pwn 0.5.613 → 0.5.617

data/documentation/Diagrams.md

@@ -0,0 +1,140 @@
+# PWN Data-Flow Diagrams
+
+26 SVG diagrams, all rendered from Graphviz sources in
+[`diagrams/dot/`](diagrams/dot/) with a single shared visual theme
+(see [`_THEME.md`](diagrams/dot/_THEME.md)). Rebuild everything with:
+
+```bash
+cd documentation/diagrams && ./build.sh
+```
+
+Every diagram uses strict layer→layer edges (`newrank=true` + `{rank=same}`
+groups) so lines never criss-cross.
+
+---
+
+## 1 · Architecture
+
+### Overall PWN Architecture
+[source](diagrams/dot/overall-pwn-architecture.dot) · doc: [How PWN Works](How-PWN-Works.md)
+![overall-pwn-architecture](diagrams/overall-pwn-architecture.svg)
+
+### `~/.pwn/` Persistence Map
+[source](diagrams/dot/persistence-filesystem.dot) · doc: [Persistence](Persistence.md)
+![persistence-filesystem](diagrams/persistence-filesystem.svg)
+
+### Plugin Ecosystem (66 modules)
+[source](diagrams/dot/plugin-ecosystem.dot) · doc: [Plugins](Plugins.md)
+![plugin-ecosystem](diagrams/plugin-ecosystem.svg)
+
+---
+
+## 2 · Entry Points
+
+### `pwn` REPL Prototyping
+[source](diagrams/dot/pwn-repl-prototyping.dot) · doc: [pwn REPL](pwn-REPL.md)
+![pwn-repl-prototyping](diagrams/pwn-repl-prototyping.svg)
+
+### REPL History → Reusable Driver / Skill
+[source](diagrams/dot/history-to-drivers.dot) · doc: [Drivers](Drivers.md)
+![history-to-drivers](diagrams/history-to-drivers.svg)
+
+### Driver Anatomy (`bin/pwn_*`)
+[source](diagrams/dot/driver-framework.dot) · doc: [CLI Drivers](CLI-Drivers.md)
+![driver-framework](diagrams/driver-framework.svg)
+
+---
+
+## 3 · AI Agent
+
+### pwn-ai Closed Self-Improvement Loop
+[source](diagrams/dot/pwn-ai-feedback-learning-loop.dot) · doc: [Skills, Memory & Learning](Skills-Memory-Learning.md)
+![pwn-ai-feedback-learning-loop](diagrams/pwn-ai-feedback-learning-loop.svg)
+
+### Multi-Provider LLM Integration
+[source](diagrams/dot/ai-integration-tool-calling.dot) · doc: [AI Integration](AI-Integration.md)
+![ai-integration-tool-calling](diagrams/ai-integration-tool-calling.svg)
+
+### Agent Tool Registry (10 toolsets)
+[source](diagrams/dot/agent-tool-registry.dot) · doc: [Agent Tool Registry](Agent-Tool-Registry.md)
+![agent-tool-registry](diagrams/agent-tool-registry.svg)
+
+### Memory · Skills · Sessions Detail
+[source](diagrams/dot/memory-skills-detailed.dot) · doc: [Skills, Memory & Learning](Skills-Memory-Learning.md)
+![memory-skills-detailed](diagrams/memory-skills-detailed.svg)
+
+### Extrospection — World Awareness
+[source](diagrams/dot/extrospection-world-awareness.dot) · doc: [Extrospection](Extrospection.md)
