How to Learn Penetration Testing in the AI Era: A Full Four-Stage Roadmap

AI is changing the way people learn penetration testing. In the past, learning security testing basically meant writing scripts by hand, running tools one by one, and poring over logs repeatedly; now, AI can take on a large amount of repetitive work, freeing up human energy for vulnerability analysis and attack-path design. A "AI + penetration testing" learning roadmap that has been bookmarked by many beginners on Bilibili breaks the entire learning process into four modules, from building foundational awareness to SRC hands-on practice—the path is quite clear. Below, drawing on the framework of this roadmap, we break down what to learn at each stage and why it is arranged this way.

Module 1: Getting Started with AI Penetration Testing—Build the Right Mindset First

Many people rush to learn tools and hunt for vulnerabilities right away, only to get stuck at "I don't know what I'm doing." This roadmap sets the core goals of the introductory stage as two things: building cybersecurity awareness, and understanding the specific application scenarios of AI in vulnerability discovery.

First, Understand the Basic Concepts of AI Agents

Before getting hands-on, you need to understand the foundational concepts of AI agents—what a skill is, what context is, what an agent is, and common agent tools like codex, hermes, and workbody. These concepts are not decoration; later, encapsulating Skills and having AI call tools are all built on this understanding.

The Relationship Between Skill, Context, and Agent

In the context of AI agents, Skill refers to an encapsulated, callable unit of capability, such as "execute a port scan" or "parse an HTTP response"; Context refers to all the information an agent can see when completing a task, including conversation history, tool return results, system prompts, etc. The longer and more precise the context, the more reliable the agent's judgment; an Agent is the execution entity that combines a large model, context, and a set of Skills, and can autonomously plan steps and call tools. The three are nested in layers: the Agent relies on Context to make decisions and calls Skills to carry out actions. Only by understanding this structure can you understand why the later idea of "encapsulating the penetration testing process into Skills for AI reuse" is feasible—in essence, it converts human operational experience into capabilities that an Agent can call.

White-Hat Ethics and Legal Boundaries Cannot Be Skipped

Security technology itself is a capability, but all testing activities must be built on the basis of legal authorization. At this stage, you need to understand the definition of white-hat hackers, professional ethics, and the legal boundaries of security testing. This is not a formality—it is the precondition that determines whether you can stay in this industry for the long term.

At the same time, you need to master the standard penetration testing process: information gathering, threat modeling, exploitation, post-exploitation, and report generation. This process is the skeleton for subsequent learning of vulnerability discovery and automated penetration testing. The roadmap also specifically mentions understanding what role AI can play in each of these stages—how to quickly organize target assets during information gathering, how to assist in understanding vulnerability principles during vulnerability analysis, and how to improve efficiency during vulnerability verification and report generation.

Module 2: AI-Assisted Web Vulnerability Discovery—Enter Real Scenarios

After building foundational awareness, you formally enter the practical operation of vulnerability discovery. The first step at this stage is to set up an AI lab environment, including installing and configuring AI assistants like workbody, choosing common large models, setting up workspaces, and managing access permissions.

Asset Collection Shifts from Handwritten Scripts to AI Assistance

In traditional testing, asset collection often requires manually writing scripts and running multiple tools, which is time-consuming and prone to omissions. With AI, the writing of asset collection tools, web fingerprinting, and analysis of scan results can all be assisted by AI.

AI can also assist with source code analysis to help identify potential security issues. Only after asset analysis is complete do you enter the real vulnerability discovery stage, focusing on common vulnerability types in the OWASP Top 10.

Focus on Vulnerability Principles, Not Memorizing Tool Usage

The roadmap emphasizes that during learning, the focus should be on understanding the causes of vulnerabilities and how to use AI to assist in vulnerability discovery and verification. In addition, AI can help analyze security issues in complex business scenarios, such as registration, login, and password change flows, as well as CAPTCHA bypass and login verification bypass scenarios. These issues are often not a single vulnerability point but are hidden in the gaps of business processes; manual investigation is time-consuming and labor-intensive, and AI involvement can significantly improve coverage.

Module 3: AI-Driven Automated Penetration Testing—The Core of the Entire Roadmap

This is the most core part of the four modules. The goal is to have AI participate in the complete penetration testing process, not just provide isolated assistance.

Skill Encapsulation: Turn Processes into Reusable Capabilities

The first capability to master is Skill encapsulation. This means encapsulating a complete penetration testing process—such as a privilege escalation detection process—into a Skill that can be called repeatedly. When facing similar testing scenarios, you can directly reuse existing capabilities, and testing efficiency improves accordingly. The essence of this step is to distill personal experience into callable assets.

