This information is provided for educational purposes only.
Over the last weeks, I’ve been taking the Certified Ethical Hacker course, and there is a lot of practice that can be automated. The course provided information on how to automate reconnaissance with AI by utilizing sgpt. My approach was different — I tried to automate it with JetBrains Junie and here is a review. Let’s go!
Environment preparation
Performing penetration testing on your personal computer could harm your computer, especially when automated by AI. I decided to run my experiments in a virtual machine. You have too.
That’s what you need:
- ParrotOS — a special OS that contains tools for penetration testing. I run it in a virtual machine using UTM.
- PyCharm with the JetBrains Junie plugin installed.
- A bunch of additional tools were installed in
ParrotOS— You can install it on your choice. - Create an empty project in
PyCharm, navigate to the Junie plugin and toggleBrave modein because we are brave :)
Diving into JetBrains Junie
You might not know what these magical words above are, so I’ll tell you.
Reconnaissance — collecting information about the hacking target without touching it. As an example, during recon, you’re collecting information about domains, subdomains, usernames, and other useful information to perform penetration testing.
In this experiment, I was looking only for subdomains. When you find subdomains , you should perform network scanning to find open ports on these subdomains and check their validity.
If you’re not familiar with this AI agent, I recommend their IntelliJ IDEA Junie Playbook. It’s a quick start for everyone. I hope you followed it before continuing.
From Junior to Senior Vibe-hacking
I’ve made a lot of attempts to find the best-matched AI agent prompt and environment for me to perform reconnaissance and subdomain enumeration, and it was an enjoyable experience. Let’s explore it together, from the junior approach to the senior.
Junior approach
I started with an easy prompt: You’re a CEH expert. Use tools from ParrotOS to find subdomains on the domain protsenko.dev.
What did I get? It worked with problems: JetBrains Junie was trying to use utilities that ParrotOS didn’t have by default. Many attempts failed trying to use missing software, but in the end, he collected subdomains from my domain and even found abandoned subdomains that I used in the hackathons.
However, it was a long process to find all the subdomains, with many attempts to use software that was not installed, and JetBrains Junie created Python scripts with automation, a README.md, and a bunch of files that I didn’t ask for.
What about network scanning? Same approach: just prompt it to scan your findings — that’s all!
Okay, I’ve got feedback and learned important things:
- Ask Junie not to create additional files or scripts if I don’t ask for them.
- Ask Junie to use software from
/usr/bin. - Ask Junie to store result files in a specified folder at the given path, like
/results/domain/utilname.txt.
Is it a good approach?
- Pros: You don’t need to learn tools — just be a script kiddie with hand grenades.
- Cons: Your quota is limited, and the results are chaotic. Unpredictable results.
Middle approach
Going deeper and deeper, let JetBrains Junie be Middlie. Based on my previous experiments, Junie should be more determined. Let’s see the next prompt:
You’re a CEH expert. Your target is to perform penetration testing.
You should use utils built into ParrotOS located in/usr/bin.
Use at least two utils to collect more information about your target.
Do not edit or create files except result files located in/results/domain/utilname.txt.
You should find subdomains on the domain protsenko.dev.
What about the findings? The same. What about the behavior? Absolutely better: no more using soft that is not installed, no random changes or code creation, just pure results in fewer steps.
Junie is now looking at what is inside the binary directory and picks utils that could help in their targets, but each time he uses different tools, making the process not determined.
New problems appeared:
- Sometimes Junie uses wrong arguments for tools and commands fail.
- Some tools need an API key, producing wrong results due to missing keys.
Following those problems, you can sum up for yourself.
- Pros: More deterministic, more accurate, economical AI-quota spending, and that’s all.
- Cons: Results will change with different runs because of using different tools.
Middle+ approach
JetBrains Junie has a built-in feature to follow guidelines. These guidelines are used as the first step in each task, and this is the best place to describe long prompts on how to act and perform penetration testing.
I hope you know where the guidelines file is located because I asked you to read the Junie Playbook first. If not, it’s in the .junie/guidelines.md project folder.
Our guidelines will be further extended.
# Certified Ethical Hacker
- You’re an experienced CEH expert. Your target is to perform a security assessment.
- You should use only ParrotOS and the tools in it from `/usr/bin`.
- Inspect each tool you will be using by prompting the help argument or similar.
-- Utilize the features bundled into utils for saving output or Linux output redirection.
-- Result folder structure: `results/domain_name/tool_name`
- You should use software or services that don’t need API keys or subscriptions.
