Automated Pentesting with AI and Python

### Overview In this presentation, David Vega, co-founder of the Colombian startup NES, introduces Triton, an in-house vulnerability scanner developed from scratch using Python. Developed in Bogotá over two years of research, Triton was built without relying on third-party scanning engines or APIs like Greenbone, Nessus, or Qualys. Vega explains the mission of NES to bridge the gap between infrastructure monitoring and cybersecurity auditing into a unified platform, arguing that from a user's perspective, system downtime and security incidents present the same operational impact.

### Key Topics - **Unified Monitoring and Auditing**: The relationship between NES (infrastructure monitoring) and Triton (cybersecurity auditing). - **Architecture of Triton**: Utilizing Python for the scanning engine and core logic, Django for the frontend, and PostgreSQL for the database. - **Scanning Capabilities**: Differentiating level-one external scanning (leveraging tools like Shodan) from the 100% Python-based LAN-level vulnerability scanner. - **Vulnerability Data Synchronization**: Mirroring and scraping data from the NVD (National Vulnerability Database), utilizing AI to normalize CVE/CWE entries, and automating software patching. - **Vibe Coding with AI**: Accelerating Python script development and tool prototyping using natural language prompts across various generative AI models.

### Technical Details Vega details the journey of dissecting how vulnerability scanners function, which required mastering standard classification schemes: Common Vulnerabilities and Exposures (CVE), Common Weakness Enumeration (CWE), Common Platform Enumeration (CPE), and the National Vulnerability Database (NVD). Triton identifies software-level vulnerabilities by evaluating installed software, determining its precise version, and cross-referencing this against CPE standards and NVD database records to flag outdated or vulnerable releases.

At the LAN level, the engine integrates CIS controls and is working toward PCI compliance, along with automated penetration testing workflows and software updating/patching capabilities. When asked about false positive mitigation during Q&A, Vega explained that they tackle software false positives by pulling authoritative software version lists directly from the endpoint OS (such as Microsoft on PCs) and comparing them strictly against mirrored NVD and CPE ground-truth records.

Regarding the development workflow referred to as "bycoding" (vibe coding), Vega discusses using natural language prompts to rapidly generate scripts, test them iteratively, and apply security validation to catch flaws. He shares tool-specific recommendations based on practical experience: - **Frontend Development**: Vercel's v0 (referred to as Veero / B0). - **Research and Reconnaissance**: Perplexity (highlighted for multi-source web access), DeepSeek, ChatGPT, and Gemini (noted for its large token context window). - **Backend Code Generation and Bug Fixing**: Claude, GitHub Copilot, and Gemini.

### Takeaways - Building an independent scanning engine requires deep alignment with standard vulnerability taxonomies (CVE, CWE, CPE, NVD) rather than simply running black-box tools. - Cybersecurity tooling can be developed effectively with pure Python and managed by small regional teams. - Security practitioners can streamline pen-testing tasks, report generation, and data normalization by identifying specific internal operational pains and iteratively writing automation scripts with current generative AI assistants.