Shannon vs PentestGPT: Docker pentest lab walkthrough

This walkthrough compares Shannon and PentestGPT against OWASP Juice Shop, an intentionally vulnerable web application. The lab runs in Docker, with a ZAP baseline scan and a copy of the target's source code available for Shannon's whitebox assessment. A configuration file supplies login details and limits the test's scope.

The setup uses an Anthropic API key for Shannon. Although the target and containers run locally, the demonstrated workflow uses a hosted model API; it does not establish offline inference. The speaker also encounters an API spending cap that interrupts an activity, illustrating a dependency beyond the local environment.

Shannon runs autonomously while its Temporal UI displays workflow progress. The speaker reviews generated evidence and reports, including an authentication analysis section listing 14 vulnerabilities. That count belongs to one section of this scoped lab run, rather than a complete assessment of Juice Shop.

PentestGPT uses an interactive session with a plain-language instruction to focus on authentication bypass. Its output includes findings and mitigation recommendations. The speaker prefers this control for targeted checks and suggests Shannon for pipeline use. These are his workflow judgments. He stresses that a pentester still needs to validate findings, assess their practical impact and keep the AI agent within scope; the demonstration does not establish general accuracy or completeness.