[{"data":1,"prerenderedAt":421},["ShallowReactive",2],{"announcement":3,"i-tabler:sun":11,"i-tabler:moon":16,"i-tabler:menu-2":18,"i-tabler:x":20,"i-simple-icons:youtube":22,"i-simple-icons:github":24,"i-simple-icons:x":26,"i-simple-icons:linkedin":28,"i-tabler:arrow-up-right":31,"post-i-let-ai-run-my-recon-heres-what-it-found":33,"post-nav-i-let-ai-run-my-recon-heres-what-it-found":398,"video-i-let-ai-run-my-recon-heres-what-it-found":410,"i-tabler:copy":419},{"startsAt":4,"endsAt":5,"scramble":6,"cta":7,"message":10},"2026-10-13","2026-11-30","Cache Poisoning:",{"href":8,"label":9},"\u002Fcache-poisoning-the-cache-you-cant-purge","Read it","The cache you can't purge.",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":15},0,24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":17},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":19},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":21},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":23},"\u003Cpath fill=\"currentColor\" d=\"M23.498 6.186a3.02 3.02 0 0 0-2.122-2.136C19.505 3.545 12 3.545 12 3.545s-7.505 0-9.377.505A3.02 3.02 0 0 0 .502 6.186C0 8.07 0 12 0 12s0 3.93.502 5.814a3.02 3.02 0 0 0 2.122 2.136c1.871.505 9.376.505 9.376.505s7.505 0 9.377-.505a3.02 3.02 0 0 0 2.122-2.136C24 15.93 24 12 24 12s0-3.93-.502-5.814M9.545 15.568V8.432L15.818 12z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":25},"\u003Cpath fill=\"currentColor\" d=\"M12 .297c-6.63 0-12 5.373-12 12c0 5.303 3.438 9.8 8.205 11.385c.6.113.82-.258.82-.577c0-.285-.01-1.04-.015-2.04c-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729c1.205.084 1.838 1.236 1.838 1.236c1.07 1.835 2.809 1.305 3.495.998c.108-.776.417-1.305.76-1.605c-2.665-.3-5.466-1.332-5.466-5.93c0-1.31.465-2.38 1.235-3.22c-.135-.303-.54-1.523.105-3.176c0 0 1.005-.322 3.3 1.23c.96-.267 1.98-.399 3-.405c1.02.006 2.04.138 3 .405c2.28-1.552 3.285-1.23 3.285-1.23c.645 1.653.24 2.873.12 3.176c.765.84 1.23 1.91 1.23 3.22c0 4.61-2.805 5.625-5.475 5.92c.42.36.81 1.096.81 2.22c0 1.606-.015 2.896-.015 3.286c0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":27},"\u003Cpath fill=\"currentColor\" d=\"M14.234 10.162L22.977 0h-2.072l-7.591 8.824L7.251 0H.258l9.168 13.343L.258 24H2.33l8.016-9.318L16.749 24h6.993zm-2.837 3.299l-.929-1.329L3.076 1.56h3.182l5.965 8.532l.929 1.329l7.754 11.09h-3.182z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":29,"hidden":30},"\u003Cpath fill=\"currentColor\" d=\"M20.447 20.452h-3.554v-5.569c0-1.328-.027-3.037-1.852-3.037c-1.853 0-2.136 1.445-2.136 2.939v5.667H9.351V9h3.414v1.561h.046c.477-.9 1.637-1.85 3.37-1.85c3.601 0 4.267 2.37 4.267 5.455v6.286zM5.337 7.433a2.06 2.06 0 0 1-2.063-2.065a2.064 2.064 0 1 1 2.063 2.065m1.782 13.019H3.555V9h3.564zM22.225 0H1.771C.792 0 0 .774 0 1.729v20.542C0 23.227.792 24 1.771 24h20.451C23.2 24 24 23.227 24 22.271V1.729C24 .774 23.2 0 22.222 0z\"\u002F>",true,{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":32},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M17 7L7 17M8 7h9v9\"\u002F>",{"id":34,"title":35,"body":36,"categories":384,"coverImage":388,"date":389,"description":390,"draft":14,"extension":391,"meta":392,"navigation":30,"noindex":14,"path":393,"readingTime":394,"seo":395,"slug":396,"stem":396,"updatedAt":394,"youtubeId":42,"__hash__":397},"blog\u002Fi-let-ai-run-my-recon-heres-what-it-found.md","I Let AI Run My Recon Here's What It Found.",{"type":37,"value":38,"toc":376},"minimark",[39,43,47,50,53,66,74,79,85,88,95,98,102,105,108,188,191,208,226,233,244,251,254,258,265,268,271,274,277,280,284,294,297,303,309,315,321,327,330,334,337,340,347,350,353,356,360,363,369,372],[40,41],"post-media",{"video":42},"FRCigcjRO8c",[44,45,46],"p",{},"Every new target starts the same way. You get invited to a program, open the scope, and the attack surface is massive. Subdomains, APIs, login forms, admin panels, forgotten endpoints. All of it needs to be mapped before you can even start looking for bugs.",[44,48,49],{},"That is the recon phase. And it eats time. You run subdomain enumeration, fingerprint services, check for misconfigurations, and validate every finding one by one. An hour or two goes by. You have not started hunting yet, and you are already drained.",[44,51,52],{},"So I wanted to test something. What if a tool handled that entire baseline for