Pen Test Agent Design

Design blueprint for a custom autonomous penetration testing agent targeting a Next.js + ECS Fargate + ALB + Neon stack. Synthesized from AWS Security Agent…

Pen Test Agent Design

Design blueprint for a custom autonomous penetration testing agent targeting a Next.js + ECS Fargate + ALB + Neon stack. Synthesized from AWS Security Agent patterns and PentAGI architecture. Implemented in repo: ~/repos/pentest-agent.

Target Stack

Layer	Technology	Key Attack Surface
App	Next.js (ECR → ECS Fargate)	OWASP Top 10, API routes, /_next/ exposure
Ingress	ALB (no CloudFront)	No WAF, security group misconfig, HTTP headers
Database	Neon (serverless Postgres)	SQL injection via app layer
DNS	Namecheap	Subdomain takeover, SPF/DKIM/DMARC
Infra	AWS (ECS, ECR, IAM)	Overpermissioned task roles, image CVEs

Notable gap: no CloudFront/WAF — highest-priority finding before agent runs.

Agent Architecture

Loop: Plan → Probe → Report

Supervisor + Specialists:

supervisor
├── recon-agent      # nmap, DNS, TLS (testssl), tech fingerprint
├── web-agent        # nuclei, security headers, Next.js surface
└── db-agent         # sqlmap against discovered endpoints

Per Agent Harness: state lives in shared filesystem (reports/), not agent memory. Each specialist writes findings to reports/findings-<phase>.json. Supervisor synthesizes.

Domain Scope Model (from AWS Security Agent)

Three categories — never conflate:

Category	Definition	Example
Target	Actively probed for vulns	yourdomain.com, ALB DNS
Accessible	Can navigate through, NOT attacked	Neon dashboard, Namecheap, OAuth providers
Out-of-scope	Fully excluded	/api/admin/delete, /api/reset

This is a hard constraint in config/config.yaml. Any tool call targeting outside the target allowlist is rejected before execution.

Safety Constraints (Always-On)

1. Scope lock: allowlist enforced per tool call
2. Rate cap: 10 rps default; agent cannot override
3. Read-only by default: POST/PUT/DELETE to data-mutating endpoints requires explicit destructive: true flag in tool schema
4. Test account only: dedicated TEST_USERNAME + TEST_PASSWORD env vars; real account never used

Two Phases

Phase 1 — Black-Box (HTTP surface)

No AWS credentials required. Simulates external attacker.

Tools:

• nmap: port/service scan of ALB
• testssl.sh: TLS config, cipher suite, HSTS
• nuclei: template-based web vuln scan (CVEs, misconfigs, exposures)
• Custom HTTP probes: security headers, Next.js-specific paths (/_next/static, /api/* enumeration), CORS config
• sqlmap: SQL injection against discovered form/API endpoints

Phase 2 — Gray-Box (AWS config inspection)

Requires read-only AWS credentials. Inspects infrastructure layer.

Tools:

• Prowler: IAM misconfig, security group open ports, CloudTrail gaps, S3 public access
• Trivy: ECR image CVE scan
• boto3: ECS task definition env vars (secrets in plaintext?), security group rules

Auth Flow

Agent authenticates with test account at session start:

1. POST to login endpoint with TEST_USERNAME / TEST_PASSWORD
2. Extract session cookie or JWT from response
3. Inject into all subsequent requests via Authorization / Cookie header
4. Test account has real-user permissions, isolated data

Multiple credential sets for role-based testing (user vs. admin if applicable).

Tool Implementation Pattern

Each CLI wrapper follows this interface:

def run_<tool>(target: str, options: dict) -> dict:
    # 1. Validate target is in scope allowlist
    # 2. Check rate limiter
    # 3. subprocess.run(cmd, capture_output=True, timeout=300)
    # 4. Parse output → structured dict
    # 5. Return {tool, target, findings: [...], raw: str}

Error messages written as agent recovery instructions (what failed, correct usage, retry guidance). Per Tool Design for Agents.

Output

• reports/findings.json: structured {vuln, severity, endpoint, evidence, remediation}
• reports/report.md: human-readable, generated from findings.json
• report.md ingested into wiki as wiki/summaries/pentest-YYYY-MM-DD.md
• Diff against previous findings.json on subsequent runs

Progressive Deployment

Phase	Where runs	Trigger
v1	Local machine	Manual
v2	EC2 (same region as target)	Manual or scheduled
v3	GitHub Actions	Cron + PR gate

Key Patterns Borrowed

• Scope split (target/accessible/out-of-scope): from Aws Security Agent
• Flow → Task → SubTask hierarchy: from PentAGI
• Chain summarization for long scans: from PentAGI — implement if web-agent context fills during nuclei scan
• Shared filesystem state: from Agent Harness

Related Pages

• Aws Security Agent — managed AWS pen test service; scope control reference
• PentAGI — OSS autonomous pen test system; architecture reference
• Agent Harness — supervisor pattern used here
• OWASP Security Checklist — vuln categories the agent tests against
• Tool Design for Agents — error message design for CLI wrappers