- You shouldn’t create files/scripts or modify them to achieve the target except for result files.
## Footprinting guide (subdomains)
- Use the following tools to collect information about subdomains:
-- `dnsrecon` – all supported types except for brt, snoop, or tld modes.
-- `massdns` – for performant brute-forcing.
-- `sublist3r` – with default settings.
-- `theHarvester` – subdomain mode only.
Each step should be saved to an output file with the tool name and additional info.
If an output file for a given tool and parameters is present — skip that step.
Save unique domain names to the file: `overall_domains.txt`Key changes here are:
- Obviously, using the guidelines file.
- There are strict instructions on what Junie should do and the order to run.
- Junie, before running commands, should read the manual by using help arguments.
Your prompt to JetBrains Junie will be simple: Perform collecting subdomains on protsenko.dev . That’s all, our guidelines will be applied automatically.
That works definitely better. Processes are deterministic, no visible problems — just concentrated results.
The same approach should be applied to the network-scanning step, but one important mention — tools like nmap these with some arguments need root access, and those commands will definitely fail.
Is it a good approach?
- Pros: Absolutely game-changing with expected results.
- Cons: You need to know what tools should be used and when. You’re no longer script kiddies. You should care about what you are doing, or not, if you are just reviewing the JetBrains Junie plugin.
Senior approach
An AI agent could automate your work, and it does, but running the same prompts on different targets could be expensive due to AI costs. In the previous step, I described what the AI agent should use, the order, and bla-bla-bla. All of this looks like half-baked scripts. Let’s combine the power of Junie to write a Python script for collecting subdomains without using AI.
Let’s keep our guidelines untouched and write a task for JetBrains Junie:
# Coding task
You're a skilled Python developer.
You should write a Python script (use built-in functions only) to collect subdomains:
## Important notes
- Learn about each tool that you will be using in the script by prompting the help argument or similar.
- Each tool's results should be stored in `results/domain_name/tool_name`.
- The script shouldn't use software / services / arguments that need API keys or subscriptions.
## How to collect
- Use the next tools to collect information about subdomains:
-- `dnsrecon` – all supported types except brt, snoop, and tld modes.
-- `massdns` – for performant brute-forcing.
-- `sublist3r` – with default settings.
-- `theHarvester` – subdomain mode only.
Each step should be saved to an output file with the tool name and additional info.
If an output file for a given tool and parameters is present – skip that step.
At the last step, analyze all results files with `cat`; do not use `head` with limited lines.
Save unique domain names to the file `overall_domains.txt`; every unique domain should be a subdomain of the target.
## User interface
- User via command arguments should specify the target domain.
- User via command arguments could specify a wordlist for `massdns`; the default value is `/usr/share/wordlists/dnsmap`.
- Domain should be correct.
- Before running, verify that each tool is present and installed.
- If a tool is not installed, print a message about this and skip the step.
## Testing
Perform scanning of the `protsenko.dev` domain to find subdomains for testing purposes.Results? Amazing! Junie learned how the tools work, wrote the code, performed testing, and, based on the results, fixed the problems until the code was working perfectly.
Now you have a perfect script that works without AI agents and utilizes the tools bundled in ParrotOS. No more spending AI quota — just a classical script to collect subdomains from different tools.
Are there problems with that approach? I didn’t find direct problems; I did not perform a code review of the scripts, but they work well, and I don’t care what’s inside because I did it just for fun and educational purposes and preparing JetBrains Junie review.
- Pros: Once develop — reuse every time.
- Cons: You still need to know what are you doing.
At the end
Will I use more AI in my learning journey into CEH? Definitely, in different ways, but with limited scope. Before using AI and utilizing something , it’s better to learn about the tools that will be used and when they should be used.
Between fully AI-agent workflows, I prefer to research, experiment with prompts and tasks that I need, and, at the end, develop a script that works without AI because of the quota.
However, classical programming without AI is more enjoyable and controllable for me. At work, I’m using AI only to find necessary functions or for full-line code completion. I don’t let AI write the whole code because results are different every time, and code quality is equal to or lower than OK level, while I’m aiming for a higher level.
What about JetBrains Junie? My review is that Junie is a perfect plugin for JetBrains IDE that I definitely recommend to anyone. Give it a try, experiment, code, run, and have fun.
That’s all for now. If you’re interested in AI agents and how to build them, follow me on LinkedIn to learn about new articles. If you like this article, read my related article: Google Agent Development Kit Guide: AI CVEs prioritization
