GreyDGL / PentestGPT

A GPT-empowered penetration testing tool
MIT License
7.28k stars 883 forks source link

Suspicious on using GPT-4-Turbo #204

Closed DailyPS closed 7 months ago

DailyPS commented 7 months ago

In General Updates, PentestGPT is using GPT-4-Turbo for default. But when I looked the code, I'm suspicious about that.

In pentest_gpt.py line 64, 65 set default gpt-4-1105-preview for reasoning model and parsing model

reasoning_model="gpt-4-1106-preview",
parsing_model="gpt-4-1106-preview",

Continuously same line 80 to 88, models call dynamic_import for calling model.

reasoning_model_object = dynamic_import(
   reasoning_model, self.log_dir, use_langfuse_logging=use_langfuse_logging
)
generation_model_object = dynamic_import(
   reasoning_model, self.log_dir, use_langfuse_logging=use_langfuse_logging
)
parsing_model_object = dynamic_import(
    parsing_model, self.log_dir, use_langfuse_logging=use_langfuse_logging
)

Function dynamic_import in module_import.py has conditional branch which checks if module name is in module_mapping. But, there are no element that named gpt-4-1106-preview but named gpt-4-turbo.

    "gpt-4-turbo": {
        "config_name": "GPT4Turbo",
        "module_name": "chatgpt_api",
        "class_name": "ChatGPTAPI",
    },

I think this would make condition false and PentestGPT would not run on GPT-4-Turbo, instead running on GPT-3.5-Turbo.

Based on the reasons I explained, I'm suspicious about does PentestGPT support GPT-4-Turbo properly.

GreyDGL commented 7 months ago

Hi thanks for raising this issue. When you run pentestgpt in the terminal, by default it will pass the arguments with settings in main.py (https://github.com/GreyDGL/PentestGPT/blob/main/pentestgpt/main.py) and the default setting will be gpt-4-turbo for both reasoning and parsing modules.

This will further import class GPT4Turbo (line 65) in module_import.py and print out the model name gpt-4-1106-preview.

I think I'll just fix the default setting in pentest_gpt.py line 64, 65 to avoid any false imports.