AI Automated Penetration Testing Learning Roadmap: From Beginner to SRC in Practice

AI is changing the way penetration testing is learned. In the past, the path to learning vulnerability discovery was usually "first grind through the command line and tool manuals, then practice repeatedly on labs." That workflow is now being rewritten—AI can help you write asset collection scripts, analyze scan results, and even generate POC verification code. A learning roadmap for "AI + Penetration Testing" has been compiled on Bilibili, breaking the whole process into four modules that offer a solid reference for anyone wanting to get into cybersecurity.

Module 1: Establish the Right Cognitive Boundaries First

This roadmap sets two core goals for the beginner stage: building a correct understanding of cybersecurity, and understanding what AI can actually do in vulnerability discovery.

The concepts to get clear on include: what a skill is, what context is, what an agent is, and common agent tools like codex, hermes, and workbody. These terms sound abstract, but they are the foundation for all the automation that follows—without understanding how an agent works, it's hard to judge whether the results AI gives you can be trusted.

Equally important are the definition of a white-hat hacker, professional ethics, and the legal boundaries of security testing. The material states it plainly: security technology itself is a capability, but all testing activity must be built on legal authorization. If this line isn't clearly drawn, no matter how well you learn the technical skills afterward, it's dangerous.

The basic workflow also needs to be covered: information gathering, threat modeling, exploitation, post-exploitation, and report generation. These form the skeleton for later automation; AI is just an accelerator that fills in each stage.

An agent is the core paradigm of current AI applications—a loop system in which a large model autonomously plans steps, invokes tools, and observes feedback given a goal. Unlike single-turn Q&A, an agent typically consists of three components: planning (breaking a task into substeps), tool invocation (such as executing commands, reading and writing files, and making network requests), and memory (storing intermediate results and context). In penetration testing scenarios, agents are useful because asset collection, scanning, and verification are inherently multi-step processes that require adjusting based on feedback—which fits exactly how agents work. Codex is a series of models OpenAI released early on for code generation, and it later became a representative name for code agent tools; hermes and workbody are specific agent tools/assistant products mentioned in the material. The key to understanding these concepts is distinguishing between the "model" and the "agent framework": the model handles reasoning and generation, while the framework handles orchestrating tools and maintaining context.

Module 2: AI-Assisted Web Vulnerability Discovery

Once you move into hands-on practice, the first step is setting up an AI lab environment. This includes installing and configuring AI assistants like workbody, choosing common large models, setting up workspaces, and managing access permissions. If the environment isn't set up correctly, you'll get stuck everywhere when invoking tools later.

Asset collection and attack surface mapping are among the most labor-intensive parts of traditional penetration testing—manually writing scripts, running multiple tools, and then reviewing results by hand. The material points out that AI can now assist with writing asset collection tools, web fingerprinting, and analyzing scan results, and can also participate in source code analysis to help uncover potential security issues.

When it comes to vulnerability discovery itself, the focus is on common types from the OWASP TOP10, such as SQL injection (mistakenly referred to as "Circle injection" in the material), privilege escalation vulnerabilities, and logic flaws. When learning, grasp two points: the root cause of how the vulnerability arises, and how to use AI to discover and verify it. Complex business scenarios also deserve attention—security issues in flows like registration, login, and password changes, as well as captcha bypass and login verification bypass, are all things AI can help analyze.

OWASP TOP10 is a list of the top ten web application security risks updated every few years by OWASP (Open Worldwide Application Security Project), and it is an industry-recognized framework for vulnerability classification and learning. Common entries in recent versions include broken access control, cryptographic failures, injection vulnerabilities (SQL injection, command injection, etc.), insecure design, security misconfiguration, vulnerable and outdated components, identification and authentication failures, software and data integrity failures, security logging and monitoring failures, and server-side request forgery (SSRF). Focusing your learning on this list has the advantage of covering the most frequent vulnerability types in the real world, each with mature detection approaches and verification methods. It should be noted that "privilege escalation vulnerabilities" mentioned in the original text usually fall under broken access control in the OWASP classification, while "logic flaws" often correspond to insecure design. Their common trait is that they are hard for scanners to detect automatically and rely more on understanding business flows—which is exactly where AI-assisted analysis can add value.

Module 3: AI-Driven Automated Penetration Testing

This is the most central part of the entire roadmap, with the goal of embedding AI into the complete penetration testing workflow.

The first capability is Skill encapsulation: packaging a complete testing workflow (such as privilege escalation detection) into a reusable Skill. When facing similar scenarios, you can reuse it directly instead of building from scratch each time. This is essentially turning personal experience into an asset, and it's also the key to improving automated testing efficiency.