+![extrospection-world-awareness](diagrams/extrospection-world-awareness.svg)
+
+### Swarm — Native Multi-Agent
+[source](diagrams/dot/swarm-multi-agent.dot) · doc: [Swarm](Swarm.md)
+![swarm-multi-agent](diagrams/swarm-multi-agent.svg)
+
+### Cron — Scheduled Jobs
+[source](diagrams/dot/cron-scheduling.dot) · doc: [Cron](Cron.md)
+![cron-scheduling](diagrams/cron-scheduling.svg)
+
+### Sessions ↔ Cron ↔ Swarm Continuity
+[source](diagrams/dot/sessions-cron-automation.dot) · doc: [Sessions](Sessions.md)
+![sessions-cron-automation](diagrams/sessions-cron-automation.svg)
+
+---
+
+## 4 · Security Workflows
+
+### End-to-End Penetration Test
+[source](diagrams/dot/penetration-testing-workflow.dot)
+![penetration-testing-workflow](diagrams/penetration-testing-workflow.svg)
+
+### Web Application Testing
+[source](diagrams/dot/web-application-testing.dot) · doc: [BurpSuite](BurpSuite.md)
+![web-application-testing](diagrams/web-application-testing.svg)
+
+### Burp ⭐ vs ZAP Selection
+[source](diagrams/dot/burp-vs-zap-preference.dot)
+![burp-vs-zap-preference](diagrams/burp-vs-zap-preference.svg)
+
+### Network & Infrastructure Testing
+[source](diagrams/dot/network-infra-testing.dot) · doc: [NmapIt](NmapIt.md)
+![network-infra-testing](diagrams/network-infra-testing.svg)
+
+### SAST / Code Scanning
+[source](diagrams/dot/code-scanning-sast.dot) · doc: [SAST](SAST.md)
+![code-scanning-sast](diagrams/code-scanning-sast.svg)
+
+### Fuzzing
+[source](diagrams/dot/fuzzing-workflow.dot) · doc: [Fuzzing](Fuzzing.md)
+![fuzzing-workflow](diagrams/fuzzing-workflow.svg)
+
+### Reverse Engineering & Binary Exploitation
+[source](diagrams/dot/reverse-engineering-flow.dot) · doc: [Hardware](Hardware.md)
+![reverse-engineering-flow](diagrams/reverse-engineering-flow.svg)
+
+### Zero-Day Research Lifecycle
+[source](diagrams/dot/zero-day-research-flow.dot)
+![zero-day-research-flow](diagrams/zero-day-research-flow.svg)
+
+### Reporting Pipeline
+[source](diagrams/dot/reporting-pipeline.dot) · doc: [Reporting](Reporting.md)
+![reporting-pipeline](diagrams/reporting-pipeline.svg)
+
+---
+
+## 5 · Domain-Specific
+
+### AWS Cloud Security (90 services)
+[source](diagrams/dot/aws-cloud-security.dot) · doc: [AWS](AWS.md)
+![aws-cloud-security](diagrams/aws-cloud-security.svg)
+
+### SDR / Radio Hacking
+[source](diagrams/dot/sdr-radio-flow.dot) · doc: [SDR](SDR.md)
+![sdr-radio-flow](diagrams/sdr-radio-flow.svg)
+
+### Hardware & Physical-Layer
+[source](diagrams/dot/hardware-hacking.dot) · doc: [Hardware](Hardware.md)
+![hardware-hacking](diagrams/hardware-hacking.svg)
+
+---
+
+[← Back to Home](Home.md)

