pentesting 0.12.13 → 0.16.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (20) hide show
  1. package/README.md +90 -95
  2. package/dist/main.js +3103 -0
  3. package/package.json +13 -13
  4. package/dist/auto-update-6CLBRLE3.js +0 -24
  5. package/dist/chunk-3RG5ZIWI.js +0 -10
  6. package/dist/chunk-5IKQY4A4.js +0 -134
  7. package/dist/chunk-6IXHQS2A.js +0 -525
  8. package/dist/chunk-AOJBE232.js +0 -457
  9. package/dist/index.js +0 -16445
  10. package/dist/replay-ABCV4F64.js +0 -130
  11. package/dist/skill-2AON6M2V.js +0 -416
  12. package/dist/update-34NDFWS3.js +0 -24
  13. package/dist/web-search-XQYEM24B.js +0 -43
  14. package/src/agents/specs/crypto.yaml +0 -79
  15. package/src/agents/specs/default.yaml +0 -60
  16. package/src/agents/specs/exploit.yaml +0 -70
  17. package/src/agents/specs/privesc.yaml +0 -83
  18. package/src/agents/specs/recon.yaml +0 -65
  19. package/src/agents/specs/web.yaml +0 -73
  20. /package/dist/{index.d.ts → main.d.ts} +0 -0
package/README.md CHANGED
@@ -1,156 +1,151 @@
1
1
  <div align="center">
2
2
 
3
3
  ```
4
- ██████╗ ███████╗███╗ ██╗████████╗███████╗███████╗████████╗██╗███╗ ██╗ ██████╗
5
- ██╔══██╗██╔════╝████╗ ██║╚══██╔══╝██╔════╝██╔════╝╚══██╔══╝██║████╗ ██║██╔════╝
4
+ ██████╗ ███████╗███╗ ██╗████████╗███████╗███████╗████████╗██╗███╗ ██╗ ██████╗
5
+ ██╔══██╗██╔════╝████╗ ██║╚══██╔══╝██╔════╝██╔════╝╚══██╔══╝██║████╗ ██║██╔════╝
6
6
  ██████╔╝█████╗ ██╔██╗ ██║ ██║ █████╗ ███████╗ ██║ ██║██╔██╗ ██║██║ ███╗
7
7
  ██╔═══╝ ██╔══╝ ██║╚██╗██║ ██║ ██╔══╝ ╚════██║ ██║ ██║██║╚██╗██║██║ ██║
8
8
  ██║ ███████╗██║ ╚████║ ██║ ███████╗███████║ ██║ ██║██║ ╚████║╚██████╔╝
9
- ╚═╝ ╚══════╝╚═╝ ╚═══╝ ╚═╝ ╚══════╝╚══════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═════╝
9
+ ╚═╝ ╚══════╝╚═╝ ╚═══╝ ╚═╝ ╚══════╝╚══════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═════╝
10
10
  ────────────────────────────────────────────────────────────────────────────────
11
11
  A U T O N O M O U S S E C U R I T Y A G E N T
12
12
  ```
13
13
 
14
- **v0.12.10 | Multi-Agent System | 50+ Security Tools**
15
14
 
16
15
  [![npm](https://img.shields.io/badge/npm-pentesting-red)](https://www.npmjs.org/package/pentesting)
17
- [![Docker](https://img.shields.io/badge/docker-kalilinux%2Fkali--rolling-blue)](https://hub.docker.com/r/kalilinux/kali-rolling)
18
- [![License: MIT](https://img.shields.io/badge/License-MIT-red.svg)](https://opensource.org/licenses/MIT)
19
16
 
20
17
  </div>
21
18
 
22
19
  ---
23
20
 
24
- ## ⚠️ Requirements
25
-
26
- **This agent requires Kali Linux environment for full functionality.**
21
+ ## Quick Start
27
22
 
28
- ### Option 1: Native Kali Linux (Recommended)
29
23
  ```bash
30
- # On Kali Linux
31
- sudo apt update && sudo apt install -y kali-linux-headless nodejs npm
32
24
  npm install -g pentesting
33
- pentesting
34
- ```
35
25
 