you? Mapped the surface, ran the common checks, validated what it found, and handed you a clean report before you even opened Burp.",[44,54,55,56,65],{},"I pointed ",[57,58,64],"a",{"href":59,"rel":60,"target":63},"https:\u002F\u002Fpenligent.ai\u002F?utm_source=amrelsagaei.com&utm_id=AmrSecOfficial",[61,62],"noopener","noreferrer","_blank","Penligent"," at a target and let it do the work. This article covers what the tool is, how to install it, what the report looks like, and where it fits in a real hunting workflow. The full live demo is in the video. Here, you get all the details you need to set it up and try it yourself.",[67,68,71],"sponsor",{"cta":69,"href":59,"logo":70,"name":64},"Try Penligent","penligent",[44,72,73],{},"Penligent is the AI-powered testing tool this article walks through. You give it a target and it runs the recon, fingerprints the services, checks for common vulnerabilities, validates what it finds, and exports the report.",[75,76,78],"h2",{"id":77},"what-is-penligent","What Is Penligent",[44,80,81,84],{},[57,82,64],{"href":59,"rel":83,"target":63},[61,62]," is an AI-powered security testing tool. You give it a target, and it runs through the recon and vulnerability assessment process on its own. It identifies services, fingerprints technologies, checks for common vulnerabilities, validates what it finds, and puts everything into a report you can export.",[44,86,87],{},"The interface uses natural language and point-and-click controls. You do not need to memorize flags or build command chains from scratch. You tell it what to test, and it handles the execution.",[44,89,90,91,94],{},"What makes it interesting is how it chains things together. When one scan returns results, ",[57,92,64],{"href":59,"rel":93,"target":63},[61,62]," decides what to run next based on those results. If it fingerprints a specific framework, it pulls checks for that framework. If it finds an open service, it digs deeper into that service. It is not running a static checklist. It adapts as it goes.",[44,96,97],{},"Now, to be clear. This is not the tool that finds complex business logic bugs. That takes manual testing, creativity, and experience. But the baseline work? The recon, the service enumeration, the common vulnerability checks? That is exactly what Penligent handles. It takes the repetitive part of your workflow and compresses it so you can get to the real hunting faster.",[75,99,101],{"id":100},"installation","Installation",[44,103,104],{},"You need two things. A Kali machine (physical or VM, does not matter) and a target to test against.",[44,106,107],{},"If you are running a fresh Kali install, get the base tooling ready first:",[109,110,115],"pre",{"code":111,"language":112,"meta":113,"className":114,"style":113},"sudo su\napt update && apt upgrade -y\napt install golang\ngo install -v github.com\u002Fprojectdiscovery\u002Fpdtm\u002Fcmd\u002Fpdtm@latest\npdtm -ia\n","bash","","shiki shiki-themes vitesse-dark vitesse-light",[116,117,118,131,154,165,179],"code",{},[119,120,123,127],"span",{"class":121,"line":122},"line",1,[119,124,126],{"class":125},"swzfi","sudo",[119,128,130],{"class":129},"sRRDT"," su\n",[119,132,134,137,140,144,147,150],{"class":121,"line":133},2,[119,135,136],{"class":125},"apt",[119,138,139],{"class":129}," update",[119,141,143],{"class":142},"somML"," &&",[119,145,146],{"class":125}," apt",[119,148,149],{"class":129}," upgrade",[119,151,153],{"class":152},"se4ZP"," -y\n",[119,155,157,159,162],{"class":121,"line":156},3,[119,158,136],{"class":125},[119,160,161],{"class":129}," install",[119,163,164],{"class":129}," golang\n",[119,166,168,171,173,176],{"class":121,"line":167},4,[119,169,170],{"class":125},"go",[119,172,161],{"class":129},[119,174,175],{"class":152}," -v",[119,177,178],{"class":129}," github.com\u002Fprojectdiscovery\u002Fpdtm\u002Fcmd\u002Fpdtm@latest\n",[119,180,182,185],{"class":121,"line":181},5,[119,183,184],{"class":125},"pdtm",[119,186,187],{"class":152}," -ia\n",[44,189,190],{},"That installs Go, the ProjectDiscovery tool manager, and pulls in the full toolkit. Subfinder, httpx, nuclei, all of it. Having these available gives Penligent more to work with during scans.",[44,192,193,194,198,199,203,204,207],{},"Now grab Penligent itself. Go to ",[57,195,197],{"href":59,"rel":196,"target":63},[61,62],"penligent.ai",", click ",[200,201,202],"strong",{},"Download",", and save the ",[116,205,206],{},".deb"," package. Then install it:",[109,209,211],{"code":210,"language":112,"meta":113,"className":114,"style":113},"sudo dpkg -i penligent-xxx.deb\n",[116,212,213],{},[119,214,215,217,220,223],{"class":121,"line":122},[119,216,126],{"class":125},[119,218,219],{"class":129}," dpkg",[119,221,222],{"class":152}," -i",[119,224,225],{"class":129}," penligent-xxx.deb\n",[44,227,228,229,232],{},"Replace ",[116,230,231],{},"penligent-xxx.deb"," with the actual filename you downloaded. That is the entire installation.",[44,234,235,236,239,240,243],{},"Open the application. Top-right corner, click ",[200,237,238],{},"Sign In",". If you do not have an account yet, register on the ",[57,241,64],{"href":59,"rel":242,"target":63},[61,62]," site first.",[44,245,246,247,250],{},"One optional step. If you want Penligent to generate and run Python scripts during testing, go to ",[200,248,249],{},"Settings"," and configure your Python environment. You can skip this for now and set it up later.",[44,252,253],{},"The whole setup takes about two minutes.",[75,255,257],{"id":256},"how-a-scan-works","How a Scan Works",[44,259,260,261,264],{},"Click ",[200,262,263],{},"Create Project"," in the top-left corner. Enter your target domain or IP. Hit start.",[44,266,267],{},"Penligent begins with recon. It identifies what services are running, what ports are open, and what technologies sit behind each one. Once it has that picture, it moves into vulnerability checks. It probes endpoints, tests input fields, and checks for common misconfigurations.",[44,269,270],{},"Here is the important part. When it flags something, it does not just log it and move on. It validates. It sends test payloads, reads the responses, and checks whether the issue is actually exploitable or just a false positive. If the finding holds up, it documents the proof and moves to the next check.",[44,272,273],{},"It also checks for outdated components and cross-references them against known CVEs. When it finds a match, it tests whether the exploit actually applies to the version running on your target. Not just a version number match. An actual exploitability check.",[44,275,276],{},"The whole process takes about 30 minutes for a standard target. At the end, you have a mapped attack surface with validated findings ready to review.",[44,278,279],{},"The full walkthrough of this running against OWASP Juice Shop is in the video.",[75,281,283],{"id":282},"the-report","The Report",[44,285,260,286,289,290,293],{},[200,287,288],{},"Export Report"," and ",[57,291,64],{"href":59,"rel":292,"target":63},[61,62]," generates a full structured document.",[44,295,296],{},"The report includes five sections:",[44,298,299,302],{},[200,300,301],{},"Executive summary."," A high-level overview of what was tested and what was found. Good for getting oriented quickly or briefing a team.",[44,304,305,308],{},[200,306,307],{},"Detailed findings."," Each vulnerability listed with a severity rating. No raw scan output. Clean and categorized.",[44,310,311,314],{},[200,312,313],{},"Reproduction steps."," Step-by-step instructions for reproducing each finding. This saves you real time when writing your own bug bounty reports. The reproduction path is already laid out.",[44,316,317,320],{},[200,318,319],{},"Proof of concept."," Evidence for each confirmed vulnerability. Response data, screenshots, whatever Penligent captured during validation.",[44,322,323,326],{},[200,324,325],{},"Remediation recommendations."," Suggested fixes for each issue. More relevant for consulting work, but also useful for understanding the nature of each finding.",[44,328,329],{},"This is not raw tool output you need to clean up. It is a finished document you can actually use. Reference it when writing HackerOne reports, hand it to a client, or use it as your checklist for what to investigate manually.",[75,331,333],{"id":332},"where-this-fits-in-your-workflow","Where This Fits in Your Workflow",[44,335,336],{},"Here is the honest take.",[44,338,339],{},"Without a tool like this, your workflow looks like this. You get a target. You spend an hour or two running recon tools manually. Subdomain enumeration, port scanning, tech fingerprinting, basic