data/documentation/Drivers.md

@@ -0,0 +1,25 @@
+# Drivers & Custom Automation
+
+`PWN::Driver` and the `/opt/pwn/bin/` directory provide patterns for packaging reusable security automation.
+
+## What is a Driver?
+
+A self-contained Ruby script or gem that:
+- Loads the `pwn` environment
+- Orchestrates multiple plugins, AI calls, or custom logic
+- Can be scheduled via cron or run standalone
+
+## Examples
+
+Look in `/opt/pwn/bin/` (shipped with the gem).
+
+## Creating New Drivers
+
+1. Study existing examples in `bin/`.
+2. Use `PWN::Driver` helpers where appropriate.
+3. Leverage the full plugin + AI surface.
+4. Distill recurring successful patterns into **Skills**.
+
+Drivers + Skills + Agent = extremely powerful autonomous red teaming / research platform.
+
+[[Diagrams]]

data/documentation/General-PWN-Usage.md

@@ -0,0 +1,60 @@
+# General Usage — Day-One Cheat Sheet
+
+## Launch
+
+```bash
+$ pwn                         # interactive REPL
+$ pwn --ai "scan 10.0.0.0/24 with NmapIt and summarise open services"
+$ pwn_nmap_discover_tcp_udp -t 10.0.0.0/24 -o out/   # headless driver
+```
+
+## Inside the REPL
+
+```ruby
+PWN.help                            # top-level help
+PWN::Plugins.constants.sort         # list all 66 plugins
+PWN::Plugins::NmapIt.help           # per-plugin usage
+ls PWN::Plugins::BurpSuite          # Pry: list methods
+show-source PWN::SAST::SQL.scan     # Pry: read the code
+history                             # what you've typed → copy into a driver
+```
+
+## Custom REPL commands
+
+| Command | Does |
+|---|---|
+| `pwn-ai` | Enter the agent TUI (SHIFT+ENTER = newline, ENTER = submit) |
+| `pwn-asm` | Multi-line assembly ↔ opcode workbench |
+| `pwn-ai-memory` | Inspect / edit `~/.pwn/memory.json` |
+| `pwn-ai-sessions` | List / view / delete transcripts |
+| `pwn-ai-cron` | List / run scheduled jobs |
+| `pwn-ai-delegate` | Hand a task to a Swarm persona |
+| `welcome-banner` | Redraw a random `PWN::Banner` |
+| `toggle-pager` | Pry pager on/off |
+
+## A 60-second attack chain
+
+```ruby
+# 1. discover
+nmap = PWN::Plugins::NmapIt.port_scan(target: 'scanme.nmap.org')
+
+# 2. drive traffic through Burp
+burp = PWN::Plugins::BurpSuite.start(headless: true)
+b    = PWN::Plugins::TransparentBrowser.open(
+         browser_type: :headless, proxy: 'http://127.0.0.1:8080')
+b[:browser].goto 'http://scanme.nmap.org'
+
+# 3. active scan
+scan = PWN::Plugins::BurpSuite.active_scan(burp_obj: burp,
+         target_url: 'http://scanme.nmap.org')
+
+# 4. report
+PWN::Reports::SAST.generate(dir_path: '/tmp/src', output_dir: '/tmp/out')
+```
+
+Then say the same thing in English inside `pwn-ai` and watch the agent do it.
+
+**Next:** [pwn REPL](pwn-REPL.md) · [pwn-ai Agent](pwn-ai-Agent.md) ·
+[CLI Drivers](CLI-Drivers.md)
+
+[← Home](Home.md)

data/documentation/Home.md

@@ -0,0 +1,78 @@
+# PWN Documentation
+
+> **PWN** (/pōn/) — an open-source offensive-security automation framework and
+> continuous-security-integration platform written in Ruby.
+> 66 plugins · 48 SAST rules · 90 AWS wrappers · 21 WWW drivers · 52 CLI
+> drivers · 5 LLM engines · a self-improving multi-agent AI · one REPL.
+
+**Repo root:** `/opt/pwn` · **This wiki:** `/opt/pwn/documentation/` ·
+**Rebuild diagrams:** `documentation/diagrams/build.sh`
+
+---
+
+## 🗺️ Start Here
+
+| | |
+|---|---|
+| [What is PWN](What-is-PWN.md) | One-paragraph elevator pitch |
+| [Why PWN](Why-PWN.md) | Design philosophy — why another framework |
+| [How PWN Works](How-PWN-Works.md) | The five layers, with the architecture diagram |
+| [Installation](Installation.md) | RVM, gem, `./install.sh`, first launch |
+| [General Usage](General-PWN-Usage.md) | Day-one cheat sheet |
+| [Configuration](Configuration.md) | `~/.pwn/config.yml` — engines, keys, agent options |
+| **[All Data-Flow Diagrams](Diagrams.md)** | **26 SVGs** in one scrollable page |
+
+## 🚪 Entry Points
+
+| | |
+|---|---|
+| [The `pwn` REPL](pwn-REPL.md) | Pry shell with the whole `PWN::` namespace pre-loaded |
+| [`pwn-ai` Autonomous Agent](pwn-ai-Agent.md) | Natural-language TUI + `pwn --ai PROMPT` one-shot |
+| [CLI Drivers `bin/pwn_*`](CLI-Drivers.md) | 52 headless executables for CI/CD |
+| [Drivers (build your own)](Drivers.md) | Turn a REPL session into a shipped binary |
+
+## 🤖 AI Subsystem  (`PWN::AI`)
+
+| | |
+|---|---|
+| [AI / LLM Integration](AI-Integration.md) | OpenAI · Anthropic · Grok (OAuth) · Gemini · Ollama |
+| [Agent Tool Registry](Agent-Tool-Registry.md) | 10 toolsets · 45+ LLM-callable tools |
+| [Memory · Skills · Learning](Skills-Memory-Learning.md) | Introspection — the self-improvement loop |
+| [Extrospection](Extrospection.md) | World-awareness — snapshot · drift · intel · correlate |
+| [Swarm (Multi-Agent)](Swarm.md) | Personas · ask · debate · broadcast · shared bus |
+| [Sessions](Sessions.md) | Transcript persistence + reflection |
+| [Cron](Cron.md) | Scheduled autonomous jobs |
+
+## 🧩 Capability Namespaces  (`lib/pwn/*`)
+
+| | |
+|---|---|
+| [Plugins (66)](Plugins.md) | Every `PWN::Plugins::*` module by category |
+|   ↳ [BurpSuite](BurpSuite.md) ⭐ | Preferred web proxy / scanner |
+|   ↳ [TransparentBrowser](Transparent-Browser.md) | Headless / visible browser automation |
+|   ↳ [NmapIt](NmapIt.md) | Network discovery |
+|   ↳ [Metasploit](Metasploit.md) | RPC exploitation |
+|   ↳ [Fuzzing](Fuzzing.md) | `Fuzz` · `Sock` · `Packet` |
+|   ↳ [Hardware](Hardware.md) | Serial · BusPirate · MSR206 · Android · BareSIP |
+| [SAST (48 rules)](SAST.md) | Static analysis + test-case engine |
+| [WWW (21 drivers)](WWW.md) | Browser automations for real sites |
+| [AWS (90 services)](AWS.md) | Cloud-security enumeration |
+| [SDR](SDR.md) | GQRX · FlipperZero · RFIDler · SonMicro |
+| [Blockchain](Blockchain.md) | BTC · ETH helpers |
+| [Bounty](Bounty.md) | Lifecycle / auth-replay tooling |
+| [Reports](Reporting.md) | HTML/JSON output + DefectDojo/Jira |
+| [FFI](FFI.md) | Native calls |
+| [Banner](Banner.md) | 15 startup banners |
+
+## 🛠️ Meta
+
+| | |
+|---|---|
+| [`~/.pwn/` Filesystem Map](Persistence.md) | Every file PWN writes and why |
+| [Troubleshooting](Troubleshooting.md) | Common errors and fixes |
+| [Contributing](Contributing.md) | Conventions, RuboCop, spec rules |
+
+---
+
+<sub>Generated by pwn-ai. Edit any `.md` directly; edit any diagram in
+`documentation/diagrams/dot/*.dot` then run `./build.sh`.</sub>

data/documentation/How-PWN-Works.md

@@ -0,0 +1,62 @@
+# How PWN Works
+
+PWN is five layers, each visible in the source tree. Edges only ever go
+**down** one layer (or sideways within a layer), which is why the diagrams
+below have no criss-crossing lines.
+
+![Overall Architecture](diagrams/overall-pwn-architecture.svg)
+
+## L0 — Actors
+
+Humans (`pwn` REPL, `pwn-ai` TUI), CI runners (`pwn --ai "…"`, `bin/pwn_*`),
+LLM providers (over HTTPS), and targets (hosts, web apps, clouds, radios,
+hardware).
+
+## L1 — Entry points  (`bin/`)
+
+| Entry | File | Purpose |
+|---|---|---|
+| `pwn` REPL | `lib/pwn/plugins/repl.rb` | Pry with `PWN::` pre-loaded + custom commands |
+| `pwn-ai` | `lib/pwn/ai/agent/loop.rb` | Agent TUI inside the REPL |
+| `pwn --ai PROMPT` | `bin/pwn` | Headless one-shot agent (CI-friendly) |
+| `bin/pwn_*` | 52 files | Thin OptionParser wrappers over one plugin each |
+| `PWN::Cron` | `lib/pwn/cron.rb` | Scheduled jobs → any of the above |
+
+## L2 — AI agent core  (`lib/pwn/ai/agent/`)
+
+| Module | Role |
+|---|---|
+| `Loop` | plan → dispatch tool_calls → observe → repeat until final answer |
+| `Registry` | JSON-Schema function definitions grouped into 10 **toolsets** |
+| `Dispatch` / `Result` | execute a tool, capture stdout/value/error/duration |
+| `PromptBuilder` | inject MEMORY / SKILLS / LEARNING / EXTROSPECTION blocks |
+| `Metrics` · `Learning` | **introspection** — how well am I doing? |
+| `Extrospection` | **extrospection** — what does the world look like? |
+| `Swarm` | multi-agent personas over a shared JSONL bus |
+
+See [Agent Tool Registry](Agent-Tool-Registry.md) for every tool the LLM can call.
+
+## L3 — Capability namespaces  (`lib/pwn/*`)
+
+`Plugins` (66) · `SAST` (48) · `WWW` (21) · `AWS` (90) · `SDR` · `Blockchain` ·
+`Bounty` · `Reports` · `FFI` · `Banner`. Each is a plain module of
+`public_class_method def self.x(opts = {})` methods — callable identically from
+the REPL, from `pwn_eval`, or from a driver.
+
+## L4 — Persistence  (`~/.pwn/`)
+
+Everything the framework remembers between processes lives in one directory:
+
+![~/.pwn map](diagrams/persistence-filesystem.svg)
+
+See [Persistence](Persistence.md) for the byte-level layout of each file.
+
+## The feedback loop
+
+The reason L2 exists is to close this loop on every turn:
+
+![Self-improvement loop](diagrams/pwn-ai-feedback-learning-loop.svg)
+
+**Next:** [pwn REPL](pwn-REPL.md) · [pwn-ai Agent](pwn-ai-Agent.md)
+
+[← Home](Home.md)

data/documentation/Installation.md

@@ -0,0 +1,75 @@
+# Installation
+
+PWN is tested on **Debian-based Linux** (Kali, Ubuntu) and **macOS**, using
+Ruby via **RVM**.
+
+## Quick install (recommended)
+
+```bash
+cd /opt
+sudo git clone https://github.com/0dayinc/pwn
+cd /opt/pwn
+./install.sh          # system deps (nmap, chromium, graphviz, …)
+./install.sh ruby-gem # rvm gemset + bundle install + rake install
+pwn                   # launch the REPL
+```
+
+```text
+pwn[v0.5.616]:001 >>> PWN.help
+```
+
+## Gem-only install
+
+```bash
+rvm install ruby-4.0.5
+rvm use     ruby-4.0.5@pwn --create
+gem install --verbose pwn
+pwn
+```
+
+## Upgrading
+
+```bash
+rvm use ruby-4.0.5@pwn
+gem uninstall --all --executables pwn
+gem install --verbose pwn
+```
+
+or from a checkout:
+
+```bash
+cd /opt/pwn && git pull && rvmsudo rake install
+```
+
+## First-run configuration
+
+`pwn` creates `~/.pwn/` on first launch. Add at least one LLM engine to
+`~/.pwn/config.yml` to enable `pwn-ai` — see [Configuration](Configuration.md).
+
+## Optional external tools
+
+PWN wraps these when present on `$PATH`; none are hard requirements:
+
+| Tool | Used by |
+|---|---|
+| `nmap` | `PWN::Plugins::NmapIt` |
+| Burp Suite Pro (+ REST API) | `PWN::Plugins::BurpSuite` |
+| `msfconsole` / msfrpcd | `PWN::Plugins::Metasploit` |
+| `chromium` / `google-chrome` | `PWN::Plugins::TransparentBrowser` |
+| `zaproxy` | `PWN::Plugins::Zaproxy` (fallback) |
+| `gqrx` | `PWN::SDR::GQRX` |
+| `adb` | `PWN::Plugins::Android` |
+| `graphviz` (`dot`) | rebuilding these diagrams |
+| `tor` | `PWN::Plugins::Tor` |
+
+## Verify
+
+```ruby
+pwn[v0.5.616]:001 >>> PWN::Plugins.constants.count   # => 66
+pwn[v0.5.616]:002 >>> PWN::SAST.constants.count      # => 48
+pwn[v0.5.616]:003 >>> pwn-ai                         # launches agent TUI
+```
+
+**Next:** [Configuration](Configuration.md) · [General Usage](General-PWN-Usage.md)
+
+[← Home](Home.md)

data/documentation/NmapIt.md

@@ -0,0 +1,18 @@
+# NmapIt
+
+`PWN::Plugins::NmapIt` provides a convenient Ruby wrapper around Nmap for reconnaissance.
+
+## Features
+
+- Easy target specification (hosts, ranges, CIDR)
+- Parsing of XML output into usable Ruby structures
+- Service version detection, script execution support
+- Integration with other plugins (e.g. feed into TransparentBrowser or Shodan)
+
+Commonly used early in agent workflows:
+
+> "Run NmapIt against 10.0.0.0/24, identify web services, then spider with TransparentBrowser."
+
+See source in `lib/pwn/plugins/nmap_it.rb`.
+
+[[Diagrams]]

data/documentation/Plugins.md

@@ -0,0 +1,59 @@
+# Plugins
+
+PWN ships with **66+** plugins under `PWN::Plugins::*`.
+
+## Browsing Plugins
+
+```ruby
+PWN::Plugins.constants.sort
+PWN::Plugins::BurpSuite.methods(false).sort   # preferred web proxy/scanner
+```
+
+## Major Categories & Highlights
+
+### Web / Proxy / Scanning
+- **burp_suite** (preferred) — Headless + live interaction with Burp Suite Professional
+- **zaproxy** — OWASP ZAP support (fallback)
+- **transparent_browser** — Headless/visible browser automation, spidering, JS execution
+- **spider**
+- **nmap_it** — Nmap wrapper + parsing
+- **nessus_cloud**, **nexpose_vuln_scan**, **openvas**
+
+### Exploitation & Post-Exploitation
+- **metasploit**
+- **assembly**
+- **fuzz**
+- **packet**
+- **beef** (Browser Exploitation Framework)
+- **tor**
+
+### Recon / OSINT
+- **shodan**
+- **hunter**
+- **ip_info**
+- **github**
+- **hacker_one**
+
+### Data & Auth
+- **authentication_helper**, **basic_auth**, **oauth2**
+- **dao_ldap**, **dao_mongo**, **dao_postgres**, **dao_sqlite3**
+- **vault**
+
+### Mobile / Hardware / Misc
+- **android**
+- **serial**, **bus_pirate**, **msr206**
+- **ocr**, **pdf_parse**, **voice**
+- **blockchain**, **bounty** (HackerOne), **defect_dojo**
+
+### Utility
+- **file_fu**, **json_pathify**, **log**, **pwn_logger**, **thread_pool**
+- **monkey_patch**, **xxd**, **char**, **vin**, **ssn**, **credit_card**
+
+Full list (current as of build):
+`android assembly authentication_helper baresip basic_auth beef black_duck_binary_analysis burp_suite bus_pirate char credit_card dao_ldap dao_mongo dao_postgres dao_sqlite3 defect_dojo detect_os ein file_fu fuzz git github hacker_one hunter ip_info irc jenkins jira_data_center json_pathify log mail_agent metasploit monkey_patch msr206 nessus_cloud nexpose_vuln_scan nmap_it oauth2 ocr open_api openvas packet pdf_parse pony ps pwn_logger rabbit_mq repl scannable_codes serial shodan slack_client sock spider ssn thread_pool tor transparent_browser twitter_api uri_scheme vault vin voice vsphere xxd zaproxy`
+
+Each plugin has self-documenting method signatures viewable via the REPL or source in `lib/pwn/plugins/`.
+
+See individual plugin pages or source for details. Many plugins accept common options and return rich Ruby objects.
+
+[[Diagrams]]

data/documentation/Reporting.md

@@ -0,0 +1,28 @@
+# Reporting
+
+`PWN::Reports` generates structured output from scans, agent runs, SAST results, and manual findings.
+
+## Capabilities
+
+- Vulnerability report templating (Markdown + other formats)
+- Integration with defect trackers (`PWN::Plugins::DefectDojo`, Jira, etc.)
+- Automated report generation after agent tasks or plugin runs
+- Custom report drivers
+
+## Template
+
+See example report templates in the PWN repo (or generate with `PWN::Reports`). Full pipeline in [Diagrams](Diagrams.md).
+
+## Usage Patterns
+
+Typically invoked at the end of reconnaissance → scanning → exploitation → analysis workflows:
+
+```ruby
+PWN::Reports.generate(...)
+```
+
+The `pwn-ai` agent is frequently instructed to "analyze findings and produce a report."
+
+Combined with `PWN::Plugins::HackerOne` / bounty modules for streamlined disclosure workflows.
+
+[[Diagrams]]

data/documentation/SAST.md

@@ -0,0 +1,32 @@
+# SAST (Static Application Security Testing)
+
+`PWN::SAST` provides a growing collection of static analysis signatures and test case generators.
+
+## Location
+
+`lib/pwn/sast/` — one file per vulnerability class or mechanism.
+
+## Current Coverage (examples)
+
+- Command execution (multiple languages)
+- Deserialization (Java, etc.)
+- Eval / dangerous functions
+- CSRF, redirect, inner HTML, postMessage issues
+- Log4j, ReDoS, path traversal patterns
+- Credential / secret patterns (keystore, passwords, AWS keys)
+- Modern issues: prototype pollution, etc.
+- Custom signature engine + factory
+
+## Usage
+
+```ruby
+PWN::SAST.constants
+PWN::SAST::TestCaseEngine.generate(...)
+# Or call specific check modules
+```
+
+SAST results feed directly into reporting and can be orchestrated by the `pwn-ai` agent or custom drivers.
+
+See `lib/pwn/sast/` source for the full and growing list of modules.
+
+[[Diagrams]]

data/documentation/Skills-Memory-Learning.md

@@ -0,0 +1,44 @@
+# Skills, Memory & Learning
+
+One of PWN's most powerful features is its self-improving closed loop.
+
+## Memory (`PWN::Memory`)
+
+Persistent facts, preferences, lessons, and environment data stored in `~/.pwn/memory.json`.
+
+Use from REPL / agent:
+- `PWN::Memory.remember(key, value, category: :fact)`
+- `PWN::Memory.recall(query)`
+
+Injected into every future `pwn-ai` session.
+
+## Skills
+
+Reusable, versionable markdown procedures stored in `~/.pwn/skills/`.
+
+- Created automatically via distillation of successful agent runs.
+- Manually via `skill_create` or editing YAML+markdown files.
+- Contain front-matter `references:` (CWE, CVE, ATT&CK, NIST, URLs).
+- Exposed to the agent and listed via `skill_list` / `skill_view`.
+
+Example skills:
+- `deep_exploitation`
+- `vulnerability_research_fundamentals`
+- `xai_grok_oauth_device_flow`
+
+## Learning Loop
+
+- `PWN::AI::Agent::Metrics` — per-tool success rate + duration (`~/.pwn/metrics.json`)
+- `PWN::AI::Agent::Learning` — outcomes, reflections, skill distillation (`~/.pwn/learning.jsonl`)
+- Successful workflows become durable skills available to all future sessions.
+
+## Management Commands (REPL)
+
+- `pwn-ai-memory`
+- `pwn-ai-sessions`
+- `pwn-ai-cron`
+- `skill_list`, `skill_view`, `skill_create`, `skill_add_reference`
+
+This system turns one-off wins into institutional knowledge.
+
+[[Diagrams]]

data/documentation/Transparent-Browser.md

@@ -0,0 +1,32 @@
+# Transparent Browser
+
+`PWN::Plugins::TransparentBrowser` — powerful browser automation (headless + visible) built on top of Selenium / Watir / Ferrum / similar.
+
+## Primary Uses
+
+- Web spidering / crawling
+- JavaScript-heavy application interaction
+- Automated form submission, auth flows
+- Screenshotting, DOM inspection
+- Proxied browsing (pairs excellently with BurpSuite)
+
+## Example Calls
+
+```ruby
+browser = PWN::Plugins::TransparentBrowser.open_browser(
+  browser_type: :chrome,
+  proxy: 'http://127.0.0.1:8080'   # Burp
+)
+browser.goto 'https://target.example.com'
+# ... interact ...
+browser.close
+```
+
+Agent-friendly.
+
+## See Also
+
+- [Burp Suite](BurpSuite.md)
+- [Plugins](Plugins.md)
+
+[[Diagrams]]