pentesting 0.12.13 → 0.16.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +90 -95
- package/dist/main.js +3103 -0
- package/package.json +13 -13
- package/dist/auto-update-6CLBRLE3.js +0 -24
- package/dist/chunk-3RG5ZIWI.js +0 -10
- package/dist/chunk-5IKQY4A4.js +0 -134
- package/dist/chunk-6IXHQS2A.js +0 -525
- package/dist/chunk-AOJBE232.js +0 -457
- package/dist/index.js +0 -16445
- package/dist/replay-ABCV4F64.js +0 -130
- package/dist/skill-2AON6M2V.js +0 -416
- package/dist/update-34NDFWS3.js +0 -24
- package/dist/web-search-XQYEM24B.js +0 -43
- package/src/agents/specs/crypto.yaml +0 -79
- package/src/agents/specs/default.yaml +0 -60
- package/src/agents/specs/exploit.yaml +0 -70
- package/src/agents/specs/privesc.yaml +0 -83
- package/src/agents/specs/recon.yaml +0 -65
- package/src/agents/specs/web.yaml +0 -73
- /package/dist/{index.d.ts → main.d.ts} +0 -0
package/dist/chunk-6IXHQS2A.js
DELETED
|
@@ -1,525 +0,0 @@
|
|
|
1
|
-
// src/config/agent-constants.ts
|
|
2
|
-
var AGENT_STATUS = {
|
|
3
|
-
IDLE: "idle",
|
|
4
|
-
RUNNING: "running",
|
|
5
|
-
PAUSED: "paused",
|
|
6
|
-
STUCK: "stuck",
|
|
7
|
-
WAITING_INPUT: "waiting_input",
|
|
8
|
-
COMPLETED: "completed"
|
|
9
|
-
};
|
|
10
|
-
var PHASE_ID = {
|
|
11
|
-
RECON: "recon",
|
|
12
|
-
SCAN: "scan",
|
|
13
|
-
ENUM: "enum",
|
|
14
|
-
VULN: "vuln",
|
|
15
|
-
EXPLOIT: "exploit",
|
|
16
|
-
PRIVESC: "privesc",
|
|
17
|
-
PIVOT: "pivot",
|
|
18
|
-
PERSIST: "persist",
|
|
19
|
-
EXFIL: "exfil",
|
|
20
|
-
REPORT: "report"
|
|
21
|
-
};
|
|
22
|
-
var PHASE_STATUS = {
|
|
23
|
-
PENDING: "pending",
|
|
24
|
-
IN_PROGRESS: "in_progress",
|
|
25
|
-
COMPLETED: "completed",
|
|
26
|
-
FAILED: "failed",
|
|
27
|
-
SKIPPED: "skipped"
|
|
28
|
-
};
|
|
29
|
-
var THOUGHT_TYPE = {
|
|
30
|
-
THINKING: "thinking",
|
|
31
|
-
// LLM text streaming
|
|
32
|
-
REASONING: "reasoning",
|
|
33
|
-
// LLM extended thinking
|
|
34
|
-
PLANNING: "planning",
|
|
35
|
-
// Strategic planning
|
|
36
|
-
OBSERVATION: "observation",
|
|
37
|
-
// Observing results
|
|
38
|
-
HYPOTHESIS: "hypothesis",
|
|
39
|
-
// Forming hypothesis
|
|
40
|
-
REFLECTION: "reflection",
|
|
41
|
-
// Self-reflection
|
|
42
|
-
ACTION: "action",
|
|
43
|
-
// Taking action
|
|
44
|
-
RESULT: "result",
|
|
45
|
-
// Action result
|
|
46
|
-
STUCK: "stuck",
|
|
47
|
-
// Detected stuck state
|
|
48
|
-
BREAKTHROUGH: "breakthrough"
|
|
49
|
-
// Found breakthrough
|
|
50
|
-
};
|
|
51
|
-
var AGENT_EVENT = {
|
|
52
|
-
// Lifecycle
|
|
53
|
-
PLUGINS_LOADED: "plugins_loaded",
|
|
54
|
-
HOOKS_LOADED: "hooks_loaded",
|
|
55
|
-
COMMANDS_LOADED: "commands_loaded",
|
|
56
|
-
MCP_SERVER_ADDED: "mcp_server_added",
|
|
57
|
-
// Execution
|
|
58
|
-
ITERATION: "iteration",
|
