Posts
All the articles I've posted.
AWP, Autonomous WebApp Pentester, and its first real engagement
After the external-pentest plugin, the obvious next build was the web side. So I wrote awp, an autonomous web application & API penetration-testing plugin for Claude Code, and this week I pointed it at its first authorized target. It came back with two Highs, two Mediums, and a handful of lows. Here are the honest notes.
Testing My Claude-ExternalPentest Plugin
I handed my external pentest plugin a single authorized IP to see what it could find.
Building AI Hackbots — 2026 External Pentest Edition
A Claude Code plugin I built for external penetration tests, claude-extpt. PTES + WSTG methodology, four scoped sub-agents, default-deny scope, and human-in-the-loop before anything intrusive.
Building AI Hackbots — 2026 Active Directory Edition
Handing Claude Code the same tools you'd run by hand — netexec, impacket, BloodHound — and letting it drive an Active Directory pentest from anonymous access to Domain Admin on HackTheBox 'Support' in about 30 minutes.