AI Penetration Testing Learning Roadmap Explained: From WorkBuddy Deployment to SRC Vulnerability Discovery

AI is reshaping the way penetration testing is learned. The traditional model of manually executing commands and repeatedly running tools is gradually being replaced by an "AI-assisted + automated" security testing workflow. A Bilibili creator recently proposed a four-stage AI penetration testing learning roadmap in a tutorial, covering the complete loop from foundational understanding to hands-on vulnerability hunting. This article interprets and analyzes the tutorial's content, drawing on information from multiple sources.

1. Why the AI Era Requires a New Penetration Testing Learning Path

The Bottlenecks of Traditional Approaches

Traditional penetration testing learning often requires learners to first master a large number of tool commands—Nmap scanning, Burp Suite packet capture, manual injection testing—and then gradually accumulate vulnerability analysis experience. This path has a high barrier to entry, a long cycle, and a great deal of time is consumed by repetitive information gathering and tool configuration.

The Changes AI Brings

According to the tutorial's analysis, AI's core value in vulnerability discovery is reflected across multiple stages: during information gathering it can quickly map out target assets, during vulnerability analysis it can help understand vulnerability principles, and it can also play a role in vulnerability verification and report generation. As emphasized in the video screenshot: "But now, with the help of AI"—AI's involvement has brought qualitative changes to the efficiency of penetration testing workflows.

This judgment is echoed by other security researchers. Several security channels on YouTube likewise point out that the assistive role of AI agents in asset discovery and vulnerability triage is rapidly strengthening. Multi-source consensus: AI will not replace security testers, but it will significantly change the way they work.

2. Breaking Down the Four-Stage Learning Roadmap

Stage One: Introduction to AI Penetration Testing

The core goal of this stage is to establish correct understanding. Several key concepts need to be grasped:

• AI Agent fundamentals: What a Skill is, what Context is, what an Agent is, and common Agent tools such as Codex, Hermes, WorkBuddy^Ad, etc.
• White-hat hacker ethics and legal boundaries: The tutorial particularly emphasizes that security technology itself is a capability, but all testing behavior must be built on the foundation of legal authorization.
• Standard penetration testing process: Information gathering, threat modeling, vulnerability exploitation, post-exploitation, and report generation.

This stage may appear to be "groundwork," but in fact it determines whether the direction of all subsequent practice is correct. The awareness of legal authorization is especially important against the backdrop of AI lowering the technical barrier.

AI Agent is the key concept for understanding the entire roadmap. Unlike single-turn Q&A chatbots, an Agent refers to an AI system capable of autonomously planning steps, invoking external tools, and iteratively adjusting based on execution results. Its typical working loop is: receive goal → break down tasks → select tools → execute → observe feedback → correct the next step. The Skill mentioned in the original can be understood as an encapsulated reusable capability module (similar to a function or plugin), while Context refers to the conversation history, tool return results, and background materials visible to the model during a task; context management directly determines whether an Agent can maintain goal consistency over a long workflow. Tools like Codex and WorkBuddy are essentially frameworks that provide Agents with a runtime environment, tool interfaces, and context scheduling. Only by understanding the division of labor among these three can one understand why Stage Three packages the workflow into Skills—it moves the Agent from "figuring things out anew each time" to "executing according to established patterns."

Stage Two: AI-Assisted Web Vulnerability Discovery

Entering the hands-on stage, the first step is environment setup. According to the tutorial, this requires installing and configuring an AI assistant like WorkBuddy, selecting common large models, setting up workspaces, and managing access permissions.

Once the environment is ready, the next step is asset collection and attack surface mapping. In the past this required manually writing scripts and running multiple tools; now AI can assist with writing asset collection tools, Web fingerprinting, and analyzing scan results. The tutorial also mentions that AI can assist with source code analysis to help identify potential security issues.

The Web vulnerability discovery stage focuses on the OWASP TOP 10, including SQL injection (the injection-type vulnerabilities mentioned in the tutorial), privilege escalation vulnerabilities, logic flaws, and more. The learning focus is on understanding the causes of vulnerabilities and how to use AI to assist in discovery and verification. In addition, AI can help analyze security issues in complex business scenarios such as registration and login, password changes, including verification code bypass and login verification bypass.

OWASP TOP 10 is a list of the top ten Web application security risks periodically published by the Open Web Application Security Project (OWASP), and is the most commonly cited classification framework in global Web security testing. It covers categories such as broken access control, cryptographic failures, injection, insecure design, security misconfiguration, vulnerable and outdated components, identification and authentication failures, software and data integrity failures, security logging and monitoring failures, and server-side request forgery. The SQL injection mentioned in the original belongs to the injection risk category, while privilege escalation corresponds to broken access control. Note that this list reflects the prevalence and severity of risk categories rather than ranking them by frequency of occurrence, and versions are updated as the attack-defense landscape evolves. Learning with it as an outline has the advantage of complete coverage and easy cross-referencing with tools and lab exercises; its limitation is that it only covers the Web layer, so cloud-native, API, and supply chain scenarios require separate supplementation.

Stage Three: AI-Driven Automated Penetration Testing

This is the most core part of the entire roadmap. The tutorial proposes three key capabilities:

Skill encapsulation. Encapsulate the complete penetration testing workflow (such as a privilege escalation detection workflow) into a reusable Skill that can be directly reused when facing similar scenarios, greatly improving testing efficiency.

