xcoy0te
RSS FeedResearch notes on offensive security, AI, and the certifications along the way. Lab reproductions, technique writeups, and honest exam reviews.
Browse the posts or read more about me.
Recent Posts
AWP, Autonomous WebApp Pentester, and its first real engagement
After the external-pentest plugin, the obvious next build was the web side. So I wrote awp, an autonomous web application & API penetration-testing plugin for Claude Code, and this week I pointed it at its first authorized target. It came back with two Highs, two Mediums, and a handful of lows. Here are the honest notes.
Testing My Claude-ExternalPentest Plugin
I handed my external pentest plugin a single authorized IP to see what it could find.
Building AI Hackbots — 2026 External Pentest Edition
A Claude Code plugin I built for external penetration tests, claude-extpt. PTES + WSTG methodology, four scoped sub-agents, default-deny scope, and human-in-the-loop before anything intrusive.
Building AI Hackbots — 2026 Active Directory Edition
Handing Claude Code the same tools you'd run by hand — netexec, impacket, BloodHound — and letting it drive an Active Directory pentest from anonymous access to Domain Admin on HackTheBox 'Support' in about 30 minutes.