|
59
|
-
THOUGHT: "thought",
|
|
60
|
-
RESPONSE: "response",
|
|
61
|
-
TOOL_CALL: "tool_call",
|
|
62
|
-
TOOL_RESULT: "tool_result",
|
|
63
|
-
COMMAND_EXECUTE: "command_execute",
|
|
64
|
-
APPROVAL_NEEDED: "approval_needed",
|
|
65
|
-
TOKEN_USAGE: "token_usage",
|
|
66
|
-
LLM_START: "llm_start",
|
|
67
|
-
LLM_END: "llm_end",
|
|
68
|
-
// State changes
|
|
69
|
-
TARGET_SET: "target_set",
|
|
70
|
-
PHASE_CHANGE: "phase_change",
|
|
71
|
-
AGENT_SWITCH: "agent_switch",
|
|
72
|
-
PAUSED: "paused",
|
|
73
|
-
RESUMED: "resumed",
|
|
74
|
-
RESET: "reset",
|
|
75
|
-
// Discoveries
|
|
76
|
-
FINDING: "finding",
|
|
77
|
-
CREDENTIAL: "credential",
|
|
78
|
-
COMPROMISED: "compromised",
|
|
79
|
-
// Completion
|
|
80
|
-
COMPLETE: "complete",
|
|
81
|
-
REPORT: "report",
|
|
82
|
-
ERROR: "error",
|
|
83
|
-
HINT_RECEIVED: "hint_received",
|
|
84
|
-
CONTEXT_COMPACTED: "context_compacted"
|
|
85
|
-
};
|
|
86
|
-
var CLI_COMMAND = {
|
|
87
|
-
HELP: "help",
|
|
88
|
-
TARGET: "target",
|
|
89
|
-
START: "start",
|
|
90
|
-
STOP: "stop",
|
|
91
|
-
FINDINGS: "findings",
|
|
92
|
-
CLEAR: "clear",
|
|
93
|
-
EXIT: "exit"
|
|
94
|
-
};
|
|
95
|
-
var MESSAGE_TYPE = {
|
|
96
|
-
USER: "user",
|
|
97
|
-
ASSISTANT: "assistant",
|
|
98
|
-
TOOL: "tool",
|
|
99
|
-
THINKING: "thinking",
|
|
100
|
-
ERROR: "error",
|
|
101
|
-
SYSTEM: "system",
|
|
102
|
-
RESULT: "result"
|
|
103
|
-
};
|
|
104
|
-
var TOOL_NAME = {
|
|
105
|
-
// System
|
|
106
|
-
BASH: "bash",
|
|
107
|
-
READ_FILE: "read_file",
|
|
108
|
-
WRITE_FILE: "write_file",
|
|
109
|
-
LIST_DIRECTORY: "list_directory",
|
|
110
|
-
SET_TARGET: "set_target",
|
|
111
|
-
// Network - Basic Connectivity
|
|
112
|
-
PING: "ping",
|
|
113
|
-
TRACEROUTE: "traceroute",
|
|
114
|
-
MTR: "mtr",
|
|
115
|
-
RUSTSCAN: "rustscan",
|
|
116
|
-
NMAP_SCAN: "nmap_scan",
|
|
117
|
-
MASSCAN: "masscan",
|
|
118
|
-
TCPDUMP_CAPTURE: "tcpdump_capture",
|
|
119
|
-
TSHARK: "tshark",
|
|
120
|
-
NGREP: "ngrep",
|
|
121
|
-
ARP_SCAN: "arp_scan",
|
|
122
|
-
NETCAT: "netcat",
|
|
123
|
-
SOCAT: "socat",
|
|
124
|
-
// DNS & Subdomain
|
|
125
|
-
DIG: "dig",
|
|
126
|
-
HOST: "host",
|
|
127
|
-
NSLOOKUP: "nslookup",
|
|
128
|
-
WHOIS: "whois",
|
|
129
|
-
SUBFINDER: "subfinder",
|
|
130
|
-
AMASS: "amass",
|
|
131
|
-
DNSENUM: "dnsenum",
|
|
132
|
-
DNSRECON: "dnsrecon",
|
|
133
|
-
DNSMAP: "dnsmap",
|
|
134
|
-
ZONE_TRANSFER: "zone_transfer",
|
|
135
|
-
// Service Enumeration
|
|
136
|
-
SNMP_WALK: "snmp_walk",
|
|
137
|
-
SNMP_CHECK: "snmp_check",
|
|
138
|
-
ONESIXTYONE: "onesixtyone",
|
|
139
|
-
FTP_ENUM: "ftp_enum",
|
|
140
|
-
FTP_ANON: "ftp_anon",
|
|
141
|
-
NBTSCAN: "nbtscan",
|
|
142
|
-
RPC_INFO: "rpc_info",
|
|
143
|
-
SHOWMOUNT: "showmount",
|
|
