> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/pensarai/apex/llms.txt
> Use this file to discover all available pages before exploring further.

# targeted-pentest

> Execute focused penetration testing against specific security objectives

The `targeted-pentest` command runs a focused security assessment against specific testing objectives, ideal for investigating particular vulnerability classes or security concerns.

## Syntax

```bash theme={null}
pensar targeted-pentest --target <url> --objective <text> [--objective <text>...] [options]
```

## Description

Unlike the full `pentest` command which performs comprehensive attack surface discovery, `targeted-pentest` focuses exclusively on your specified objectives. This makes it ideal for:

* Testing specific vulnerability hypotheses
* Focused security audits
* Regression testing after security fixes
* Investigating specific attack vectors

## Required Options

<ParamField path="--target" type="string" required>
  Target URL, domain, or IP address to test

  **Examples**:

  * `https://example.com`
  * `http://192.168.1.100:8080`
  * `api.example.com`
</ParamField>

<ParamField path="--objective" type="string" required>
  Testing objective or security goal (repeatable)

  Define what you want to test. You can specify multiple objectives by using the flag multiple times.

  **Examples**:

  * `"Test for SQL injection in login form"`
  * `"Check authentication bypass vulnerabilities"`
  * `"Verify session management security"`
  * `"Test file upload restrictions"`

  <Note>
    At least one `--objective` is required. You can specify multiple objectives to test several attack vectors in a single run.
  </Note>
</ParamField>

## Optional Parameters

<ParamField path="--model" type="string">
  AI model to use for security analysis

  **Default**: `claude-sonnet-4-5`

  **Supported models**:

  * `claude-sonnet-4-5` (recommended)
  * `claude-opus-4-0`
  * `gpt-4o`
  * `gpt-4-turbo`
  * Custom models via OpenRouter or local vLLM

  **Example**:

  ```bash theme={null}
  --model gpt-4o
  ```
</ParamField>

## Examples

### Single Objective Testing

Test for SQL injection vulnerabilities:

```bash theme={null}
pensar targeted-pentest \
  --target https://example.com \
  --objective "Test for SQL injection in all input fields"
```

**Output**:

```
============================================================
TARGETED PENTEST
============================================================
Target:  https://example.com
Model:   claude-sonnet-4-5
Objectives:
  1. Test for SQL injection in all input fields

→ Analyzing target...
→ Testing login form
→ calling fetch_http
✓ fetch_http completed
→ calling execute_command
✓ Found SQL injection in username parameter

============================================================
RESULTS
============================================================
Findings:  3
Path:      /home/user/.pensar/sessions/jkl012/findings.json
POCs:      /home/user/.pensar/sessions/jkl012/pocs/
```

### Multiple Objectives

Test several security aspects in one run:

```bash theme={null}
pensar targeted-pentest \
  --target https://app.example.com \
  --objective "Test authentication mechanisms for bypass vulnerabilities" \
  --objective "Check for insecure direct object references (IDOR)" \
  --objective "Verify session management follows security best practices"
```

**Output**:

```
============================================================
TARGETED PENTEST
============================================================
Target:  https://app.example.com
Model:   claude-sonnet-4-5
Objectives:
  1. Test authentication mechanisms for bypass vulnerabilities
  2. Check for insecure direct object references (IDOR)
  3. Verify session management follows security best practices

→ Testing objective 1: Authentication bypass...
✓ No authentication bypass found
✓ Multi-factor authentication properly implemented

→ Testing objective 2: IDOR vulnerabilities...
→ calling fetch_http
✓ Found IDOR in /api/users/:id endpoint
✓ Found IDOR in /api/documents/:id endpoint

→ Testing objective 3: Session management...
✓ Found insecure session cookie (missing HttpOnly flag)
✓ Session tokens predictable via weak random number generator

============================================================
RESULTS
============================================================
Findings:  4
Path:      /home/user/.pensar/sessions/mno345/findings.json
POCs:      /home/user/.pensar/sessions/mno345/pocs/
```

### API Security Testing

Focus on REST API vulnerabilities:

```bash theme={null}
pensar targeted-pentest \
  --target https://api.example.com/v2 \
  --objective "Test API authentication and authorization" \
  --objective "Check for mass assignment vulnerabilities" \
  --objective "Verify rate limiting implementation"
```

### Custom Model Selection

Use a specific model for testing:

```bash theme={null}
pensar targeted-pentest \
  --target https://example.com \
  --objective "Test for XSS vulnerabilities" \
  --model gpt-4o
```

### Regression Testing

Verify that a security fix works:

```bash theme={null}
pensar targeted-pentest \
  --target https://staging.example.com \
  --objective "Verify CVE-2024-1234 SQL injection is patched in /api/search"
```

**Output**:

```
============================================================
TARGETED PENTEST
============================================================
Target:  https://staging.example.com
Model:   claude-sonnet-4-5
Objectives:
  1. Verify CVE-2024-1234 SQL injection is patched in /api/search

→ Testing /api/search endpoint...
→ Attempting SQL injection payloads
✓ Parameterized queries detected
✓ Input validation properly implemented
✓ SQL injection attack unsuccessful - vulnerability appears fixed

============================================================
RESULTS
============================================================
Findings:  0
Path:      /home/user/.pensar/sessions/pqr678/findings.json
POCs:      /home/user/.pensar/sessions/pqr678/pocs/
```

### File Upload Security

Test file upload functionality:

```bash theme={null}
pensar targeted-pentest \
  --target https://example.com \
  --objective "Test file upload for unrestricted file upload vulnerability" \
  --objective "Check if uploaded files can be executed" \
  --objective "Verify file type validation"
```