vulnerability checks. You chain everything together yourself. By the time you are done, you are already tired and you have not started the real testing yet.",[44,341,342,343,346],{},"With ",[57,344,64],{"href":59,"rel":345,"target":63},[61,62],", you point it at the target and let it handle that baseline. You get a report showing what is exposed, what services are running, and what has known issues. Then you start your manual testing fresh. Focused on the things automation cannot find. Business logic flaws. Access control gaps. The edge cases that only a human catches.",[44,348,349],{},"That is the split. Penligent does the mapping. You do the hunting.",[44,351,352],{},"It also handles more than just surface-level scanning. The validation, the dynamic chaining, the CVE checks. It goes deeper than a basic port scan. It is not going to replace your instincts on a target. But it earns its place by handling the repetitive work well, so your energy goes where it actually matters.",[44,354,355],{},"If you have been running the same recon chain manually on every new target, this saves you that time.",[75,357,359],{"id":358},"conclusion","Conclusion",[44,361,362],{},"Recon is not optional. You need the map before you hunt. But building that map yourself on every single target is not the best use of your time.",[44,364,365,368],{},[57,366,64],{"href":59,"rel":367,"target":63},[61,62]," builds it for you. Install it, point it at your scope, and walk into the target already knowing what is there. Then focus on the work that actually needs you. The logic testing. The chaining. The bugs that no scanner catches.",[44,370,371],{},"Your time is the most valuable thing in your workflow. Spend it on hunting.",[373,374,375],"style",{},"html pre.shiki code .swzfi, html code.shiki .swzfi{--shiki-default:#80A665;--shiki-light:#59873A}html pre.shiki code .sRRDT, html code.shiki .sRRDT{--shiki-default:#C98A7D;--shiki-light:#B56959}html pre.shiki code .somML, html code.shiki .somML{--shiki-default:#666666;--shiki-light:#999999}html pre.shiki code .se4ZP, html code.shiki .se4ZP{--shiki-default:#C99076;--shiki-light:#A65E2B}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}",{"title":113,"searchDepth":156,"depth":156,"links":377},[378,379,380,381,382,383],{"id":77,"depth":133,"text":78},{"id":100,"depth":133,"text":101},{"id":256,"depth":133,"text":257},{"id":282,"depth":133,"text":283},{"id":332,"depth":133,"text":333},{"id":358,"depth":133,"text":359},[385,386,387],"Bug Bounty","Linux","Penetration Testing","\u002Fimages\u002Fblog\u002Fi-let-ai-run-my-recon-heres-what-it-found\u002Filetairunmyreconhereswhatitfound.webp","2026-04-10","Recon eats time. What happened when Penligent was pointed at a target and left to map the attack surface, validate findings and produce a report unattended.","md",{},"\u002Fi-let-ai-run-my-recon-heres-what-it-found",null,{"title":35,"description":390},"i-let-ai-run-my-recon-heres-what-it-found","Xg48JyS3wfc5SR5MUVPJ3hD8sQx73WmVK0LA91azQtQ",{"older":399,"newer":404,"total":409},{"slug":400,"title":401,"date":402,"position":403},"claude-code-for-hackers","Claude Code For Hackers","2026-03-28",9,{"slug":405,"title":406,"date":407,"position":408},"client-side-02-serviceworker-bugs","Client Side 02: ServiceWorker Bugs","2026-04-16",7,68,{"id":42,"title":411,"published":412,"url":413,"description":414,"durationSeconds":415,"viewCount":416,"thumbnail":417,"thumbnailSrcset":418},"I Let AI Run My Recon  Here's What It Found.","2026-04-10T13:00:29Z","https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=FRCigcjRO8c","The recon phase burns time on every new target. Same subdomain enumeration, same port scans, same fingerprinting. I wanted to see what happens when AI handles that entire baseline.",1170,6069,"\u002Fimages\u002Fvideos\u002FFRCigcjRO8c-800.webp","\u002Fimages\u002Fvideos\u002FFRCigcjRO8c-800.webp 800w, \u002Fimages\u002Fvideos\u002FFRCigcjRO8c-1280.webp 1280w",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":420},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M7 9.667A2.667 2.667 0 0 1 9.667 7h8.666A2.667 2.667 0 0 1 21 9.667v8.666A2.667 2.667 0 0 1 18.333 21H9.667A2.667 2.667 0 0 1 7 18.333z\"\u002F>\u003Cpath d=\"M4.012 16.737A2 2 0 0 1 3 15V5c0-1.1.9-2 2-2h10c.75 0 1.158.385 1.5 1\"\u002F>\u003C\u002Fg>",1791942280363]