144
|
-
TELNET: "telnet",
|
|
145
|
-
// Web Recon & Tech Identification
|
|
146
|
-
WHATWEB: "whatweb",
|
|
147
|
-
HTTPX: "httpx",
|
|
148
|
-
NUCLEI: "nuclei",
|
|
149
|
-
NIKTO: "nikto",
|
|
150
|
-
FFUF: "ffuf",
|
|
151
|
-
GOBUSTER: "gobuster",
|
|
152
|
-
DIRB: "dirb",
|
|
153
|
-
FEROXBUSTER: "feroxbuster",
|
|
154
|
-
WAYBACKURLS: "waybackurls",
|
|
155
|
-
WAFW00F: "wafw00f",
|
|
156
|
-
GOWITNESS: "gowitness",
|
|
157
|
-
// Windows/SMB/AD
|
|
158
|
-
SMB_ENUM: "smb_enum",
|
|
159
|
-
SMBMAP: "smbmap",
|
|
160
|
-
ENUM4LINUX: "enum4linux",
|
|
161
|
-
CRACKMAPEXEC: "crackmapexec",
|
|
162
|
-
SMBCLIENT: "smbclient",
|
|
163
|
-
RPCCLIENT: "rpcclient",
|
|
164
|
-
WINRM: "winrm",
|
|
165
|
-
RDP_CHECK: "rdp_check",
|
|
166
|
-
LDAP_SEARCH: "ldap_search",
|
|
167
|
-
KERBRUTE: "kerbrute",
|
|
168
|
-
BLOODHOUND: "bloodhound",
|
|
169
|
-
// Database Clients
|
|
170
|
-
MSSQL_CLIENT: "mssql_client",
|
|
171
|
-
MYSQL_CLIENT: "mysql_client",
|
|
172
|
-
PSQL_CLIENT: "psql_client",
|
|
173
|
-
REDIS_CLI: "redis_cli",
|
|
174
|
-
MONGO_CLIENT: "mongo_client",
|
|
175
|
-
// Web
|
|
176
|
-
WEB_REQUEST: "web_request",
|
|
177
|
-
DIRECTORY_BRUTEFORCE: "directory_bruteforce",
|
|
178
|
-
SQL_INJECTION: "sql_injection",
|
|
179
|
-
BROWSER_AUTOMATION: "browser_automation",
|
|
180
|
-
// Exploit
|
|
181
|
-
SEARCHSPLOIT: "searchsploit",
|
|
182
|
-
METASPLOIT: "metasploit",
|
|
183
|
-
GENERATE_PAYLOAD: "generate_payload",
|
|
184
|
-
// Credential
|
|
185
|
-
BRUTEFORCE_LOGIN: "bruteforce_login",
|
|
186
|
-
CRACK_HASH: "crack_hash",
|
|
187
|
-
JOHN: "john",
|
|
188
|
-
HASHCAT: "hashcat",
|
|
189
|
-
HASHID: "hashid",
|
|
190
|
-
DUMP_CREDENTIALS: "dump_credentials",
|
|
191
|
-
HYDRA: "hydra",
|
|
192
|
-
MEDUSA: "medusa",
|
|
193
|
-
// Privilege Escalation
|
|
194
|
-
CHECK_SUDO: "check_sudo",
|
|
195
|
-
FIND_SUID: "find_suid",
|
|
196
|
-
RUN_PRIVESC_ENUM: "run_privesc_enum",
|
|
197
|
-
// Post-Exploitation & Tunneling
|
|
198
|
-
SSH: "ssh",
|
|
199
|
-
SSH_KEYGEN: "ssh_keygen",
|
|
200
|
-
SETUP_TUNNEL: "setup_tunnel",
|
|
201
|
-
CHISEL: "chisel",
|
|
202
|
-
PROXYCHAINS: "proxychains",
|
|
203
|
-
LATERAL_MOVEMENT: "lateral_movement",
|
|
204
|
-
REVERSE_SHELL: "reverse_shell",
|
|
205
|
-
// Listener & Payload Delivery
|
|
206
|
-
NC_LISTENER: "nc_listener",
|
|
207
|
-
PYTHON_HTTP_SERVER: "python_http_server",
|
|
208
|
-
MSFVENOM: "msfvenom",
|
|
209
|
-
RLWRAP: "rlwrap",
|
|
210
|
-
PWNCAT: "pwncat",
|
|
211
|
-
// Forensics
|
|
212
|
-
BINWALK: "binwalk",
|
|
213
|
-
FOREMOST: "foremost",
|
|
214
|
-
STEGHIDE: "steghide",
|
|
215
|
-
EXIFTOOL: "exiftool",
|
|
216
|
-
// Reversing
|
|
217
|
-
GDB: "gdb",
|
|
218
|
-
RADARE2: "radare2",
|
|
219
|
-
// Impacket Tools
|
|
220
|
-
