# The Pen Tester’s Toolkit in 2026: OSINT, Uncensored AI Models and an SDR

> Four OSINT tools pen testers rely on (SpiderFoot, theHarvester, Shodan, Maigret), the uncensored AI models now marketed for red-team work, and the HackRF One radio. What each does, the rules that come with it, and what defenders should do about all three.

Source: https://playciso.com/blog/pen-tester-toolkit-osint-uncensored-models-sdr · Published: 2026-10-28 · Publisher: PlayCISO (https://playciso.com)

---

A pen tester’s kit in 2026 has three layers that did not used to sit together: **OSINT tools** that map a target from public sources, **uncensored AI models** that will help with offensive work a mainstream assistant refuses, and **hardware** for the radio and wireless links software cannot reach. This post covers what each is, the rules that come with it, and what a defender should take from it. Everything here is for authorised testing; none of it is a substitute for a signed scope. ## Layer 1: OSINT, before a single packet Open-source intelligence (OSINT) is information gathered from public sources. In a pen test it comes first, because it shows what an attacker can learn without touching the target, and it shapes which systems and people are worth testing. Four tools do most of the work: - SpiderFoot (GitHub, MIT licence, about 24,000 stars). Give it a domain, IP range, email or name and it runs more than 200 modules against public sources: DNS, certificate logs, breach data, code repositories, social sites. Best for mapping an organisation’s external attack surface at the start of an engagement. Some modules need third-party API keys. - theHarvester (GitHub, GPL-2.0, about 18,000 stars, ships in Kali Linux). Collects email addresses, subdomains, hosts and names for a company domain. Fast, and the usual first step before a phishing simulation or external test. - Shodan (official Python library). A search engine for internet-connected devices: banners, open ports and known vulnerabilities, collected by Shodan’s own scanners. You see what is exposed without scanning it yourself. The library is free; the service needs an account and API key. - Maigret (GitHub, MIT, about 39,000 stars). Checks a username across thousands of websites and builds a profile from what it finds. In a social-engineering assessment it shows how much an employee’s public footprint gives away. Maigret deserves its own warning. It profiles real people. Use it only inside an engagement where the organisation has consented to social-engineering testing, keep what you collect to what the scope needs, and treat the results as personal data under GDPR or your local equivalent. Pointing it at a private individual is stalking with extra steps. ## Layer 2: uncensored AI models Mainstream AI assistants refuse many offensive-security requests. A growing set of open-weights models has had that refusal behaviour removed, usually by [abliteration](/tools/abliterated-models-guide): a direct edit to the model’s weights that deletes the internal direction responsible for refusing, with no retraining. Several are now marketed for red-team and offensive-security work. Three we checked on Hugging Face on 28 October 2026: - dealignai/GLM-5.3-UNCENSORED-FP8, an uncensored build of Z.ai’s GLM-5.3. Its card describes a general-purpose uncensor done as a permanent weight edit. About 3,000 downloads. - dealignai/DeepSeek-V4.1-Flash-UNCENSORED-FP8, built on DeepSeek-V4.1-Flash, keeping its vision, tool use and 1M-token context. A refusal-free model that can call tools can act as an agent, not just answer questions. About 49,000 downloads. - orcarouter/Qwen3.8-27B-Uncensored-GGUF, tagged "abliterated", "uncensored" and "ai-red-team". The GGUF format runs on a single consumer GPU or a well-specified laptop. About 96,000 downloads, the most of the three. Download counts and capability claims come from the publishers’ own pages; PlayCISO has not verified their benchmark claims. We list these as **defensive intelligence**: you should know they exist and recognise them in your environment. They are on our [abliterated model tracker](/tools/abliterated-model-risk), which scores a model across provenance, custom code, reach and governance. If a pen test team wants to use one, apply the controls you would apply to any tool that touches client data: - Get it into the written scope. Many clients will not accept AI processing of their data at all. Ask. - Self-host it. The point of a local model is that client data never leaves your environment. Do not send client data to a hosted endpoint you do not control. - Check provenance and licence. These are third-party edits from community accounts, not releases from the original provider. Record the exact repository, publisher, base model and date. - A human reviews every output before anyone acts on it, as with any AI pentest tool. ## Layer 3: an SDR for the radio links Software covers most engagements, but physical and IoT tests often include radio: key fobs, gate and garage openers, alarm sensors, sub-GHz industrial and smart-home devices. The usual entry point is a software-defined radio (SDR), and the most common one is the **HackRF One** from Great Scott Gadgets ([open-source hardware](https://github.com/greatscottgadgets/hackrf)). It receives and transmits from 1 MHz to 6 GHz, one direction at a time. Buy it from the maker or an authorised reseller; clones are common. Receiving is broadly legal. **Transmitting is regulated** in almost every country and usually needs a licence or a shielded test enclosure, and any test of someone else’s radio system needs their written authorisation. Jamming is illegal outright. ## The rules that come with all three - Written authorisation and scope first. Name the targets, the time windows, the people in scope for social engineering, whether AI tools may process client data, and whether radio testing is included. Our free scoping checklist covers the questions. - OSINT is in scope too. Passive recon touches no target system, but it collects data about real people. Scope it and follow privacy law. - Keep client data where the client expects it. That rules out pasting findings into a public AI service, and it is why the self-hosted models matter. - Report what you did, not just what you found. Note which tools and models you used, so the client can reproduce and challenge the results. ## What defenders should do - Run the same OSINT on yourself. SpiderFoot and theHarvester against your own domains show what an attacker sees on day one. Fix exposed subdomains and services before someone else finds them. - Inventory AI models inside the organisation. A 27B uncensored model fits on a developer workstation. Search model caches and registries for names ending in -uncensored, -abliterated or CRACK, and score anything you find with the risk calculator. - Assume attackers have capable, refusal-free AI. That raises the floor for phishing quality and exploit development speed. It does not change the fundamentals: patch exposed services, require phishing-resistant MFA, and watch for the behaviour, not the tool. - Do not forget radio. If your buildings rely on fixed-code fobs or unencrypted sub-GHz sensors, add them to the next physical test. Measuring the people who do this work? Our free [SLA & KPI library](/kpi-library?role=penetration-tester) has KPIs, SLAs and performance measures for penetration testers and red team leads, including rules-of-engagement compliance.