pentesting 0.14.1 → 0.16.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. package/README.md +105 -21
  2. package/dist/main.js +3103 -0
  3. package/package.json +8 -8
  4. package/dist/chunk-3RG5ZIWI.js +0 -10
  5. package/dist/chunk-5KIJPRTS.js +0 -832
  6. package/dist/chunk-M2IFHZDV.js +0 -602
  7. package/dist/index.js +0 -18815
  8. package/dist/skill-NGH4KQUH.js +0 -611
  9. package/dist/web-search-IOD4SUIR.js +0 -49
  10. package/src/agents/specs/crypto.yaml +0 -79
  11. package/src/agents/specs/default.yaml +0 -60
  12. package/src/agents/specs/exploit.yaml +0 -70
  13. package/src/agents/specs/privesc.yaml +0 -83
  14. package/src/agents/specs/recon.yaml +0 -65
  15. package/src/agents/specs/web.yaml +0 -73
  16. /package/dist/{index.d.ts → main.d.ts} +0 -0
package/README.md CHANGED
@@ -1,12 +1,12 @@
1
1
  <div align="center">
2
2
 
3
3
  ```
4
- ██████╗ ███████╗███╗ ██╗████████╗███████╗███████╗████████╗██╗███╗ ██╗ ██████╗
5
- ██╔══██╗██╔════╝████╗ ██║╚══██╔══╝██╔════╝██╔════╝╚══██╔══╝██║████╗ ██║██╔════╝
4
+ ██████╗ ███████╗███╗ ██╗████████╗███████╗███████╗████████╗██╗███╗ ██╗ ██████╗
5
+ ██╔══██╗██╔════╝████╗ ██║╚══██╔══╝██╔════╝██╔════╝╚══██╔══╝██║████╗ ██║██╔════╝
6
6
  ██████╔╝█████╗ ██╔██╗ ██║ ██║ █████╗ ███████╗ ██║ ██║██╔██╗ ██║██║ ███╗
7
7
  ██╔═══╝ ██╔══╝ ██║╚██╗██║ ██║ ██╔══╝ ╚════██║ ██║ ██║██║╚██╗██║██║ ██║
8
8
  ██║ ███████╗██║ ╚████║ ██║ ███████╗███████║ ██║ ██║██║ ╚████║╚██████╔╝
9
- ╚═╝ ╚══════╝╚═╝ ╚═══╝ ╚═╝ ╚══════╝╚══════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═════╝
9
+ ╚═╝ ╚══════╝╚═╝ ╚═══╝ ╚═╝ ╚══════╝╚══════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═════╝
10
10
  ────────────────────────────────────────────────────────────────────────────────
11
11
  A U T O N O M O U S S E C U R I T Y A G E N T
12
12
  ```
@@ -23,6 +23,7 @@
23
23
  ```bash
24
24
  npm install -g pentesting
25
25
 
26
+ # Required environments
26
27
  export PENTEST_API_KEY="your_api_key"
27
28
  export PENTEST_BASE_URL="https://api.z.ai/api/anthropic"
28
29
  export PENTEST_MODEL="glm-4.7"
@@ -30,38 +31,121 @@ export PENTEST_MODEL="glm-4.7"
30
31
  pentesting
31
32
  ```
32
33
 
33
- ## Purpose
34
+ ---
35
+
36
+ ## Features
37
+
38
+ ### 🤖 Multi-Agent Architecture
39
+
40
+ Autonomous penetration testing with specialized agents:
41
+
42
+ ```
43
+ Orchestrator → Recon → Vuln → Exploit → Post
44
+ ↓ ↓ ↓ ↓
45
+ Web Infra Report
46
+ ```
34
47
 