## Output Files

The targeted-pentest command generates output files in the session directory:

### findings.json

JSON file with discovered vulnerabilities:

```json theme={null}
[
  {
    "id": "vuln-001",
    "title": "IDOR in User Profile API",
    "severity": "high",
    "cvss": 8.1,
    "description": "The /api/users/:id endpoint allows unauthorized access...",
    "objective": "Check for insecure direct object references (IDOR)",
    "poc": "pocs/idor-user-profile.py",
    "remediation": "Implement proper authorization checks..."
  }
]
```

### pocs/

Proof-of-concept exploit scripts:

```bash theme={null}
pocs/
├── idor-user-profile.py
└── session-cookie-theft.sh
```

## Use Cases

<Tabs>
  <Tab title="Hypothesis Testing">
    Test a specific vulnerability theory:

    ```bash theme={null}
    pensar targeted-pentest \
      --target https://example.com \
      --objective "Test if JWT tokens are properly validated"
    ```

    Perfect for:

    * Security research
    * Validating suspicions
    * Focused investigations
  </Tab>

  <Tab title="Compliance Audits">
    Verify specific security requirements:

    ```bash theme={null}
    pensar targeted-pentest \
      --target https://example.com \
      --objective "Verify OWASP Top 10 compliance for authentication" \
      --objective "Check PCI-DSS requirement 6.5.1 (injection flaws)"
    ```

    Useful for:

    * Regulatory compliance
    * Security certifications
    * Audit preparation
  </Tab>

  <Tab title="Regression Testing">
    Confirm security fixes:

    ```bash theme={null}
    pensar targeted-pentest \
      --target https://staging.example.com \
      --objective "Verify fix for SQL injection in search functionality"
    ```

    Ideal for:

    * Post-fix validation
    * CI/CD security gates
    * Continuous testing
  </Tab>

  <Tab title="Bug Bounty">
    Focus on high-value targets:

    ```bash theme={null}
    pensar targeted-pentest \
      --target https://example.com \
      --objective "Test admin panel for privilege escalation" \
      --objective "Check payment flow for logic flaws"
    ```

    Great for:

    * Bug bounty hunting
    * High-value target focus
    * Efficient time usage
  </Tab>
</Tabs>

## Objective Writing Tips

### Be Specific

<CodeGroup>
  ```bash Good theme={null}
  --objective "Test if the /api/users endpoint is vulnerable to SQL injection via the 'search' parameter"
  ```

  ```bash Too Vague theme={null}
  --objective "Test for vulnerabilities"
  ```
</CodeGroup>

### Include Context

<CodeGroup>
  ```bash Good theme={null}
  --objective "Verify that uploaded profile pictures cannot execute as PHP scripts"
  ```

  ```bash Lacks Context theme={null}
  --objective "Test file uploads"
  ```
</CodeGroup>

### Reference Standards

<CodeGroup>
  ```bash Good theme={null}
  --objective "Check for OWASP A01:2021 Broken Access Control in admin API endpoints"
  ```

  ```bash Less Effective theme={null}
  --objective "Check access control"
  ```
</CodeGroup>

## Comparison with Full Pentest

| Feature                  | `pentest`          | `targeted-pentest` |
| ------------------------ | ------------------ | ------------------ |
| Attack surface discovery | ✅ Automatic        | ❌ Manual           |
| Testing scope            | Comprehensive      | Focused            |
| Number of findings       | Many               | Specific           |
| Execution time           | Longer             | Faster             |
| Use case                 | Initial assessment | Hypothesis testing |
| Whitebox support         | ✅ Yes              | ❌ No               |

<Note>
  Use `pentest` for initial security assessments and `targeted-pentest` for focused investigations or regression testing.
</Note>

## Environment Variables

<ParamField path="ANTHROPIC_API_KEY" type="string">
  API key for Claude models (recommended)
</ParamField>

<ParamField path="OPENAI_API_KEY" type="string">
  API key for GPT models
</ParamField>

<ParamField path="OPENROUTER_API_KEY" type="string">
  API key for OpenRouter
</ParamField>

## Troubleshooting

### Objective Not Being Tested

If your objective isn't being addressed:

1. **Make it more specific**:
   ```bash theme={null}
   # Instead of:
   --objective "Test security"

   # Use:
   --objective "Test the login form at /login for SQL injection in username field"
   ```

2. **Break down complex objectives**:
   ```bash theme={null}
   # Instead of one complex objective, use multiple:
   --objective "Test authentication bypass" \
   --objective "Test authorization bypass" \
   --objective "Test session fixation"
   ```

### No Findings

If the test completes with no findings:

1. The target may be secure for the tested objectives ✅
2. Try rephrasing your objectives
3. Use the full `pentest` command for broader testing
4. Check logs: `~/.pensar/sessions/*/agent.log`

### Authentication Required

For authenticated testing:

```bash theme={null}
# Use the TUI for authentication setup:
pensar
# Then navigate to: Operator Dashboard > Auth Wizard
```

## Related Commands

* [pentest](/commands/pentest) - Comprehensive automated pentest
* [pensar](/commands/pensar) - Interactive TUI with manual control
* [doctor](/commands/doctor) - Check system configuration

## Next Steps

<CardGroup cols={2}>
  <Card title="Writing Objectives" icon="bullseye" href="/guides/writing-objectives">
    Learn to write effective security testing objectives
  </Card>

  <Card title="Interpreting Results" icon="magnifying-glass" href="/guides/interpreting-results">
    Understand and act on pentest findings
  </Card>
</CardGroup>