IMPACKET_SECRETSDUMP: "impacket_secretsdump",
|
|
221
|
-
IMPACKET_PSEXEC: "impacket_psexec",
|
|
222
|
-
IMPACKET_WMIEXEC: "impacket_wmiexec",
|
|
223
|
-
IMPACKET_SMBEXEC: "impacket_smbexec",
|
|
224
|
-
IMPACKET_ATEXEC: "impacket_atexec",
|
|
225
|
-
IMPACKET_DCOMEXEC: "impacket_dcomexec",
|
|
226
|
-
IMPACKET_GETNPUSERS: "impacket_getnpusers",
|
|
227
|
-
IMPACKET_GETUSERSPNS: "impacket_getuserspns",
|
|
228
|
-
// Reporting
|
|
229
|
-
REPORT_FINDING: "report_finding",
|
|
230
|
-
TAKE_SCREENSHOT: "take_screenshot",
|
|
231
|
-
// Research & Writeups
|
|
232
|
-
SEARCH_WRITEUPS: "search_writeups",
|
|
233
|
-
SEARCH_MACHINE: "search_machine",
|
|
234
|
-
SEARCH_BY_SCENARIO: "search_by_scenario",
|
|
235
|
-
SEARCH_AD_WRITEUPS: "search_ad_writeups",
|
|
236
|
-
SEARCH_LINUX_PRIVESC: "search_linux_privesc",
|
|
237
|
-
SEARCH_WINDOWS_PRIVESC: "search_windows_privesc",
|
|
238
|
-
CTF_RESEARCH: "ctf_research",
|
|
239
|
-
SECURITY_RESEARCH: "security_research"
|
|
240
|
-
};
|
|
241
|
-
var APT_PACKAGE = {
|
|
242
|
-
// Network
|
|
243
|
-
NMAP: "nmap",
|
|
244
|
-
RUSTSCAN: "rustscan",
|
|
245
|
-
MASSCAN: "masscan",
|
|
246
|
-
TCPDUMP: "tcpdump",
|
|
247
|
-
TSHARK: "tshark",
|
|
248
|
-
NGREP: "ngrep",
|
|
249
|
-
ARP_SCAN: "arp-scan",
|
|
250
|
-
SOCAT: "socat",
|
|
251
|
-
NETCAT: "netcat-traditional",
|
|
252
|
-
IPUTILS_PING: "iputils-ping",
|
|
253
|
-
TRACEROUTE: "traceroute",
|
|
254
|
-
MTR: "mtr-tiny",
|
|
255
|
-
// DNS
|
|
256
|
-
DNSUTILS: "dnsutils",
|
|
257
|
-
WHOIS: "whois",
|
|
258
|
-
SUBFINDER: "subfinder",
|
|
259
|
-
AMASS: "amass",
|
|
260
|
-
DNSENUM: "dnsenum",
|
|
261
|
-
DNSRECON: "dnsrecon",
|
|
262
|
-
// Service Enum
|
|
263
|
-
SNMP: "snmp",
|
|
264
|
-
ONESIXTYONE: "onesixtyone",
|
|
265
|
-
NBTSCAN: "nbtscan",
|
|
266
|
-
RPCBIND: "rpcbind",
|
|
267
|
-
NFS_COMMON: "nfs-common",
|
|
268
|
-
TELNET: "telnet",
|
|
269
|
-
// Web
|
|
270
|
-
FFUF: "ffuf",
|
|
271
|
-
GOBUSTER: "gobuster",
|
|
272
|
-
DIRB: "dirb",
|
|
273
|
-
FEROXBUSTER: "feroxbuster",
|
|
274
|
-
WHATWEB: "whatweb",
|
|
275
|
-
HTTPX: "httpx-toolkit",
|
|
276
|
-
NUCLEI: "nuclei",
|
|
277
|
-
NIKTO: "nikto",
|
|
278
|
-
WAFW00F: "wafw00f",
|
|
279
|
-
SQLMAP: "sqlmap",
|
|
280
|
-
// Windows/SMB/AD
|
|
281
|
-
SMBCLIENT: "smbclient",
|
|
282
|
-
SMBMAP: "smbmap",
|
|
283
|
-
ENUM4LINUX: "enum4linux",
|
|
284
|
-
CRACKMAPEXEC: "crackmapexec",
|
|
285
|
-
EVIL_WINRM: "evil-winrm",
|
|
286
|
-
LDAP_UTILS: "ldap-utils",
|
|
287
|
-
KERBRUTE: "kerbrute",
|
|
288
|
-
BLOODHOUND: "bloodhound",
|
|
289
|
-
// Database
|
|
290
|
-
IMPACKET_SCRIPTS: "impacket-scripts",
|
|
291
|
-
MYSQL_CLIENT: "default-mysql-client",
|
|
292
|
-
POSTGRESQL_CLIENT: "postgresql-client",
|
|
293
|
-
REDIS_TOOLS: "redis-tools",
