PathFinder & one-shot-enum

• 

  Attack Path 1

• 

  Attack Path 2

• 

  Attack Path 3

• 

  Findings 1

• 

  Findings 2

• 

  Findings 3

• 

  one-shot-enum Service Enumeration 1

• 

  one-shot-enum Service Enumeration 2

• 

  one-shot-enum Service Enumeration 3

• 

  PathFinder Startup

• 

  PathFinder Recon Plan

• 

  PathFinder Recon In Progress

• 

  Parsing Data

• 

  PathFinder Credential Validation

• 

  PathFinder Report

Inspiration

After taking my OSCP exam, I felt overwhelmed by the sheer amount of enumeration required before I could even begin thinking about how to gain a foothold. Pentesting tools generate enormous amounts of useful information, but connecting those separate findings into something actionable remains a largely manual process.

I wanted to create a tool that could ingest that noise, connect the dots between different enumeration results, and point the tester in the right direction.

What it does

PathFinder turns raw pentesting and AI system enumeration output into prioritized, evidence backed next steps.

Its companion tool, one-shot-enum (also listed in the Try it out section below), performs broad first pass discovery across traditional infrastructure and AI attack surfaces. PathFinder then parses and normalizes the resulting evidence, correlating services, credentials, web content, Active Directory data, privilege escalation findings, and AI components.

Rather than replacing established tools such as Nmap or BloodHound, PathFinder connects their results.

How I built it

I built PathFinder iteratively. I started with common enumeration outputs, developed a normalized finding format, and added rules capable of correlating findings into useful next step recommendations.

I continually expanded its coverage by identifying gaps, adding parsers and attack rules, running it against realistic lab environments, reviewing the results, and refining areas that generated incomplete or noisy recommendations.

Code reviews, regression tests, real world output samples, and repeated lab testing helped me improve parser reliability and keep recommendations grounded in the underlying evidence.

Challenges I ran into

One of the biggest challenges was supporting the wide range of popular open source pentesting tools. Each tool uses different output formats, terminology, schemas, and levels of structure - and those formats can change between versions.

The harder challenge was connecting the dots between them. An individual result may appear insignificant in isolation but become highly actionable when correlated with a discovered service, credential, user, share, vulnerability, or AI component.

I also had to balance useful recommendations against noise. PathFinder needed to identify promising next steps without inventing speculative attack chains or overwhelming the tester with every theoretical possibility.

Accomplishments that I'm proud of

I am proud that PathFinder has grown beyond a collection of parsers into a practical correlation and prioritization engine.

It can process evidence from traditional network and web enumeration, Active Directory tooling, credential discovery, privilege escalation checks, and AI system reconnaissance. It preserves the original evidence while converting disconnected findings into clear, prioritized actions.

I am also proud of the integration with one-shot-enum, which provides a streamlined workflow from initial discovery through evidence collection and next step analysis.

What I learned

I learned a great deal about normalizing inconsistent security tool output and designing a common finding format that preserves enough context for meaningful correlation.

I also learned how difficult it is to synthesize reliable attack opportunities. Good recommendations require more than matching keywords. They require understanding identities, hosts, services, credentials, trust relationships, confidence levels, and the conditions needed for an action to succeed.

Most importantly, I learned that effective security automation should support the tester’s judgement rather than attempt to replace it.

What's next for PathFinder

My next priority is ensuring that existing parsers remain robust as external tools and their output formats evolve.

I also plan to:

• Add parsers for newly released and widely adopted enumeration tools
• Expand the attack rule library as new techniques and technologies emerge
• Improve correlation between credential validation and subsequent enumeration
• Continue testing against realistic labs and real world output samples
• Expand coverage of emerging AI agents, RAG pipelines, MCP services, and AI infrastructure

My long term goal is to make PathFinder a dependable bridge between enumeration and human decision making. A tool that helps security testers spend less time sorting through output and more time investigating the right opportunities (and to help those taking their OSCP+!).

Built with Codex during Build Week

PathFinder existed before Build Week as an enumeration parser. During Build Week, I used Codex and GPT-5.6 to substantially extend it by expanding parser coverage, strengthening cross tool correlation, integrating one-shot-enum, improving AI system coverage, adding regression tests, and creating reproducible reports.

I directed the product and security decisions, while Codex accelerated implementation.

Links to the one-shot-enum and PathFinder repositories are available in the Try it out section below. The screenshots in the image gallery and the video demo show both tools being tested against an isolated Metasploitable 2 lab.

Built With

• python