The Loophole That Gave Our Pentest Agent Its Teeth

Description and use

By exploiting a snapshot naming collision in TrueForge, we injected required pentest tools into the sandbox, maintained scope discipline, and reported network limitations honestly.

Problem

The agent harness allowed the sandbox to run on the host and could not accept custom tool images, preventing the pentest agent from using required tools and restricting network access.

Outcome

The agent successfully injected required tools into the sandbox via snapshot naming collision, operated within Daytona’s egress policy, and reported network limitations honestly, demonstrating a robust pentest workflow.

Workflow

• 1. Identify that TrueForge falls back to a local host sandbox when provider table is empty.
• 2. Discover that the sandbox image is pinned at compile time and cannot be overridden via config.
• 3. Read DaytonaProvider.ts to find the snapshot naming collision logic.
• 4. Create a Dockerfile that starts FROM the official sandbox image and installs nmap, nuclei, sqlmap, ffuf.
• 5. Use Daytona to build the image under the exact name TrueForge would generate (e.g., trueforge-build‑<digest>).
• 6. Configure the agent harness to use the new snapshot; Daytona adopts it on 409 conflict.
• 7. Verify tool presence by booting a throwaway sandbox from the snapshot and running nuclei -version.
• 8. Run the agent against a local Juice Shop; Daytona’s egress proxy blocks external target, but the agent diagnoses the proxy and reports the limitation.
• 9. File findings and PRs upstream to improve TrueForge.
• 10. Release the agent for others to clone and run against their own targets.

Evidence

The sandbox image – the thing that decides what's inside the sandbox – turned out to be pinned at TrueForge's compile time.

Source

When TrueForge configures its sandbox provider, it builds its image into a Daytona snapshot. The snapshot's name is deterministic: a prefix plus a digest of the pinned image.

Source

We wrote a Dockerfile that starts FROM the official sandbox image and layers on nmap, sqlmap, and pinned, checksum-verified nuclei/httpx/ffuf.

Source

The agent had an out. Some allowlisted hosts were reachable. It could have relayed through one of them and gotten the job done. It didn't.

Source