|
|
294
|
-
MONGODB_CLIENTS: "mongodb-clients",
|
|
295
|
-
// Credential
|
|
296
|
-
HYDRA: "hydra",
|
|
297
|
-
MEDUSA: "medusa",
|
|
298
|
-
JOHN: "john",
|
|
299
|
-
HASHCAT: "hashcat",
|
|
300
|
-
HASHID: "hashid",
|
|
301
|
-
// Exploit
|
|
302
|
-
EXPLOITDB: "exploitdb",
|
|
303
|
-
METASPLOIT_FRAMEWORK: "metasploit-framework",
|
|
304
|
-
// Post-Exploitation
|
|
305
|
-
OPENSSH_CLIENT: "openssh-client",
|
|
306
|
-
CHISEL: "chisel",
|
|
307
|
-
PROXYCHAINS4: "proxychains4",
|
|
308
|
-
RLWRAP: "rlwrap",
|
|
309
|
-
PWNCAT: "pwncat",
|
|
310
|
-
// Forensics
|
|
311
|
-
BINWALK: "binwalk",
|
|
312
|
-
FOREMOST: "foremost",
|
|
313
|
-
STEGHIDE: "steghide",
|
|
314
|
-
EXIFTOOL: "libimage-exiftool-perl",
|
|
315
|
-
// Reversing
|
|
316
|
-
GDB: "gdb",
|
|
317
|
-
RADARE2: "radare2"
|
|
318
|
-
};
|
|
319
|
-
var TOOL_TO_APT = {
|
|
320
|
-
// System (no apt package needed)
|
|
321
|
-
[TOOL_NAME.BASH]: null,
|
|
322
|
-
[TOOL_NAME.READ_FILE]: null,
|
|
323
|
-
[TOOL_NAME.WRITE_FILE]: null,
|
|
324
|
-
[TOOL_NAME.LIST_DIRECTORY]: null,
|
|
325
|
-
[TOOL_NAME.SET_TARGET]: null,
|
|
326
|
-
// Network - Basic Connectivity
|
|
327
|
-
[TOOL_NAME.PING]: APT_PACKAGE.IPUTILS_PING,
|
|
328
|
-
[TOOL_NAME.TRACEROUTE]: APT_PACKAGE.TRACEROUTE,
|
|
329
|
-
[TOOL_NAME.MTR]: APT_PACKAGE.MTR,
|
|
330
|
-
[TOOL_NAME.RUSTSCAN]: APT_PACKAGE.RUSTSCAN,
|
|
331
|
-
[TOOL_NAME.NMAP_SCAN]: APT_PACKAGE.NMAP,
|
|
332
|
-
[TOOL_NAME.MASSCAN]: APT_PACKAGE.MASSCAN,
|
|
333
|
-
[TOOL_NAME.TCPDUMP_CAPTURE]: APT_PACKAGE.TCPDUMP,
|
|
334
|
-
[TOOL_NAME.TSHARK]: APT_PACKAGE.TSHARK,
|
|
335
|
-
[TOOL_NAME.NGREP]: APT_PACKAGE.NGREP,
|
|
336
|
-
[TOOL_NAME.ARP_SCAN]: APT_PACKAGE.ARP_SCAN,
|
|
337
|
-
[TOOL_NAME.NETCAT]: APT_PACKAGE.NETCAT,
|
|
338
|
-
[TOOL_NAME.SOCAT]: APT_PACKAGE.SOCAT,
|
|
339
|
-
// DNS & Subdomain
|
|
340
|
-
[TOOL_NAME.DIG]: APT_PACKAGE.DNSUTILS,
|
|
341
|
-
[TOOL_NAME.HOST]: APT_PACKAGE.DNSUTILS,
|
|
342
|
-
[TOOL_NAME.NSLOOKUP]: APT_PACKAGE.DNSUTILS,
|
|
343
|
-
[TOOL_NAME.WHOIS]: APT_PACKAGE.WHOIS,
|
|
344
|
-
[TOOL_NAME.SUBFINDER]: APT_PACKAGE.SUBFINDER,
|
|
345
|
-
[TOOL_NAME.AMASS]: APT_PACKAGE.AMASS,
|
|
346
|
-
[TOOL_NAME.DNSENUM]: APT_PACKAGE.DNSENUM,
|
|
347
|
-
[TOOL_NAME.DNSRECON]: APT_PACKAGE.DNSRECON,
|
|
348
|
-
[TOOL_NAME.DNSMAP]: APT_PACKAGE.DNSRECON,
|
|
349
|
-
[TOOL_NAME.ZONE_TRANSFER]: APT_PACKAGE.DNSUTILS,
|
|
350
|
-
// Service Enumeration
|
|
351
|
-
[TOOL_NAME.SNMP_WALK]: APT_PACKAGE.SNMP,
|
|
352
|
-
[TOOL_NAME.SNMP_CHECK]: APT_PACKAGE.SNMP,
|
|
353
|
-
[TOOL_NAME.ONESIXTYONE]: APT_PACKAGE.ONESIXTYONE,
|
|
354
|
-
[TOOL_NAME.FTP_ENUM]: null,
|
|
355
|
-
[TOOL_NAME.FTP_ANON]: null,
|
|
356
|
-
[TOOL_NAME.NBTSCAN]: APT_PACKAGE.NBTSCAN,
|
|
357
|
-
[TOOL_NAME.RPC_INFO]: APT_PACKAGE.RPCBIND,