AI invoking Kali tools. Have AI connect to a Kali Linux environment and invoke common security tools such as Nmap, Nikto (the scanning tool mentioned in the tutorial), and Metasploit to complete the entire workflow from information gathering to vulnerability analysis to vulnerability exploitation.

AI generating and verifying POCs. Based on specific vulnerability descriptions, use AI to generate corresponding proof-of-concept code, then execute and verify it. The tutorial points out that this capability has direct practical value in the SRC vulnerability submission process.

It should be viewed objectively that POC auto-generation still has limitations. According to feedback from some security researchers, the accuracy of AI-generated POCs in complex vulnerability scenarios still has room for improvement and requires manual review. This is an observation from a single source and has not yet formed broad consensus.

Kali Linux is a Debian-based distribution geared toward penetration testing and security auditing, pre-installed with hundreds of security tools, including Nmap (port and service detection), Nikto (Web server scanning), and Metasploit (vulnerability exploitation framework). The technical prerequisite for having AI invoke Kali tools is the tool calling (Function Calling / MCP) mechanism: the AI itself does not execute commands but outputs structured invocation requests, which the outer framework actually executes in the Kali environment and passes the results back to the model. This also means the risk boundary shifts upward—once an Agent has command execution permissions, a single incorrect target resolution or out-of-scope scan could cause real impact. Therefore, in practice, sandbox isolation, target whitelisting, and manual confirmation steps are usually required. Only by understanding this invocation chain can one judge which steps in the automated workflow can be left to run and which must retain human checkpoints.

Stage Four: Extended Resources and Hands-On Platforms

After finishing the theory, hands-on practice is essential. The tutorial recommends two types of platforms:

• Lab platforms: HTB, VulnHub (the VulHub/HackTheBox-type platforms mentioned in the tutorial) provide target machine environments of varying difficulty, suitable for practicing vulnerability analysis and penetration testing skills.
• SRC platforms: Common domestic ones such as Butian and Vulbox can help learners understand the vulnerability discovery process of real enterprises and accumulate vulnerability submission experience.

Labs and SRC are two practice grounds of different natures. Labs (such as Hack The Box, VulnHub, Vulhub) are artificially constructed vulnerability environments where one can freely experiment and fail repeatedly within the authorized scope, with the focus on training tool usage and understanding of vulnerability principles; Vulhub provides reproducible vulnerability environments in the form of Docker containers, suitable for verifying specific CVEs. SRC (Security Response Center) is a vulnerability collection platform established by enterprises, such as Butian and Vulbox, where submitted vulnerabilities enter a real enterprise review process involving severity rating, deduplication, and reward rules. The two are complementary: labs address "can you do it," while SRC addresses "is it real." It should be noted that submitting vulnerabilities to SRC must also comply with platform rules and legal boundaries, testing of unauthorized assets is not permitted, and AI-generated POCs should be manually verified before submission to avoid false positives.

3. The Value and Limitations of This Roadmap

What Is Commendable

The greatest value of this roadmap lies in its clear structure. From establishing understanding to environment setup, from single-point capability training to connecting the complete workflow, and finally landing on hands-on platforms, it forms a "learn-practice-fight" closed loop. In particular, proposing Skill encapsulation as an independent capability reflects a pragmatic understanding of AI Agent implementation.

Issues to Note

The tutorial as a whole leans toward directional guidance, and specific technical details and operational steps require hands-on demonstrations in the video. For learners with zero foundation, the concept density in Stage One is relatively high, and additional foundational knowledge on AI Agents may be needed. In addition, there is currently a lack of publicly available quantitative data to support the ecosystem maturity of specific tools like WorkBuddy and the actual success rate of AI-assisted vulnerability discovery in real SRC scenarios.

4. Conclusion

The learning path for AI penetration testing is shifting from "hand-writing scripts and manual testing" to "AI assistance, workflow encapsulation, and automated execution." As the tutorial emphasizes: "Future security testing will no longer rely solely on manual command execution and repeated tool runs; instead, one needs to learn to use AI to improve efficiency." Delegate repetitive work to AI and focus energy on vulnerability analysis, attack thinking, and security strategy—this may be the mindset shift security practitioners most need in the AI era.

One-line Summary

A Bilibili tutorial proposes a four-stage AI penetration testing learning roadmap that forms a closed loop from understanding to hands-on practice.

Paragraph Summary

Based on a Bilibili creator's tutorial, this article interprets a penetration testing learning roadmap for the AI era. The author first analyzes the bottlenecks of traditional penetration testing—high barriers and heavy repetitive work—and points out AI's value in information gathering, vulnerability analysis, verification, and report generation, while emphasizing that AI will not replace security personnel. The article then breaks down the four-stage roadmap: Stage One establishes understanding of AI Agents, legal authorization, and standard processes; Stage Two covers environment setup and OWASP TOP 10-related Web vulnerability discovery; Stage Three focuses on three core capabilities—Skill encapsulation, AI invoking Kali tools, and POC generation and verification; Stage Four provides hands-on practice through lab and SRC platforms. The article concludes by affirming its clear structure and "learn-practice-fight" closed loop, while noting limitations such as insufficient technical detail and the lack of quantitative data on tool ecosystem maturity and success rates.