The Pen Tester’s Toolkit in 2026: OSINT, Uncensored AI Models and an SDR
A modern pen tester’s kit has three layers. OSINT tools map the target from public sources before any packet is sent: SpiderFoot (MIT, 24k GitHub stars) automates hundreds of lookups, theHarvester (GPL-2.0, ships in Kali) finds exposed mailboxes and subdomains, Shodan shows what is already visible on the internet, and Maigret (MIT, 39k stars) checks a username across thousands of sites for social-engineering assessments. Uncensored AI models, built by stripping the refusal behaviour out of open-weights models, are now marketed for red-team use: dealignai publishes uncensored GLM-5.3 and DeepSeek-V4.1-Flash builds, and orcarouter’s Qwen3.8-27B-Uncensored-GGUF, which runs on a single consumer GPU, had about 96,000 downloads when we checked. For radio work, the HackRF One software-defined radio covers 1 MHz to 6 GHz. Every one of these needs written authorisation and a scope; people-search touches privacy law and radio transmission needs a licence. Defenders should run the same OSINT on themselves, inventory any uncensored model inside the organisation, and treat these models as a reason to expect more capable attackers, not as a reason to panic.
A pen tester’s kit in 2026 has three layers that did not used to sit together: OSINT tools that map a target from public sources, uncensored AI models that will help with offensive work a mainstream assistant refuses, and hardware for the radio and wireless links software cannot reach. This post covers what each is, the rules that come with it, and what a defender should take from it. Everything here is for authorised testing; none of it is a substitute for a signed scope.
Layer 1: OSINT, before a single packet
Open-source intelligence (OSINT) is information gathered from public sources. In a pen test it comes first, because it shows what an attacker can learn without touching the target, and it shapes which systems and people are worth testing. Four tools do most of the work:
- SpiderFoot (GitHub, MIT licence, about 24,000 stars). Give it a domain, IP range, email or name and it runs more than 200 modules against public sources: DNS, certificate logs, breach data, code repositories, social sites. Best for mapping an organisation’s external attack surface at the start of an engagement. Some modules need third-party API keys.
- theHarvester (GitHub, GPL-2.0, about 18,000 stars, ships in Kali Linux). Collects email addresses, subdomains, hosts and names for a company domain. Fast, and the usual first step before a phishing simulation or external test.
- Shodan (official Python library). A search engine for internet-connected devices: banners, open ports and known vulnerabilities, collected by Shodan’s own scanners. You see what is exposed without scanning it yourself. The library is free; the service needs an account and API key.
- Maigret (GitHub, MIT, about 39,000 stars). Checks a username across thousands of websites and builds a profile from what it finds. In a social-engineering assessment it shows how much an employee’s public footprint gives away.
Maigret deserves its own warning. It profiles real people. Use it only inside an engagement where the organisation has consented to social-engineering testing, keep what you collect to what the scope needs, and treat the results as personal data under GDPR or your local equivalent. Pointing it at a private individual is stalking with extra steps.
Layer 2: uncensored AI models
Mainstream AI assistants refuse many offensive-security requests. A growing set of open-weights models has had that refusal behaviour removed, usually by abliteration: a direct edit to the model’s weights that deletes the internal direction responsible for refusing, with no retraining. Several are now marketed for red-team and offensive-security work. Three we checked on Hugging Face on 28 October 2026:
- dealignai/GLM-5.3-UNCENSORED-FP8, an uncensored build of Z.ai’s GLM-5.3. Its card describes a general-purpose uncensor done as a permanent weight edit. About 3,000 downloads.
- dealignai/DeepSeek-V4.1-Flash-UNCENSORED-FP8, built on DeepSeek-V4.1-Flash, keeping its vision, tool use and 1M-token context. A refusal-free model that can call tools can act as an agent, not just answer questions. About 49,000 downloads.
- orcarouter/Qwen3.8-27B-Uncensored-GGUF, tagged "abliterated", "uncensored" and "ai-red-team". The GGUF format runs on a single consumer GPU or a well-specified laptop. About 96,000 downloads, the most of the three.