|
|
358
|
-
[TOOL_NAME.SHOWMOUNT]: APT_PACKAGE.NFS_COMMON,
|
|
359
|
-
[TOOL_NAME.TELNET]: APT_PACKAGE.TELNET,
|
|
360
|
-
// Web Recon & Tech Identification
|
|
361
|
-
[TOOL_NAME.WHATWEB]: APT_PACKAGE.WHATWEB,
|
|
362
|
-
[TOOL_NAME.HTTPX]: APT_PACKAGE.HTTPX,
|
|
363
|
-
[TOOL_NAME.NUCLEI]: APT_PACKAGE.NUCLEI,
|
|
364
|
-
[TOOL_NAME.NIKTO]: APT_PACKAGE.NIKTO,
|
|
365
|
-
[TOOL_NAME.FFUF]: APT_PACKAGE.FFUF,
|
|
366
|
-
[TOOL_NAME.GOBUSTER]: APT_PACKAGE.GOBUSTER,
|
|
367
|
-
[TOOL_NAME.DIRB]: APT_PACKAGE.DIRB,
|
|
368
|
-
[TOOL_NAME.FEROXBUSTER]: APT_PACKAGE.FEROXBUSTER,
|
|
369
|
-
[TOOL_NAME.WAYBACKURLS]: null,
|
|
370
|
-
[TOOL_NAME.WAFW00F]: APT_PACKAGE.WAFW00F,
|
|
371
|
-
[TOOL_NAME.GOWITNESS]: null,
|
|
372
|
-
// Windows/SMB/AD
|
|
373
|
-
[TOOL_NAME.SMB_ENUM]: APT_PACKAGE.SMBCLIENT,
|
|
374
|
-
[TOOL_NAME.SMBMAP]: APT_PACKAGE.SMBMAP,
|
|
375
|
-
[TOOL_NAME.ENUM4LINUX]: APT_PACKAGE.ENUM4LINUX,
|
|
376
|
-
[TOOL_NAME.CRACKMAPEXEC]: APT_PACKAGE.CRACKMAPEXEC,
|
|
377
|
-
[TOOL_NAME.SMBCLIENT]: APT_PACKAGE.SMBCLIENT,
|
|
378
|
-
[TOOL_NAME.RPCCLIENT]: APT_PACKAGE.SMBCLIENT,
|
|
379
|
-
[TOOL_NAME.WINRM]: APT_PACKAGE.EVIL_WINRM,
|
|
380
|
-
[TOOL_NAME.RDP_CHECK]: null,
|
|
381
|
-
[TOOL_NAME.LDAP_SEARCH]: APT_PACKAGE.LDAP_UTILS,
|
|
382
|
-
[TOOL_NAME.KERBRUTE]: APT_PACKAGE.KERBRUTE,
|
|
383
|
-
[TOOL_NAME.BLOODHOUND]: APT_PACKAGE.BLOODHOUND,
|
|
384
|
-
// Database Clients
|
|
385
|
-
[TOOL_NAME.MSSQL_CLIENT]: APT_PACKAGE.IMPACKET_SCRIPTS,
|
|
386
|
-
[TOOL_NAME.MYSQL_CLIENT]: APT_PACKAGE.MYSQL_CLIENT,
|
|
387
|
-
[TOOL_NAME.PSQL_CLIENT]: APT_PACKAGE.POSTGRESQL_CLIENT,
|
|
388
|
-
[TOOL_NAME.REDIS_CLI]: APT_PACKAGE.REDIS_TOOLS,
|
|
389
|
-
[TOOL_NAME.MONGO_CLIENT]: APT_PACKAGE.MONGODB_CLIENTS,
|
|
390
|
-
// Web Attack
|
|
391
|
-
[TOOL_NAME.WEB_REQUEST]: null,
|
|
392
|
-
[TOOL_NAME.DIRECTORY_BRUTEFORCE]: APT_PACKAGE.GOBUSTER,
|
|
393
|
-
[TOOL_NAME.SQL_INJECTION]: APT_PACKAGE.SQLMAP,
|
|
394
|
-
[TOOL_NAME.BROWSER_AUTOMATION]: null,
|
|
395
|
-
// Exploit
|
|
396
|
-
[TOOL_NAME.SEARCHSPLOIT]: APT_PACKAGE.EXPLOITDB,
|
|
397
|
-
[TOOL_NAME.METASPLOIT]: APT_PACKAGE.METASPLOIT_FRAMEWORK,
|
|
398
|
-
[TOOL_NAME.GENERATE_PAYLOAD]: APT_PACKAGE.METASPLOIT_FRAMEWORK,
|
|
399
|
-
// Credential
|
|
400
|
-
[TOOL_NAME.BRUTEFORCE_LOGIN]: APT_PACKAGE.HYDRA,
|
|
401
|
-
[TOOL_NAME.CRACK_HASH]: APT_PACKAGE.JOHN,
|
|
402
|
-
[TOOL_NAME.JOHN]: APT_PACKAGE.JOHN,
|
|
403
|
-
[TOOL_NAME.HASHCAT]: APT_PACKAGE.HASHCAT,
|
|
404
|
-
[TOOL_NAME.HASHID]: APT_PACKAGE.HASHID,
|
|
405
|
-
[TOOL_NAME.DUMP_CREDENTIALS]: APT_PACKAGE.IMPACKET_SCRIPTS,
|
|
406
|
-
[TOOL_NAME.HYDRA]: APT_PACKAGE.HYDRA,
|
|
407
|
-
[TOOL_NAME.MEDUSA]: APT_PACKAGE.MEDUSA,
|
|
408
|
-
// Privilege Escalation
|
|
409
|
-
[TOOL_NAME.CHECK_SUDO]: null,