36
- ### Option 2: Docker with Kali Image
37
- ```bash
38
- # Pull official Kali Linux image
39
- docker pull kalilinux/kali-rolling
40
-
41
- # Run with full tools
42
- docker run -it --rm --network host \
43
- -e PENTEST_API_KEY="your_key" \
44
- -e PENTEST_BASE_URL="https://api.openai.com/v1" \
45
- -e PENTEST_MODEL="gpt-4-turbo" \
46
- kalilinux/kali-rolling bash -c "
47
- apt update && apt install -y nodejs npm kali-tools-top10 && \
48
- npm install -g pentesting && \
49
- pentesting
50
- "
51
- ```
26
+ # Required environments
27
+ export PENTEST_API_KEY="your_api_key"
28
+ export PENTEST_BASE_URL="https://api.z.ai/api/anthropic"
29
+ export PENTEST_MODEL="glm-4.7"
52
30
 
53
- ### Option 3: Kali on WSL2 (Windows)
54
- ```bash
55
- # Install Kali from Microsoft Store, then:
56
- sudo apt update && sudo apt install -y kali-linux-headless nodejs npm
57
- sudo npm install -g pentesting
58
31
  pentesting
59
32
  ```
60
33
 
61
34
  ---
62
35
 
63
- ## Quick Start
36
+ ## Features
64
37
 
65
- ```bash
66
- npm install -g pentesting
38
+ ### 🤖 Multi-Agent Architecture
67
39
 
68
- # requirements
69
- export PENTEST_API_KEY="your_api_key"
70
- export PENTEST_BASE_URL="https://api.z.ai/api/anthropic"
71
- export PENTEST_MODEL="glm-4.7"
40
+ Autonomous penetration testing with specialized agents:
72
41
 
73
- pentesting
42
+ ```
43
+ Orchestrator → Recon → Vuln → Exploit → Post
44
+ ↓ ↓ ↓ ↓
45
+ Web Infra Report
74
46
  ```
75
47
 
76
- **Note:** If a security tool is not installed, the agent will automatically attempt to install it using `apt`.
48
+ Each agent is a simple `while(true) { think → tool → observe }` loop with:
49
+ - **Specialized prompts** (not code)
50
+ - **Dedicated tool sets**
51
+ - **State slicing** for token efficiency
77
52
 
78
- ---
53
+ ### 🎯 CTF Expert Knowledge
54
+
55
+ Built-in security expertise including:
56
+ - **Essential options**: `nmap -Pn` (never forget)
57
+ - **CVE detection**: Apache 2.4.49 → CVE-2021-41773
58
+ - **Service-specific exploits**: Samba, VSFTPD, MS17-010
59
+ - **Web attack vectors**: SQLi, XSS, SSRF, XXE
60
+ - **AD infrastructure**: BloodHound, CrackMapExec
61
+
62
+ ### 🔍 Transparent Execution
63
+
64
+ Full visibility into agent decision-making:
65
+
66
+ ```
67
+ Orchestrator agentLoop
68
+ │ think: "Start with reconnaissance"
69
+ │ tool_call: delegate('recon', 'Subnet scan')
70
+ │
71
+ ├─▶ RECON agentLoop
72
+ │ │ tool_call: nmap -Pn 10.10.10.0/24 [confirm → y]
73
+ │ │ observe: 3 hosts discovered
74
+ │ │ escalate ↑: recon → vuln
75
+ │ └─▶ return "Apache 2.4.49 found"
76
+ │
77
+ └─▶ VULN agentLoop
78
+ │ tool_call: curl --path-as-is ... [review → yes]
79
+ │ observe: /etc/passwd exposure confirmed
80
+ └─▶ return "CVE-2021-41773 Critical confirmed"
81
+ ```
79
82
 
80
- ## Core Features
83
+ ### 🛡️ Safety First
81
84
 
82
- | Feature | Description |
83
- |---------|-------------|
84
- | **Multi-Agent System** | 5 specialist agents (Recon, Web, Exploit, PrivEsc, Lateral) |
85
- | **Autonomous Orchestration** | Strategic planning, self-diagnostics, quality gates |
86
- | **50+ Security Tools** | nmap, sqlmap, ffuf, gobuster, hydra, metasploit... |
87
- | **Auto-Install** | Missing tools are automatically installed via apt |
88
- | **CTF Research** | Writeup search (0xdf, IppSec), scenario-based research |
89
- | **Audit & Safety** | Tool execution logging, risk scoring, approval system |
85
+ - **Scope enforcement**: Never attack outside approved targets
86
+ - **Approval gates**: `auto` / `confirm` / `review`
87
+ - **Audit logging**: Every action recorded
88
+ - **Authorized users only**: No unnecessary prompt defenses
90
89
 
91
90
  ---
