Pentest Genie isn't a vertical-specific tool. The same loop runs against a bug bounty program, a pre-prod release, and a SOC-2 evidence gather — the difference is mode, scope, and what artifact you ship at the end.
Each audience uses a different mode, a different scope shape, and a different export format. The agent doesn't change — what you give it and what you take from it does.
The agent finds the vuln, reproduces it, captures the evidence, and exports a submission-ready report. You hit submit. Get paid faster.
Stop spending Tuesday afternoon running subfinder. The agent handles recon, hypothesis, and first-stage exploitation autonomously — you take the wheel for the part that needs you.
A manual pentest is a photograph. Your apps need a video. Run the agent on every release, every PR, every feature flag flip — cost-capped so it scales with you.
Annual pentests go stale by day 30. The agent gives you scan artifacts that auditors actually look at — payloads, evidence, timestamps, full reproducibility.
Every chain is hardcoded to a set of CWE IDs in `exploit_template_engine.py`. When the agent recognises a class, it pivots into the matching chain — not into a generic LLM probe. Exploitation is predictable, auditable, and mapped to OWASP Top-10 2021.
CWE IDs → 14 chains → 10 OWASP categories
2 chains
idor_to_exfillfi_to_rce1 chain
race_condition6 chains
sqli_to_credscmdi_to_rcessti_to_rcexxe_to_lfixss_to_impactnosql_injection1 chain
upload_to_rce2 chains
auth_bypass_to_adminjwt_bypass1 chain
deserialization_rce1 chain
ssrf_to_cloudSource: `exploit_template_engine.py` lines 39–114. Mapping versioned with the dispatch.
One agent, three operating profiles. Mode controls request rate, evasion, and concurrency — not what gets tested.
Low-rate, jittered, evasive. For environments where you don't want WAFs lighting up or SOC pages firing. Best for red-team engagements that simulate a careful attacker.
Default profile. Moderate concurrency, standard rate limits. The right mode for bug bounty hunting and pre-production AppSec scans.
High concurrency, full toolkit, broad fuzzing. Use when you control the target and the goal is to surface everything quickly — internal staging, compliance evidence gather, or pre-launch.
Reports are not afterthoughts. Every scan produces multiple export formats, plus the raw evidence that backs each finding.
Structured findings, evidence refs, full telemetry
Dark-themed interactive report with collapsible evidence
Print-ready for compliance distribution
Markdown formatted for HackerOne submission
Markdown formatted for Bugcrowd submission
PoC scripts
Custom Python that reproduces each finding end-to-end
Payload log
Every payload sent, every response received, indexed by finding
OOB receipts
Interactsh callback logs proving blind classes
Browser frames
Screenshots from Browserbase confirming DOM-level execution
Event stream
20-event-type WebSocket log replayable from disk
Cost ledger
Token usage and dollar cost per agent, per step
We'll match you to the right mode, scope, and export format — and get you running against your first target.