|
|
410
|
-
[TOOL_NAME.FIND_SUID]: null,
|
|
411
|
-
[TOOL_NAME.RUN_PRIVESC_ENUM]: null,
|
|
412
|
-
// Post-Exploitation & Tunneling
|
|
413
|
-
[TOOL_NAME.SSH]: APT_PACKAGE.OPENSSH_CLIENT,
|
|
414
|
-
[TOOL_NAME.SSH_KEYGEN]: APT_PACKAGE.OPENSSH_CLIENT,
|
|
415
|
-
[TOOL_NAME.SETUP_TUNNEL]: APT_PACKAGE.CHISEL,
|
|
416
|
-
[TOOL_NAME.CHISEL]: APT_PACKAGE.CHISEL,
|
|
417
|
-
[TOOL_NAME.PROXYCHAINS]: APT_PACKAGE.PROXYCHAINS4,
|
|
418
|
-
[TOOL_NAME.LATERAL_MOVEMENT]: APT_PACKAGE.IMPACKET_SCRIPTS,
|
|
419
|
-
[TOOL_NAME.REVERSE_SHELL]: APT_PACKAGE.NETCAT,
|
|
420
|
-
// Listener & Payload Delivery
|
|
421
|
-
[TOOL_NAME.NC_LISTENER]: APT_PACKAGE.NETCAT,
|
|
422
|
-
[TOOL_NAME.PYTHON_HTTP_SERVER]: null,
|
|
423
|
-
[TOOL_NAME.MSFVENOM]: APT_PACKAGE.METASPLOIT_FRAMEWORK,
|
|
424
|
-
[TOOL_NAME.RLWRAP]: APT_PACKAGE.RLWRAP,
|
|
425
|
-
[TOOL_NAME.PWNCAT]: APT_PACKAGE.PWNCAT,
|
|
426
|
-
// Impacket Tools
|
|
427
|
-
[TOOL_NAME.IMPACKET_SECRETSDUMP]: APT_PACKAGE.IMPACKET_SCRIPTS,
|
|
428
|
-
[TOOL_NAME.IMPACKET_PSEXEC]: APT_PACKAGE.IMPACKET_SCRIPTS,
|
|
429
|
-
[TOOL_NAME.IMPACKET_WMIEXEC]: APT_PACKAGE.IMPACKET_SCRIPTS,
|
|
430
|
-
[TOOL_NAME.IMPACKET_SMBEXEC]: APT_PACKAGE.IMPACKET_SCRIPTS,
|
|
431
|
-
[TOOL_NAME.IMPACKET_ATEXEC]: APT_PACKAGE.IMPACKET_SCRIPTS,
|
|
432
|
-
[TOOL_NAME.IMPACKET_DCOMEXEC]: APT_PACKAGE.IMPACKET_SCRIPTS,
|
|
433
|
-
[TOOL_NAME.IMPACKET_GETNPUSERS]: APT_PACKAGE.IMPACKET_SCRIPTS,
|
|
434
|
-
[TOOL_NAME.IMPACKET_GETUSERSPNS]: APT_PACKAGE.IMPACKET_SCRIPTS,
|
|
435
|
-
// Forensics
|
|
436
|
-
[TOOL_NAME.BINWALK]: APT_PACKAGE.BINWALK,
|
|
437
|
-
[TOOL_NAME.FOREMOST]: APT_PACKAGE.FOREMOST,
|
|
438
|
-
[TOOL_NAME.STEGHIDE]: APT_PACKAGE.STEGHIDE,
|
|
439
|
-
[TOOL_NAME.EXIFTOOL]: APT_PACKAGE.EXIFTOOL,
|
|
440
|
-
// Reversing
|
|
441
|
-
[TOOL_NAME.GDB]: APT_PACKAGE.GDB,
|
|
442
|
-
[TOOL_NAME.RADARE2]: APT_PACKAGE.RADARE2,
|
|
443
|
-
// Reporting (no apt package)
|
|
444
|
-
[TOOL_NAME.REPORT_FINDING]: null,
|
|
445
|
-
[TOOL_NAME.TAKE_SCREENSHOT]: null,
|
|
446
|
-
// Research (no apt package)
|
|
447
|
-
[TOOL_NAME.SEARCH_WRITEUPS]: null,
|
|
448
|
-
[TOOL_NAME.SEARCH_MACHINE]: null,
|
|
449
|
-
[TOOL_NAME.SEARCH_BY_SCENARIO]: null,
|
|
450
|
-
[TOOL_NAME.SEARCH_AD_WRITEUPS]: null,
|
|
451
|
-
[TOOL_NAME.SEARCH_LINUX_PRIVESC]: null,
|
|
452
|
-
[TOOL_NAME.SEARCH_WINDOWS_PRIVESC]: null,
|
|
453
|
-
[TOOL_NAME.CTF_RESEARCH]: null,
|
|
454
|
-
[TOOL_NAME.SECURITY_RESEARCH]: null
|
|
455
|
-
};
|
|
456
|
-
var SENSITIVE_TOOLS = [
|
|
457
|
-
TOOL_NAME.WRITE_FILE,
|
|
458
|
-
TOOL_NAME.BRUTEFORCE_LOGIN,
|
|
459
|
-
TOOL_NAME.METASPLOIT,
|
|
460
|
-
TOOL_NAME.SQL_INJECTION,
|
|
461
|
-
TOOL_NAME.DUMP_CREDENTIALS,
|
|
462
|
-
TOOL_NAME.GENERATE_PAYLOAD,
|
|
463
|
-
