How an AI “Second Brain” Boosts Penetration Testing Efficiency

What Is ClaudeBrain?

ClaudeBrain is an open‑source red‑team and bug‑bounty automation tool that implements Andrej Karpathy’s “LLM Wiki” concept. It equips Claude Code with a continuously growing, semantically searchable knowledge base so that answers are derived from the Wiki instead of raw documents each time.

Core Features

500+‑Page Technical Wiki

The Wiki is organized as Obsidian‑style Markdown pages indexed with qmd, supporting semantic and keyword search. Queries such as “SSRF on cloud metadata” or “AD CS ESC1” return relevant pages within milliseconds. The Wiki covers Web security, networking, Active Directory, cloud platforms (AWS, Azure, GCP), Linux/macOS, exploit development, OSINT, red‑team tactics, mobile/IoT, blockchain, and methodology. A built‑in learn skill de‑identifies experience from each engagement and adds it back to the Wiki.

Hunting Skill Library

For each common vulnerability type (XSS, SQL injection, SSRF, IDOR, RCE, authentication bypass, OAuth/SAML attacks, deserialization, cloud attacks, AD attacks, API security, LLM/AI security, request smuggling, cache poisoning, etc.) ClaudeBrain provides a dedicated “hunt skill.” Each skill follows the workflow: search the Wiki → execute the attack → output results in a unified FIND format. Out‑of‑band triggers (DNS/HTTP) enable detection of blind vulnerabilities.

Deterministic Automation Hooks

hunt-trigger.py

(UserPromptSubmit): matches user input with skills/hunt/triggers.json and loads the appropriate hunt skill. recon-capture.py (PostToolUse): fingerprints discovered tech stacks, routes to targeted tests, and captures evidence. engagement-init.py (SessionStart): repairs task files and injects a prioritized next‑action summary. scope-guard.py (PreToolUse): warns when commands target out‑of‑scope hosts or prohibited tools.

State‑Driven Engagement Model

Each engagement has a dedicated directory under targets/ containing state files, loot, path records, scope definitions, and coverage tracking. Built‑in analyzers ( next_move.py, coverage.py) rank the next best action and highlight untested vulnerability types, ensuring comprehensive coverage.

Strict Client Data Isolation

All client‑specific data (IP addresses, credentials, findings) must reside in the targets/ directory, which is listed in .gitignore. The check-leaks.sh script scans for sensitive markers before each push, preventing accidental leaks to public repositories.

Quick Start

System Requirements

Linux or WSL

bash + Python 3.10 or newer

Claude Code CLI

Node.js ≥ 18 and bun

Installation Steps

# 1. Clone the repository
git clone https://github.com/Encod3d-Sec/ClaudeBrain.git
cd ClaudeBrain

# 2. One‑time machine initialization (writes ~/.claude config, registers MCP server, etc.)
bash setup/bootstrap.sh

# 3. Build the search index (run after adding new Wiki pages)
qmd update

# 4. Restart Claude Code to load hooks, skills, and MCP server

# 5. Create a new engagement (supports pentest | bugbounty | ctf modes)
bash setup/new-engagement.sh acme pentest

# 6. Run leak check before each push
bash scripts/check-leaks.sh

Applicable Scenarios

Authorized penetration testing : structured workflow improves efficiency under a signed contract.

Bug‑bounty hunting : systematic coverage of OWASP API Top 10 and other vulnerability classes reduces blind testing.

CTF competitions : built‑in methodology and payload library help quickly identify attack paths.

Red‑team research : knowledge accumulation and state management support long‑term adversary emulation.

Conclusion

ClaudeBrain merges AI with security research workflows through a structured, searchable Wiki, modular hunt skills, deterministic Python hooks, and a stateful engagement model. The tool provides a memory‑enabled, learning partner for penetration testers, eliminating repeated discovery of attack surfaces and ensuring no vulnerability type is overlooked.

Project repository: https://github.com/Encod3d-Sec/ClaudeBrain