AI Features

RTFMv2 integrates artificial intelligence throughout the platform to accelerate analysis, suggest next steps, and automate routine tasks. The AI system operates in the background while providing interactive capabilities through chat and agent interfaces.

Overview

The AI integration provides three primary capabilities:

  1. Background Analysis: Automatic review of scan results and findings
  2. AI Agents: Autonomous task execution and research
  3. Interactive Chat: Real-time assistance and guidance

Background Analysis

The AI continuously monitors your session and analyzes new data as it arrives.

What It Analyzes

Scan Results:

  • Port scan findings from Nmap
  • Web application vulnerabilities from Nuclei and Wfuzz
  • SQL injection results from SQLMap
  • OpenVAS vulnerability reports
  • Service version detection

Host Information:

  • Operating system fingerprints
  • Open ports and services
  • Software versions
  • Configuration weaknesses

Network Patterns:

  • Host relationships and dependencies
  • Network topology insights
  • Trust boundaries
  • Lateral movement opportunities

Analysis Output

The AI generates:

Priority Rankings:

  • Hosts ordered by exploitation potential
  • Vulnerabilities sorted by severity and exploitability
  • Attack paths weighted by success probability

Contextualized Findings:

  • Vulnerability descriptions in plain language
  • Exploitation difficulty assessments
  • Required tools and techniques
  • Potential impact analysis

Recommendations:

  • Next scan targets
  • Suggested tools to run
  • Exploitation strategies
  • Post-exploitation actions

Enabling Background Analysis

  1. Open Session Settings
  2. Navigate to "AI Configuration" tab
  3. Toggle "Enable Background Analysis"
  4. Configure analysis frequency:
    • Real-time (analyzes immediately on new data)
    • Periodic (every N minutes)
    • Manual (on-demand only)
  5. Set analysis depth:
    • Quick: Basic pattern matching
    • Standard: Comprehensive analysis
    • Deep: Extensive research and correlation
  6. Save settings

Viewing Analysis Results

Dashboard Widget:

  • AI Insights panel shows recent findings
  • Click any insight for detailed explanation
  • Mark findings as addressed or dismissed

Host Details:

  • AI-generated host summaries
  • Recommended actions per host
  • Exploitation roadmap

Reports:

  • AI findings included in exported reports
  • Separate AI analysis section
  • Executive summary generation

AI Agents

Autonomous agents perform complex tasks with minimal user intervention.

Available Agents

Enumeration Agent

  • Automatically runs appropriate enumeration tools
  • Adapts based on discovered services
  • Escalates findings for exploitation

Example Tasks:

  • HTTP service discovered → Runs directory brute-force
  • SMB detected → Enumerates shares and users
  • SSH found → Attempts username enumeration

Vulnerability Research Agent

  • Searches for exploits matching discovered services
  • Queries CVE databases
  • Identifies exploit-db entries
  • Suggests Metasploit modules

Example Tasks:

  • Apache 2.4.49 detected → Finds path traversal CVE
  • Windows Server 2019 → Identifies recent patches missing
  • Custom application → Searches for known vulnerabilities

Exploitation Agent

  • Suggests exploitation sequences
  • Chains vulnerabilities for maximum impact
  • Prepares payloads and listeners
  • Verifies exploitation success

Example Tasks:

  • Identifies LFI → Suggests log poisoning → Prepares reverse shell
  • Finds SQLi → Tests for RCE via xp_cmdshell
  • Discovers RCE → Generates appropriate payload

Post-Exploitation Agent

  • Recommends enumeration commands
  • Identifies privilege escalation paths
  • Suggests credential dumping techniques
  • Maps network from compromised host

Example Tasks:

  • Shell acquired → Runs linux-exploit-suggester
  • Windows access → Checks for AlwaysInstallElevated
  • Domain user → Suggests BloodHound collection

Configuring AI Agents

Agent Settings: 1. Open AI Configuration 2. Select "Agents" tab 3. Choose which agents to enable 4. Set autonomy level: - Ask before execution (manual approval) - Execute and notify (runs automatically) - Fully autonomous (silent execution) 5. Configure agent limits: - Maximum concurrent actions - Resource usage caps - Time limits per task

Monitoring Agent Activity

Agent Dashboard:

  • View active agents and their current tasks
  • See agent decision reasoning
  • Review completed actions
  • Approve pending requests

Agent Logs:

  • Detailed execution timeline
  • Input/output for each action
  • Error messages and retries
  • Performance metrics

Notifications:

  • Real-time alerts for agent discoveries
  • Approval requests for sensitive actions
  • Completion notifications
  • Error alerts

Interactive Chat

Chat directly with the AI for guidance, questions, and on-demand analysis.

Opening the Chat Interface

  1. Click the "AI Chat" button in the toolbar
  2. Chat panel opens on the right side
  3. Type your question or request
  4. Press Enter or click Send

Chat Capabilities

Ask Questions:

"What should I scan next?"
"Explain this Nmap result"
"How do I exploit CVE-2021-44228?"
"What is the best way to enumerate SMB?"

Request Analysis:

"Analyze host 192.168.1.10"
"Summarize findings for 10.0.0.0/24"
"What are the critical vulnerabilities?"
"Show me attack paths to domain admin"

Generate Commands:

"Create an Nmap command for web service enumeration"
"Give me a SQLMap command for this URL"
"Generate a reverse shell payload for Linux"
"What's the Metasploit module for MS17-010?"