TOOL_NAME.LATERAL_MOVEMENT
|
|
464
|
-
];
|
|
465
|
-
|
|
466
|
-
// src/config/constants.ts
|
|
467
|
-
var APP_NAME = "pentesting";
|
|
468
|
-
var APP_VERSION = "0.12.13";
|
|
469
|
-
var APP_DESCRIPTION = "Autonomous Penetration Testing AI Agent";
|
|
470
|
-
var LLM_API_KEY = process.env.PENTEST_API_KEY || process.env.ANTHROPIC_API_KEY || "";
|
|
471
|
-
var LLM_BASE_URL = process.env.PENTEST_BASE_URL || void 0;
|
|
472
|
-
var LLM_MODEL = process.env.PENTEST_MODEL || "claude-sonnet-4-20250514";
|
|
473
|
-
var LLM_MAX_TOKENS = parseInt(process.env.PENTEST_MAX_TOKENS || "16384", 10);
|
|
474
|
-
var CONTEXT_WINDOW = {
|
|
475
|
-
maxTokens: 2e5,
|
|
476
|
-
// Claude's context window size
|
|
477
|
-
compactionThreshold: 15e4,
|
|
478
|
-
// Trigger compaction at 75% usage
|
|
479
|
-
reservedTokens: 4e3
|
|
480
|
-
// Reserved for system prompt
|
|
481
|
-
};
|
|
482
|
-
var AGENT_CONFIG = {
|
|
483
|
-
maxIterations: 200,
|
|
484
|
-
maxToolCallsPerIteration: 10,
|
|
485
|
-
autoApprove: false,
|
|
486
|
-
sensitiveTools: SENSITIVE_TOOLS,
|
|
487
|
-
defaultTimeout: 6e4,
|
|
488
|
-
longRunningTimeout: 6e5,
|
|
489
|
-
stuckThreshold: 5,
|
|
490
|
-
stuckTimeThreshold: 3e5,
|
|
491
|
-
maxPhaseAttempts: 20
|
|
492
|
-
};
|
|
493
|
-
var PENTEST_PHASES = [
|
|
494
|
-
{ id: PHASE_ID.RECON, name: "Reconnaissance", description: "Information gathering" },
|
|
495
|
-
{ id: PHASE_ID.SCAN, name: "Scanning", description: "Port and service scanning" },
|
|
496
|
-
{ id: PHASE_ID.ENUM, name: "Enumeration", description: "Deep service enumeration" },
|
|
497
|
-
{ id: PHASE_ID.VULN, name: "Vulnerability Analysis", description: "Vulnerability identification" },
|
|
498
|
-
{ id: PHASE_ID.EXPLOIT, name: "Exploitation", description: "Gaining access" },
|
|
499
|
-
{ id: PHASE_ID.PRIVESC, name: "Privilege Escalation", description: "Elevating privileges" },
|
|
500
|
-
{ id: PHASE_ID.PIVOT, name: "Pivoting", description: "Lateral movement" },
|
|
501
|
-
{ id: PHASE_ID.PERSIST, name: "Persistence", description: "Maintaining access" },
|
|
502
|
-
{ id: PHASE_ID.EXFIL, name: "Data Exfiltration", description: "Data extraction" },
|
|
503
|
-
{ id: PHASE_ID.REPORT, name: "Reporting", description: "Documentation" }
|
|
504
|
-
];
|
|
505
|
-
|
|
506
|
-
export {
|
|
507
|
-
AGENT_STATUS,
|
|
508
|
-
PHASE_ID,
|
|
509
|
-
PHASE_STATUS,
|
|
510
|
-
THOUGHT_TYPE,
|
|
511
|
-
AGENT_EVENT,
|
|
512
|
-
CLI_COMMAND,
|
|
513
|
-
MESSAGE_TYPE,
|
|
514
|
-
TOOL_NAME,
|
|
515
|
-
TOOL_TO_APT,
|
|
516
|
-
APP_NAME,
|
|
517
|
-
APP_VERSION,
|
|
518
|
-
APP_DESCRIPTION,
|
|
519
|
-
LLM_API_KEY,
|
|
520
|
-
LLM_BASE_URL,
|
|
521
|
-
LLM_MODEL,
|
|
522
|
-
LLM_MAX_TOKENS,
|
|
523
|
-
CONTEXT_WINDOW,
|
|
524
|
-
AGENT_CONFIG
|
|
525
|
-
};
|