92
91
 
93
92
  ## TUI Commands
94
93
 
95
94
  ```
96
- /target <ip> Set target
97
- /start Start autonomous pentest
98
- /research <box> Search writeups & exploits
99
- /findings Show findings
100
- /yolo Toggle auto-approve
101
- /help Show all commands
95
+ /target <cidr> Set engagement scope
96
+ /start Start autonomous pentest
97
+ /findings Show all findings
98
+ /loot Show credentials & sessions
99
+ /state Show current engagement state
100
+ /yolo Toggle auto-approve mode
101
+ /exit Exit session
102
+ /help Show all commands
102
103
  ```
103
104
 
104
105
  ---
105
106
 
106
107
  ## Environment
107
108
 
108
- | Variable | Description |
109
- |----------|-------------|
110
- | `PENTEST_API_KEY` | API key (required) |
111
- | `PENTEST_BASE_URL` | Custom API endpoint |
112
- | `PENTEST_MODEL` | LLM model (default: claude-sonnet-4-20250514) |
109
+ | Variable | Description | Default |
110
+ |----------|-------------|---------|
111
+ | `PENTEST_API_KEY` | API key (required) | - |
112
+ | `PENTEST_BASE_URL` | Custom API endpoint | - |
113
+ | `PENTEST_MODEL` | LLM model | `glm-4.7` |
113
114
 
114
115
  ---
115
116
 
116
- ## Supported Tools
117
+ ## Architecture
117
118
 
118
- The agent supports 50+ security tools. If a tool is missing, it will be installed automatically:
119
+ ```
120
+ ┌─────────────────────────────────────────────────────────────┐
121
+ │ Orchestrator │
122
+ │ "Delegate, don't execute directly" │
123
+ │ • delegate_to_agent • escalate • get_state • set_scope │
124
+ └────────────┬────────────────────────────────────────────────┘
125
+ │
126
+ ┌────────┼────────┬────────┬────────┬────────┐
127
+ │ │ │ │ │ │
128
+ ▼ ▼ ▼ ▼ ▼ ▼
129
+ Recon Vuln Exploit Post Web Infra
130
+ "Info" "Verify" "Approved" "Shell" "Web" "AD"
131
+ ```
119
132
 
120
- | Category | Tools |
121
- |----------|-------|
122
- | **Reconnaissance** | nmap, rustscan, masscan, subfinder, amass |
123
- | **Web** | ffuf, gobuster, nikto, nuclei, sqlmap, whatweb |
124
- | **Exploitation** | metasploit, searchsploit, msfvenom |
125
- | **Credential** | hydra, john, hashcat, crackmapexec |
126
- | **Windows/AD** | impacket-*, bloodhound, kerbrute, enum4linux |
127
- | **Utilities** | netcat, socat, chisel, proxychains |
133
+ **Key principles:**
134
+ 1. Agent = `while(true) { think → tool → observe }`
135
+ 2. Agent difference = prompt + tool set (not code)
136
+ 3. Communication = danger↑ via Orchestrator, ↓ direct call
137
+ 4. All prompts get Scope + State injection
138
+ 5. Approval = `auto` | `confirm` | `review`
128
139
 
129
140
  ---
130
141
 
131
- ## Web Research (Playwright)
132
-
133
- The agent includes a powerful **Playwright-based web research** engine:
134
-
135
- - **CAPTCHA bypass** - Headless browser avoids detection
136
- - **Deep search** - Follows links and extracts content
137
- - **Multi-source** - Google, DuckDuckGo, exploit-db, CVE databases
138
- - **CTF research** - Searches 0xdf, ippsec, HackTheBox writeups
139
-
140
- ```bash
141
- # Features available in autonomous mode:
142
- # - searchGoogle(query)
143
- # - deepSearch(query, { depth: 2 })
144
- # - searchWriteups("htb box name")
145
- # - ctfResearch("Lame", "linux")
146
- ```
147
-
148
- ## Documentation
142
+ ## Issue Report
149
143
 
150
- - **[ARCHITECTURE.md](docs/ARCHITECTURE.md)** - System architecture
144
+ **Email**: agnusdei1207@gmail.com
145
+ **LinkedIn**: [sang-woo-park](https://www.linkedin.com/in/sang-woo-park-158685393/en)
151
146
 
152
147
  ---
153
148
 
154
149
  ## License
155
150
 
156
- MIT | ⚠️ **For authorized security testing and CTF competitions only.**
151
+ MIT License - see [LICENSE](LICENSE) for details.