The second capability is having AI invoke security tools in Kali Linux, including Nmap, Nikto (mistakenly referred to as "Circlemap" in the material), and Metasploit. By connecting AI to the Kali environment, you can go from information gathering all the way through vulnerability analysis and exploitation.

The third capability is POC generation and verification. A POC is proof-of-concept code for a vulnerability; AI can generate the corresponding POC based on a vulnerability description and then execute verification. The material emphasizes that this capability has high practical value in vulnerability discovery and SRC vulnerability submission—it can significantly shorten the distance from "suspecting a vulnerability" to "confirming it's reproducible."

Finally, combine AI and Kali for a complete automated penetration testing exercise, linking together all the earlier AI capabilities, tool invocation, and vulnerability analysis.

Kali Linux is a Debian-based distribution dedicated to penetration testing, preinstalled with hundreds of security tools and often used as the standard operating environment for penetration testing. The tools mentioned in the original text have different roles: Nmap is a network discovery and port scanning tool used to identify live hosts, open ports, service versions, and OS fingerprints, and it is foundational in the information gathering stage; Nikto is a web server scanner that mainly detects outdated server software, dangerous files, and common configuration issues; Metasploit is an exploitation framework that provides vulnerability modules, payloads, and session management, moving from "discovering a vulnerability" to "verifying exploitation." AI usually invokes these tools through command-line interfaces or APIs, with the agent deciding what to execute next based on the previous step's output. The value of this combination is that it shifts toolchain orchestration from manually memorizing commands to AI-planned execution, but it also requires users to judge whether each step's results are reasonable and avoid blindly pushing in the wrong direction.

Module 4: Lab Practice and SRC in Practice

After learning the theory, you have to put it into practice. The material suggests practicing on lab platforms first, such as HTB and VulnHub (mistakenly referred to as "Valhub" in the material). These platforms provide target machine environments of varying difficulty, suitable for practicing vulnerability analysis and penetration testing techniques.

Then move on to real vulnerability discovery platforms; common ones in China include Butian and Vulbox. Through these SRC platforms, you can learn the vulnerability discovery process at real companies and accumulate practical vulnerability submission experience. The transition from labs to SRC is the key step from "being able to hit targets" to "being able to deliver."

HTB (Hack The Box) and VulnHub are two types of practice platforms with different positioning. HTB is an online platform that offers target machines from beginner to expert difficulty, as well as learning modules organized by path; its community is active, and some content requires a paid subscription. VulnHub, by contrast, provides downloadable virtual machine images that you can import locally and practice offline, suitable for learners without a stable network environment or who want to start over repeatedly. SRC (Security Response Center) is the official channel through which companies receive vulnerability submissions from external white hats; common ones in China include Butian, Vulbox, and self-built SRCs at major vendors. When submitting vulnerabilities to an SRC, you usually need to provide reproduction steps, impact scope, and verification evidence—which is exactly where POC skills show their value. It should be emphasized that SRC platforms only accept testing of assets within the authorized scope; unauthorized testing may carry legal risk even if it uncovers a real vulnerability, which is consistent with the legal authorization boundary emphasized earlier.

What Is the Value of This Roadmap

The judgment given at the end of the material is worth quoting: future security testing will no longer rely solely on manual command execution and repeatedly running tools, but rather on learning to use AI to improve efficiency—handing repetitive work to AI and focusing energy on vulnerability analysis, attack thinking, and security strategy.

The reason this judgment is sound is that it doesn't package AI as the myth of "one-click vulnerability discovery," but positions it as an efficiency tool. The core of vulnerability discovery remains understanding vulnerability principles and business logic; AI merely compresses time costs in stages like information gathering, script writing, and POC generation. For complete beginners, progressing step by step through these four modules provides more direction than blindly piling up tool lists.

One-line Summary

A four-module AI penetration testing roadmap compiled on Bilibili, from cognitive boundaries to SRC practice.

Paragraph Summary

The article introduces an "AI + Penetration Testing" roadmap circulating on Bilibili, split into four modules: the beginner stage builds cybersecurity awareness, understanding concepts like skill/context/agent and clarifying legal authorization boundaries; the AI-assisted web vulnerability discovery stage sets up an AI lab environment, uses AI for asset collection, fingerprinting, scan result and source code analysis, and learns SQL injection, privilege escalation, and logic flaws around OWASP TOP10; the core module embeds AI into the complete workflow, including Skill encapsulation, invoking Nmap/Nikto/Metasploit in Kali, and POC generation and verification; finally, gain practical experience through HTB and VulnHub labs and SRC platforms like Butian and Vulbox. The article emphasizes that AI is an efficiency tool rather than a one-click vulnerability discovery myth, and the core remains understanding vulnerability principles and business logic.