DATA_DIR environment variable (or XDG_DATA_HOME), and the files go to <data home>/symbiotic/pentest/. Each run produces these files: Credentials are never written to the report.
A full run can take tens of minutes and make a large number of requests and model calls.