Download counts and capability claims come from the publishers’ own pages; PlayCISO has not verified their benchmark claims. We list these as defensive intelligence: you should know they exist and recognise them in your environment. They are on our abliterated model tracker, which scores a model across provenance, custom code, reach and governance.
If a pen test team wants to use one, apply the controls you would apply to any tool that touches client data:
- Get it into the written scope. Many clients will not accept AI processing of their data at all. Ask.
- Self-host it. The point of a local model is that client data never leaves your environment. Do not send client data to a hosted endpoint you do not control.
- Check provenance and licence. These are third-party edits from community accounts, not releases from the original provider. Record the exact repository, publisher, base model and date.
- A human reviews every output before anyone acts on it, as with any AI pentest tool.
Layer 3: an SDR for the radio links
Software covers most engagements, but physical and IoT tests often include radio: key fobs, gate and garage openers, alarm sensors, sub-GHz industrial and smart-home devices. The usual entry point is a software-defined radio (SDR), and the most common one is the HackRF One from Great Scott Gadgets (open-source hardware). It receives and transmits from 1 MHz to 6 GHz, one direction at a time. Buy it from the maker or an authorised reseller; clones are common.
Receiving is broadly legal. Transmitting is regulated in almost every country and usually needs a licence or a shielded test enclosure, and any test of someone else’s radio system needs their written authorisation. Jamming is illegal outright.
The rules that come with all three
- Written authorisation and scope first. Name the targets, the time windows, the people in scope for social engineering, whether AI tools may process client data, and whether radio testing is included. Our free scoping checklist covers the questions.
- OSINT is in scope too. Passive recon touches no target system, but it collects data about real people. Scope it and follow privacy law.
- Keep client data where the client expects it. That rules out pasting findings into a public AI service, and it is why the self-hosted models matter.
- Report what you did, not just what you found. Note which tools and models you used, so the client can reproduce and challenge the results.
What defenders should do
- Run the same OSINT on yourself. SpiderFoot and theHarvester against your own domains show what an attacker sees on day one. Fix exposed subdomains and services before someone else finds them.
- Inventory AI models inside the organisation. A 27B uncensored model fits on a developer workstation. Search model caches and registries for names ending in -uncensored, -abliterated or CRACK, and score anything you find with the risk calculator.
- Assume attackers have capable, refusal-free AI. That raises the floor for phishing quality and exploit development speed. It does not change the fundamentals: patch exposed services, require phishing-resistant MFA, and watch for the behaviour, not the tool.
- Do not forget radio. If your buildings rely on fixed-code fobs or unencrypted sub-GHz sensors, add them to the next physical test.
Measuring the people who do this work? Our free SLA & KPI library has KPIs, SLAs and performance measures for penetration testers and red team leads, including rules-of-engagement compliance.
Frequently asked questions
What OSINT tools do penetration testers use?
The common open-source set is SpiderFoot for automated attack-surface mapping, theHarvester for exposed email addresses and subdomains, and Maigret for checking a username across thousands of public sites. Shodan, a commercial search service with an official Python library, shows which devices and services are already exposed to the internet. All are used at the start of an authorised engagement, before active testing.
What is an uncensored or abliterated AI model?
An open-weights language model whose refusal behaviour has been removed, usually by editing the weights directly (abliteration) rather than by retraining. It answers requests the original model would decline. Several are published on Hugging Face and marketed for offensive security and red-team work. They are third-party edits, not releases from the original model provider.
Should a pen test team use uncensored AI models?
Only with the same controls as any other tool that touches client data: written approval in the engagement scope, a self-hosted deployment so client data never leaves your environment, and a human reviewing every output before it is acted on. Many clients will not allow it at all, so ask. Check each model’s licence and provenance before it enters your toolkit.
Is it legal to own a HackRF One?
Owning and receiving with a software-defined radio is legal in most countries. Transmitting is regulated almost everywhere and usually needs a licence or a shielded test enclosure, and testing someone else’s radio systems needs their written authorisation. Jamming is illegal.
Ready to practise the decisions these articles describe?
Run your first War Room free →One run free with a free account · more runs with Pro