Let AI Call the Kali Linux Toolchain

The second capability is to let AI call security tools in Kali Linux, such as common tools like Nmap and Metasploit. By connecting AI to the Kali environment, it can assist in the entire process from information gathering to vulnerability analysis to exploitation. The tools are still the same tools, but the way they are orchestrated has changed.

Kali Linux and Toolchain Invocation Methods

Kali Linux is a Debian-derived distribution geared toward penetration testing and security auditing. It comes preinstalled with hundreds of security tools, including Nmap (port and service detection), Metasploit (exploitation framework), Burp Suite, sqlmap, and others, so it is often treated as the "standard workbench" for security testing. There are usually two paths for letting AI call the Kali toolchain: one is through the command-line interface, where AI generates and executes specific commands, reads the output, and then decides the next step; the other is through protocols such as MCP (Model Context Protocol), packaging tools into capability interfaces that AI can directly recognize. The core difference between the two approaches lies in the degree of structure—the latter returns structured results, which are more conducive to stable parsing and chaining of multi-step tasks by AI.

The Practical Value of POC Generation and Verification

The third capability is using AI to generate and verify POCs (proof-of-concept exploit code). With AI, corresponding POCs can be generated based on specific vulnerability descriptions and then executed and verified. This capability has direct practical value in subsequent vulnerability discovery and SRC vulnerability submissions. Finally, combine AI with Kali Linux to complete a full automated penetration testing exercise, linking together all the previously learned AI capabilities, tool invocation capabilities, and vulnerability analysis capabilities.

POC and SRC Vulnerability Submission

A POC (Proof of Concept) is a minimized verification program used to prove that a vulnerability actually exists and can be triggered. It usually only verifies reproducibility of the vulnerability and does not carry out further exploitation. When submitting vulnerabilities on an SRC (Security Response Center) platform, a POC that can be reproduced reliably is often the key basis for a report being accepted, directly affecting vulnerability rating and rewards. The value of AI-generated POCs lies in the fact that it can quickly produce draft verification scripts based on vulnerability descriptions, which are then executed, verified, and corrected by humans in an authorized environment, thereby shortening the cycle from "discovering a suspicion" to "forming a submittable report." It should be noted that the generation and execution of POCs must be strictly limited to the scope of legal authorization.

Module 4: Extended Resources and Hands-On Platforms—Capability Comes from Practice

After learning the theory, you must put it into practice. At this stage, you need to learn about common security lab platforms such as HTB and Valhub. These platforms provide target machine environments of varying difficulty and are suitable for practicing vulnerability analysis and penetration testing skills.

At the same time, you need to learn about real vulnerability discovery platforms. Common domestic ones include SRC platforms such as Butian and Vulbox. Through such platforms, you can further understand the vulnerability discovery process of real enterprises and accumulate practical vulnerability submission experience. Labs train technique, while SRC trains process and judgment—both are indispensable.

The Judgment Behind This Roadmap: AI Changes the Division of Labor

The entire roadmap starts from foundational awareness, passes through AI-assisted web vulnerability discovery and AI-driven automated penetration testing, and finally lands on practical improvement through labs and SRC platforms. The logic is progressive. The judgment behind it is clear: future security testing will no longer rely solely on manual command execution and repeated tool runs, but on learning to use AI to improve efficiency. Hand repetitive work to AI and devote more energy to vulnerability analysis, attack-path thinking, and security strategy—this is the real adjustment needed in the penetration testing learning path in the AI era.

For people who want to enter the AI security field, this four-stage roadmap provides a relatively complete framework. A roadmap is only a map; whether you can actually make it through still depends on whether you have really practiced hands-on at each stage.

One-line Summary

A four-module AI + penetration testing learning roadmap that progresses step by step from foundational awareness to SRC hands-on practice.

Paragraph Summary

The article breaks down a four-module "AI + penetration testing" learning roadmap circulating on Bilibili. Module 1 emphasizes first building cybersecurity awareness and basic concepts of AI agents, and clarifying white-hat ethics and the boundaries of legal authorization; Module 2 enters real scenarios, using AI to assist with asset collection, source code analysis, and OWASP Top 10 vulnerability discovery, with the focus on understanding vulnerability principles rather than memorizing tools; Module 3 is the core, requiring mastery of Skill encapsulation, letting AI call the Kali toolchain, AI generation and verification of POCs, and completing a full automated penetration testing exercise; Module 4 relies on labs such as HTB and Valhub and SRC platforms such as Butian and Vulbox to accumulate experience. The article points out that what AI changes is the division of labor—repetitive work is handed to AI, while human energy shifts to vulnerability analysis and attack-path design.