Get Recommendations:

"What tools should I use for this service?"
"How do I escalate privileges on Windows?"
"What's the next step after getting a shell?"
"Suggest lateral movement techniques"

Chat Features

Context Awareness:

  • Chat knows your current session state
  • References hosts and findings from your session
  • Recalls previous conversation history

Code Snippets:

  • Syntax-highlighted command examples
  • Copy-to-clipboard buttons
  • One-click execution (with confirmation)

Visual Aids:

  • Inline screenshots and diagrams
  • Network topology visualizations
  • Attack tree diagrams

Interactive Learning:

  • Explain Like I'm Five (ELI5) mode
  • Step-by-step tutorials
  • Link to relevant documentation

Chat Settings

Customize chat behavior:

  1. Open Chat Settings (gear icon in chat panel)
  2. Configure preferences:
    • Response verbosity (concise/detailed)
    • Technical level (beginner/advanced)
    • Include references (yes/no)
    • Auto-execute safe commands (yes/no)
  3. Save preferences

Chat History:

  • Full conversation history retained
  • Search previous chats
  • Export chat logs
  • Clear history option

AI Model Configuration

Selecting AI Models

RTFMv2 supports multiple AI backends:

Built-in Models:

  • Local lightweight model (fast, offline)
  • Cloud-enhanced model (slower, more capable)

External Integrations:

  • OpenAI GPT-4 (requires API key)
  • Azure OpenAI (requires subscription)
  • Local LLM servers (Ollama, LM Studio)

Configuration:

  1. Navigate to Settings → AI → Model Configuration
  2. Select primary model from dropdown
  3. Enter API credentials if required
  4. Test connection
  5. Save configuration

API Key Management

For external models:

  1. Open Model Configuration
  2. Click "Add API Key"
  3. Select provider (OpenAI, Azure, etc.)
  4. Paste API key
  5. Verify key with test request
  6. Save securely (encrypted in session)

Security:

  • API keys are encrypted at rest
  • Never transmitted outside AI requests
  • Can be session-specific or global
  • Revoke keys from settings panel

Performance Tuning

Optimize AI performance:

Speed vs. Accuracy:

  • Fast mode: Quick responses, less detailed
  • Balanced: Good mix of speed and depth
  • Thorough: Comprehensive but slower

Resource Limits:

  • Maximum tokens per request
  • Concurrent AI requests
  • Cache results for repeated queries
  • Timeout values

Cost Management:

  • Set daily/monthly API usage limits
  • Track token consumption
  • Estimate costs before execution
  • Disable AI when not needed

Privacy and Security

Data Handling

What AI Sees:

  • Session data (hosts, ports, findings)
  • Scan results and tool output
  • User questions and context

What AI Doesn't See:

  • Session passwords
  • Credential harvests (unless explicitly shared)
  • Raw packet captures
  • Sensitive client information (if marked as private)

Data Transmission

Local Models:

  • All processing on-device
  • No data leaves your system
  • Slower but completely private

Cloud Models:

  • Data sent to AI provider
  • Subject to provider's privacy policy
  • Faster and more capable
  • Can be disabled for sensitive engagements

Hybrid Approach:

  • Use local models for sensitive analysis
  • Use cloud models for general questions
  • Configure per-session or per-query

Compliance

For regulated engagements:

  1. Disable cloud AI in session settings
  2. Use local-only models
  3. Review AI logs before exporting
  4. Redact sensitive findings from AI context
  5. Document AI usage in engagement notes

Use Cases

Beginner Pentesters

Learning Mode:

  • Ask the AI to explain each step
  • Request command explanations
  • Get tool recommendations
  • Understand vulnerability context

Example Workflow:

  1. Run initial Nmap scan
  2. Ask AI: "What do these results mean?"
  3. AI explains each open port and service
  4. Ask: "What should I do next?"
  5. AI suggests enumeration techniques
  6. Follow step-by-step guidance

Experienced Practitioners

Automation:

  • Enable autonomous agents
  • Review AI recommendations
  • Use chat for quick references
  • Let AI handle routine enumeration

Example Workflow:

  1. Load session with 100+ hosts
  2. Enable Enumeration Agent
  3. Agent automatically scans all services
  4. Review AI-prioritized findings
  5. Focus manual effort on high-value targets

Red Team Operations

Offensive Planning:

  • AI suggests attack paths
  • Chains vulnerabilities
  • Recommends evasion techniques
  • Plans lateral movement

Example Workflow:

  1. Initial foothold on DMZ host
  2. Ask AI: "Map paths to domain controller"
  3. AI analyzes network topology
  4. Suggests multi-hop attack chain
  5. Provides specific commands for each step

Best Practices

Effective AI Usage

  • Be specific in questions: "How do I enumerate SMB on Windows 2019?" vs. "How do SMB?"
  • Provide context: Share relevant scan results or errors
  • Iterate on responses: Ask follow-up questions for clarity
  • Verify AI suggestions: Always validate commands before execution
  • Use agents for repetitive tasks: Let AI handle bulk enumeration

Security Considerations

  • Review agent actions: Don't blindly trust autonomous execution
  • Limit API exposure: Use separate keys for different sessions
  • Disable AI for sensitive tests: Client data protection is paramount
  • Audit AI decisions: Understand why AI made recommendations
  • Keep models updated: Newer models have better security awareness

Performance Optimization

  • Use appropriate depth: Quick analysis for broad sweeps, deep for targets
  • Cache frequent queries: AI remembers within session
  • Batch questions: Ask multiple things in one chat message
  • Limit concurrent agents: Too many can slow analysis

Troubleshooting

AI Not Responding

Check:

  • API key is valid and not expired
  • Network connectivity to AI service
  • Request hasn't timed out (increase timeout)
  • AI service isn't rate-limited

Poor Quality Responses

Try:

  • Rephrase question with more context
  • Switch to more capable model
  • Increase analysis depth setting
  • Provide example of expected output

Agent Not Taking Actions

Verify:

  • Agent is enabled in settings
  • Autonomy level allows execution
  • No conflicting permissions
  • Session has active hosts to analyze

Next Steps

With AI configured and running: