pentesting 0.101.3 → 0.101.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/ARCHITECTURE.md +30 -14
  2. package/README.md +0 -4
  3. package/package.json +98 -98
package/ARCHITECTURE.md CHANGED
@@ -235,7 +235,7 @@ tool reachability. Delegated subagent contracts stay intact. Defined in
235
235
  | --- | --- |
236
236
  | `general-agent` | Broad autonomous local orchestration for mixed tasks |
237
237
  | `local-builder` | Hands-on implementation with fresh evidence retrieval |
238
- | `ctf-competition` | Competition/lab workflow backed by `ctf-competition` and `pentesting-methodology` skills |
238
+ | `ctf-competition` | Competition/lab workflow; the profile references `ctf-competition` and `pentesting-methodology`, while built-in `write-report` remains explicitly selectable |
239
239
  | `enterprise-review` | Strict, review-heavy profile with read-only dynamic scope |
240
240
 
241
241
  ## Engagement Metadata
@@ -544,10 +544,15 @@ Inside an interactive session, these commands inspect and drive runtime state
544
544
  /exit Quit
545
545
  ```
546
546
 
547
- ## Security Domain Skills
548
-
549
- The `ctf-competition` and `pentesting-methodology` skills map authorized
550
- assessments to standard frameworks:
547
+ ## Security Domain Skills
548
+
549
+ Six built-in skills ship with the runtime: `create-skill`, `execute-plan`,
550
+ `github-pr-description`, `ctf-competition`, `pentesting-methodology`, and
551
+ `write-report`. For authorized security work, `ctf-competition` covers callback
552
+ delivery agility, reliable payload/tool delivery, and interpreter-aware
553
+ execution; `pentesting-methodology` maps assessments to standard frameworks;
554
+ and `write-report` turns preserved evidence into reproducible CTF and
555
+ penetration-test writeups.
551
556
 
552
557
  - **PTES** (Penetration Testing Execution Standard)
553
558
  - **MITRE ATT&CK** tactics and techniques
@@ -557,15 +562,26 @@ assessments to standard frameworks:
557
562
 
558
563
  ### Shell listener for authorized labs
559
564
 
560
- ```bash
561
- pentesting shell-listener --bind 127.0.0.1 --port 4444
562
- ```
563
-
564
- Manages multiple accepted TCP sessions with per-session routing, buffered
565
- output, raw byte logging, full-duplex transcripts, command history, attach /
566
- detach events, replay, and evidence manifests. `pty-upgrade` sends one concrete
567
- helper only; `upgrade` runs a helper plus a probe and records `pty_state` as
568
- verified or failed. Explicit `technique=auto` adds a bounded listener-side state
565
+ ```bash
566
+ pentesting shell-listener --bind 127.0.0.1 --port 4444 --extra-ports 8443,9001
567
+ ```
568
+
569
+ Up to 32 unique primary/additional ports bind concurrently and share one monotonic
570
+ session-id sequence; an unavailable port is skipped as long as at least one
571
+ requested port binds. `shell-session --json health` reports the active bound
572
+ endpoints so callback selection can be evidence-based. The remote-bind safety
573
+ gate remains unchanged.
574
+
575
+ Manages multiple accepted TCP sessions with per-session routing, buffered
576
+ output, raw byte logging, full-duplex transcripts, command history, attach /
577
+ detach events, replay, and evidence manifests. `probe` records the remote's
578
+ current shell interpreter in `shell`, detected only from `/proc/$$/exe` and
579
+ `$0`, so a BusyBox `sh` target is not confused with an installed Bash. This
580
+ interpreter axis is separate from TTY/`pty_state`; it is stored in session state,
581
+ the `shell-session --json` projection, session snapshots, and evidence manifests,
582
+ and is restored after a listener restart. `pty-upgrade` sends one concrete
583
+ helper only; `upgrade` runs a helper plus a probe and records `pty_state` as
584
+ verified or failed. Explicit `technique=auto` adds a bounded listener-side state
569
585
  machine: framed capability recon, allowlisted `bash`/`sh` selection, ordered
570
586
  helper attempts (`python3`, `python`, `python2`, `script`, `expect`), generic
571
587
  prompt observation, and phase-local probe verification. Only unavailable,
package/README.md CHANGED
@@ -114,7 +114,3 @@ Provider variables are optional — the TUI launches without them and lets you l
114
114
  > Each voice sings its most beautiful song from its own place, yet when combined, they create one grand, beautiful melody. I believe this structure is no different from AI agents.
115
115
  >
116
116
  > — *agnusdei1207*
117
-
118
- > Since the AI era began, I have studied many highly starred agent systems, but their machinery often obscured a clear philosophy. The ideas that actually improved performance came from observing myself and returning to computer science fundamentals—Kruskal and Prim, divide and conquer, backtracking, Monte Carlo methods, and time/space complexity. My conclusion is simple: observe yourself, master the fundamentals, and build from there.
119
-
120
- > I use Pentesting to study CTFs and penetration testing.
package/package.json CHANGED
@@ -1,98 +1,98 @@
1
- {
2
- "name": "pentesting",
3
- "version": "0.101.3",
4
- "builderReleaseTag": "v0.101.2",
5
- "description": "Penetration testing AI agent powered by Rust, with audited reverse-shell capture, verified PTY upgrades, and evidence-first orchestration.",
6
- "license": "MIT",
7
- "author": "agnusdei1207",
8
- "type": "module",
9
- "bin": {
10
- "pentesting": "bin/pentesting.mjs"
11
- },
12
- "files": [
13
- "bin",
14
- "lib",
15
- "scripts/postinstall.mjs",
16
- "README.md",
17
- "ARCHITECTURE.md",
18
- "pentesting-logo.svg"
19
- ],
20
- "engines": {
21
- "node": ">=18.18.0"
22
- },
23
- "repository": {
24
- "type": "git",
25
- "url": "git+https://github.com/agnusdei1207/pentesting-public.git"
26
- },
27
- "homepage": "https://agnusdei1207.github.io/pentesting-public/",
28
- "bugs": {
29
- "url": "https://github.com/agnusdei1207/pentesting-public/issues"
30
- },
31
- "keywords": [
32
- "penetration-testing",
33
- "pentesting",
34
- "security",
35
- "hacking",
36
- "hacker",
37
- "ai",
38
- "autonomous",
39
- "rust",
40
- "tui",
41
- "cli",
42
- "nmap",
43
- "metasploit",
44
- "sqlmap",
45
- "kali"
46
- ],
47
- "scripts": {
48
- "postinstall": "node ./scripts/postinstall.mjs",
49
- "prepublishOnly": "npm run verify",
50
- "consistency": "bash scripts/check-project-consistency.sh",
51
- "audit": "bash scripts/audit-project.sh",
52
- "test": "node --test tests/*.test.mjs",
53
- "preflight:local": "bash scripts/preflight-local.sh",
54
- "refactor:stability": "bash scripts/refactor-stability.sh",
55
- "verify": "npm run consistency && npm run test",
56
- "check": "npm run check:docker",
57
- "pentesting:help": "bash scripts/pentesting-release-help.sh",
58
- "pentesting:status": "bash scripts/pentesting-release-status.sh",
59
- "pentesting:test": "npm run test",
60
- "pentesting:verify": "npm run verify",
61
- "pentesting:pack:dry-run": "npm pack --dry-run",
62
- "pentesting:check": "bash scripts/check-pentesting-package.sh",
63
- "pentesting:publish": "bash scripts/publish-pentesting-package.sh",
64
- "pentesting:publish:dry-run": "DRY_RUN=true bash scripts/publish-pentesting-package.sh",
65
- "release:npm": "bash scripts/publish-pentesting-package.sh patch",
66
- "release:npm:minor": "bash scripts/publish-pentesting-package.sh minor",
67
- "release:npm:major": "bash scripts/publish-pentesting-package.sh major",
68
- "release:npm:dry": "DRY_RUN=true bash scripts/publish-pentesting-package.sh patch",
69
- "release:npm:minor:dry": "DRY_RUN=true bash scripts/publish-pentesting-package.sh minor",
70
- "release:npm:major:dry": "DRY_RUN=true bash scripts/publish-pentesting-package.sh major",
71
- "public:sync": "bash scripts/sync-public-repo.sh",
72
- "public:mirror-release": "bash scripts/mirror-public-release.sh",
73
- "release:backfill": "bash scripts/backfill-release-local.sh",
74
- "check:docker": "npm run docker:build && docker run -it --rm --memory 2g --memory-swap 2g --cpus 2 --pids-limit 512 -v builder-workspace:/workspace -v pentesting-config:/root/.pentesting -e OPENAI_API_KEY -e OPENAI_BASE_URL -e OPENAI_MODEL -e OPENAI_MAX_TOKENS agnusdei1207/pentesting:latest",
75
- "docker:build": "bash scripts/dbuild-image.sh app",
76
- "docker:base:build": "bash scripts/dbuild-image.sh bases",
77
- "release:patch": "./scripts/release-all.sh patch",
78
- "release:minor": "./scripts/release-all.sh minor",
79
- "release:major": "./scripts/release-all.sh major"
80
- },
81
- "devDependencies": {
82
- "@ai-sdk/google-vertex": "^4.0.47",
83
- "@types/node": "^24.10.1",
84
- "@types/tmp": "^0.2.6",
85
- "ai": "^6.0.77",
86
- "csv-parse": "^6.1.0",
87
- "handlebars": "^4.7.9",
88
- "p-limit": "^7.2.0",
89
- "pino": "^10.1.0",
90
- "pino-pretty": "^13.1.2",
91
- "strip-ansi": "^7.1.2",
92
- "tmp": "^0.2.5",
93
- "tsx": "^4.20.6",
94
- "yaml": "^2.8.3",
95
- "yargs": "^18.0.0",
96
- "zod": "^3.24.1"
97
- }
98
- }
1
+ {
2
+ "name": "pentesting",
3
+ "version": "0.101.5",
4
+ "builderReleaseTag": "v0.101.5",
5
+ "description": "Penetration testing AI agent powered by Rust, with audited reverse-shell capture, verified PTY upgrades, and evidence-first orchestration.",
6
+ "license": "MIT",
7
+ "author": "agnusdei1207",
8
+ "type": "module",
9
+ "bin": {
10
+ "pentesting": "bin/pentesting.mjs"
11
+ },
12
+ "files": [
13
+ "bin",
14
+ "lib",
15
+ "scripts/postinstall.mjs",
16
+ "README.md",
17
+ "ARCHITECTURE.md",
18
+ "pentesting-logo.svg"
19
+ ],
20
+ "engines": {
21
+ "node": ">=18.18.0"
22
+ },
23
+ "repository": {
24
+ "type": "git",
25
+ "url": "git+https://github.com/agnusdei1207/pentesting-public.git"
26
+ },
27
+ "homepage": "https://agnusdei1207.github.io/pentesting-public/",
28
+ "bugs": {
29
+ "url": "https://github.com/agnusdei1207/pentesting-public/issues"
30
+ },
31
+ "keywords": [
32
+ "penetration-testing",
33
+ "pentesting",
34
+ "security",
35
+ "hacking",
36
+ "hacker",
37
+ "ai",
38
+ "autonomous",
39
+ "rust",
40
+ "tui",
41
+ "cli",
42
+ "nmap",
43
+ "metasploit",
44
+ "sqlmap",
45
+ "kali"
46
+ ],
47
+ "scripts": {
48
+ "postinstall": "node ./scripts/postinstall.mjs",
49
+ "prepublishOnly": "npm run verify",
50
+ "consistency": "bash scripts/check-project-consistency.sh",
51
+ "audit": "bash scripts/audit-project.sh",
52
+ "test": "node --test tests/*.test.mjs",
53
+ "preflight:local": "bash scripts/preflight-local.sh",
54
+ "refactor:stability": "bash scripts/refactor-stability.sh",
55
+ "verify": "npm run consistency && npm run test",
56
+ "check": "npm run check:docker",
57
+ "pentesting:help": "bash scripts/pentesting-release-help.sh",
58
+ "pentesting:status": "bash scripts/pentesting-release-status.sh",
59
+ "pentesting:test": "npm run test",
60
+ "pentesting:verify": "npm run verify",
61
+ "pentesting:pack:dry-run": "npm pack --dry-run",
62
+ "pentesting:check": "bash scripts/check-pentesting-package.sh",
63
+ "pentesting:publish": "bash scripts/publish-pentesting-package.sh",
64
+ "pentesting:publish:dry-run": "DRY_RUN=true bash scripts/publish-pentesting-package.sh",
65
+ "release:npm": "bash scripts/publish-pentesting-package.sh patch",
66
+ "release:npm:minor": "bash scripts/publish-pentesting-package.sh minor",
67
+ "release:npm:major": "bash scripts/publish-pentesting-package.sh major",
68
+ "release:npm:dry": "DRY_RUN=true bash scripts/publish-pentesting-package.sh patch",
69
+ "release:npm:minor:dry": "DRY_RUN=true bash scripts/publish-pentesting-package.sh minor",
70
+ "release:npm:major:dry": "DRY_RUN=true bash scripts/publish-pentesting-package.sh major",
71
+ "public:sync": "bash scripts/sync-public-repo.sh",
72
+ "public:mirror-release": "bash scripts/mirror-public-release.sh",
73
+ "release:backfill": "bash scripts/backfill-release-local.sh",
74
+ "check:docker": "npm run docker:build && docker run -it --rm --memory 2g --memory-swap 2g --cpus 2 --pids-limit 512 -v builder-workspace:/workspace -v pentesting-config:/root/.pentesting -e OPENAI_API_KEY -e OPENAI_BASE_URL -e OPENAI_MODEL -e OPENAI_MAX_TOKENS agnusdei1207/pentesting:latest",
75
+ "docker:build": "bash scripts/dbuild-image.sh app",
76
+ "docker:base:build": "bash scripts/dbuild-image.sh bases",
77
+ "release:patch": "./scripts/release-all.sh patch",
78
+ "release:minor": "./scripts/release-all.sh minor",
79
+ "release:major": "./scripts/release-all.sh major"
80
+ },
81
+ "devDependencies": {
82
+ "@ai-sdk/google-vertex": "^4.0.47",
83
+ "@types/node": "^24.10.1",
84
+ "@types/tmp": "^0.2.6",
85
+ "ai": "^6.0.77",
86
+ "csv-parse": "^6.1.0",
87
+ "handlebars": "^4.7.9",
88
+ "p-limit": "^7.2.0",
89
+ "pino": "^10.1.0",
90
+ "pino-pretty": "^13.1.2",
91
+ "strip-ansi": "^7.1.2",
92
+ "tmp": "^0.2.5",
93
+ "tsx": "^4.20.6",
94
+ "yaml": "^2.8.3",
95
+ "yargs": "^18.0.0",
96
+ "zod": "^3.24.1"
97
+ }
98
+ }