35
- This project is a pentesting tool that can be used to test the security of a system.
48
+ Each agent is a simple `while(true) { think → tool → observe }` loop with:
49
+ - **Specialized prompts** (not code)
50
+ - **Dedicated tool sets**
51
+ - **State slicing** for token efficiency
52
+
53
+ ### 🎯 CTF Expert Knowledge
54
+
55
+ Built-in security expertise including:
56
+ - **Essential options**: `nmap -Pn` (never forget)
57
+ - **CVE detection**: Apache 2.4.49 → CVE-2021-41773
58
+ - **Service-specific exploits**: Samba, VSFTPD, MS17-010
59
+ - **Web attack vectors**: SQLi, XSS, SSRF, XXE
60
+ - **AD infrastructure**: BloodHound, CrackMapExec
61
+
62
+ ### 🔍 Transparent Execution
63
+
64
+ Full visibility into agent decision-making:
65
+
66
+ ```
67
+ Orchestrator agentLoop
68
+ │ think: "Start with reconnaissance"
69
+ │ tool_call: delegate('recon', 'Subnet scan')
70
+ │
71
+ ├─▶ RECON agentLoop
72
+ │ │ tool_call: nmap -Pn 10.10.10.0/24 [confirm → y]
73
+ │ │ observe: 3 hosts discovered
74
+ │ │ escalate ↑: recon → vuln
75
+ │ └─▶ return "Apache 2.4.49 found"
76
+ │
77
+ └─▶ VULN agentLoop
78
+ │ tool_call: curl --path-as-is ... [review → yes]
79
+ │ observe: /etc/passwd exposure confirmed
80
+ └─▶ return "CVE-2021-41773 Critical confirmed"
81
+ ```
36
82
 
37
- ## issue report
83
+ ### 🛡️ Safety First
38
84
 
39
- email: agnusdei1207@gmail.com
40
- linkedin: https://www.linkedin.com/in/sang-woo-park-158685393/en
85
+ - **Scope enforcement**: Never attack outside approved targets
86
+ - **Approval gates**: `auto` / `confirm` / `review`
87
+ - **Audit logging**: Every action recorded
88
+ - **Authorized users only**: No unnecessary prompt defenses
89
+
90
+ ---
41
91
 
42
92
  ## TUI Commands
43
93
 
44
94
  ```
45
- /target <ip> Set target
46
- /start Start autonomous pentest
47
- /research <box> Search writeups & exploits
48
- /findings Show findings
49
- /yolo Toggle auto-approve
50
- /help Show all commands
95
+ /target <cidr> Set engagement scope
96
+ /start Start autonomous pentest
97
+ /findings Show all findings
98
+ /loot Show credentials & sessions
99
+ /state Show current engagement state
100
+ /yolo Toggle auto-approve mode
101
+ /exit Exit session
102
+ /help Show all commands
51
103
  ```
52
104
 
53
105
  ---
54
106
 
55
107
  ## Environment
56
108
 
57
- | Variable | Description |
58
- |----------|-------------|
59
- | `PENTEST_API_KEY` | API key (required) |
60
- | `PENTEST_BASE_URL` | Custom API endpoint |
61
- | `PENTEST_MODEL` | LLM model (default: claude-sonnet-4-20250514) |
109
+ | Variable | Description | Default |
110
+ |----------|-------------|---------|
111
+ | `PENTEST_API_KEY` | API key (required) | - |
112
+ | `PENTEST_BASE_URL` | Custom API endpoint | - |
113
+ | `PENTEST_MODEL` | LLM model | `glm-4.7` |
114
+
115
+ ---
116
+
117
+ ## Architecture
118
+
119
+ ```
120
+ ┌─────────────────────────────────────────────────────────────┐
121
+ │ Orchestrator │
122
+ │ "Delegate, don't execute directly" │
123
+ │ • delegate_to_agent • escalate • get_state • set_scope │
124
+ └────────────┬────────────────────────────────────────────────┘
125
+ │
126
+ ┌────────┼────────┬────────┬────────┬────────┐
127
+ │ │ │ │ │ │
128
+ ▼ ▼ ▼ ▼ ▼ ▼
129
+ Recon Vuln Exploit Post Web Infra
130
+ "Info" "Verify" "Approved" "Shell" "Web" "AD"
131
+ ```
132
+
133
+ **Key principles:**
134
+ 1. Agent = `while(true) { think → tool → observe }`
135
+ 2. Agent difference = prompt + tool set (not code)
136
+ 3. Communication = danger↑ via Orchestrator, ↓ direct call
137
+ 4. All prompts get Scope + State injection
138
+ 5. Approval = `auto` | `confirm` | `review`
139
+
140
+ ---
141
+
142
+ ## Issue Report
143
+
144
+ **Email**: agnusdei1207@gmail.com
145
+ **LinkedIn**: [sang-woo-park](https://www.linkedin.com/in/sang-woo-park-158685393/en)
62
146
 
63
147
  ---
64
148
 
65
- ## Documentation
149
+ ## License
66
150
 
67
- - **[ARCHITECTURE.md](docs/ARCHITECTURE.md)** — System architecture & data flow
151
+ MIT License - see [LICENSE](LICENSE) for details.