pentesting 0.4.1 → 0.4.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -1,3 +1,5 @@
1
+ # PENTEST
2
+
1
3
  ```
2
4
  ╔═══════════════════════════════════════════════════════════════╗
3
5
  ║ ║
@@ -9,6 +11,7 @@
9
11
  ║ ╚═╝ ╚══════╝╚═╝ ╚═══╝ ╚═╝ ╚══════╝╚══════╝ ╚═╝ ║
10
12
  ║ ║
11
13
  ║ 🎯 DEF CON-level Autonomous Pentesting Agent ║
14
+ ║ ⚡ Powered by Claude + MCP + Ralph Loop ║
12
15
  ║ ║
13
16
  ╚═══════════════════════════════════════════════════════════════╝
14
17
  ```
@@ -29,11 +32,6 @@ export PENTEST_API_KEY=your_api_key
29
32
  export PENTEST_BASE_URL=https://your-api-endpoint.com/v1
30
33
  export PENTEST_MODEL=your-model-name
31
34
 
32
- export PENTEST_API_KEY="key"
33
- export PENTEST_BASE_URL="https://api.z.ai/api/anthropic"
34
- export PENTEST_MODEL="glm-4.7"
35
-
36
-
37
35
  # Run
38
36
  pentesting
39
37
  ```
@@ -42,46 +40,70 @@ pentesting
42
40
 
43
41
  ## ✨ Features
44
42
 
43
+ ### Core Capabilities
45
44
  - **10-Phase Attack Workflow**: Recon → Scan → Enum → Vuln Analysis → Exploitation → PrivEsc → Pivot → Persist → Exfil → Report
46
- - **9 Specialized Agents**: Built-in experts for each security domain
45
+ - **9 Specialized Agents**: Built-in domain experts for security testing
47
46
  - **Ralph Loop**: Autonomous iteration until objective is achieved
48
- - **Streaming Responses**: Real-time LLM output
47
+ - **Streaming Responses**: Real-time LLM output display
49
48
  - **Session Persistence**: Save/resume pentesting sessions
50
49
  - **Tool Approval**: Manual confirmation for dangerous commands
51
50
  - **MCP Integration**: Extend with Model Context Protocol tools
52
51
  - **Docker Toolkit**: 50+ pre-installed pentesting tools
53
52
  - **Provider Agnostic**: Works with any OpenAI-compatible API
54
53
 
54
+ ### v0.4+ New Features (kimi-cli inspired)
55
+ - **Context Checkpoints**: Save/restore conversation states with `/checkpoint`, `/undo`, `/revert`
56
+ - **Flow Skills**: Mermaid/D2 diagram-based workflow automation
57
+ - **Session Replay**: Review past sessions from wire recordings
58
+ - **Auto-Update**: Background version checking with update notifications
59
+ - **Vision Analysis**: Analyze images from clipboard with `/paste`
60
+ - **Wire Logging**: Detailed session recording in JSONL format
61
+ - **Rich TUI**: Premium ASCII banner, organized help, status reports
62
+
55
63
  ---
56
64
 
57
65
  ## 📖 CLI Commands
58
66
 
67
+ ### Core
59
68
  ```bash
60
- # Target & Session
61
- /target <ip> Set target
69
+ /target <ip> Set target IP/hostname
62
70
  /start [objective] Start autonomous pentest
71
+ /stop Stop current operation
72
+ /status Show status report
73
+ ```
74
+
75
+ ### Session Management
76
+ ```bash
77
+ /checkpoint [desc] Create checkpoint with optional description
78
+ /checkpoints List all checkpoints
79
+ /undo Undo to last checkpoint
80
+ /revert <id> Revert to specific checkpoint
81
+ /compact Compact context (keep last 3 messages)
63
82
  /sessions List saved sessions
64
83
  /resume [id] Resume a session
84
+ /replay Show session recordings
85
+ ```
65
86
 
66
- # Scanning & Enumeration
67
- /scan <target> Quick enumeration
68
- /web <url> Web application testing
69
-
70
- # Exploitation
71
- /exploit <service> Search for exploits
72
- /privesc [os] Check privilege escalation vectors
73
- /attack <objective> Execute attack chain
74
- /hash <hash> Identify and crack hashes
87
+ ### Skills & Extras
88
+ ```bash
89
+ /skills List available skills
90
+ /update Check for updates
91
+ /update now Install update
92
+ ```
75
93
 
76
- # Reporting
94
+ ### Findings & Reports
95
+ ```bash
96
+ /findings Show discovered findings
77
97
  /report Generate pentest report
78
- /findings Show findings
98
+ ```
79
99
 
80
- # Control
100
+ ### Utility
101
+ ```bash
102
+ /paste Paste from clipboard (text or image)
81
103
  /yolo Toggle auto-approve mode
82
- /approve /deny Approve/deny tool execution
83
104
  /clear Clear screen
84
105
  /exit Exit
106
+ /y /n /ya Approve/Deny/Always approve (for pending tools)
85
107
  ```
86
108
 
87
109
  ---
@@ -195,33 +217,62 @@ await agent.addMCPServer('security-tools', 'docker', [
195
217
  ## 🏗️ Architecture
196
218
 
197
219
  ```
198
- ┌─────────────────────────────────────────────────────────────┐
199
- TUI (app.tsx)
200
- - Streaming text display
201
- - Tool approval prompts
202
- - Session management
203
- └──────────────────────────┬──────────────────────────────────┘
204
- │ Wire Protocol
205
- ┌──────────────────────────▼──────────────────────────────────┐
206
- │ PentestingAgent (Unified) │
207
- ┌──────────────┐ ┌──────────────┐ ┌──────────────┐
208
- RalphLoop │ │ Streaming │ Session │ │
209
- │ │ (Auto-iter) Handler Manager
210
- └──────────────┘ └──────────────┘ └──────────────┘
211
-
212
- ┌──────────────────────────────────────────────────┐
213
- │ AutonomousHackingAgent (Core)
214
- │ │ ┌──────────────────────────────────────────┐
215
- │ │ 9 Built-in Specialized Agents
216
- │ │ └──────────────────────────────────────────┘
217
- └──────────────────────────────────────────────────┘
218
- └──────────────────────────┬──────────────────────────────────┘
219
-
220
- ┌────────────────┼────────────────┐
221
- ┌────▼────┐ ┌────▼────┐ ┌────▼────┐
222
- │ Tool │ │ Bash │ │ MCP │
223
- Executor Commands Servers
224
- └─────────┘ └─────────┘ └─────────┘
220
+ ┌─────────────────────────────────────────────────────────────────┐
221
+ TUI (app.tsx)
222
+ ┌──────────────┐ ┌──────────────┐ ┌──────────────────────────┐
223
+ WireLogger │ │ContextMgr │ SlashCommandRegistry │ │
224
+ (Recording) │(Checkpoints)│ │ (Command Handling) │ │
225
+ │ └──────────────┘ └──────────────┘ └──────────────────────────┘ │
226
+ └────────────────────────────┬────────────────────────────────────┘
227
+ │ Events
228
+ ┌────────────────────────────▼────────────────────────────────────┐
229
+ AutonomousHackingAgent (Core Engine)
230
+ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐
231
+ │ │ HookExecutor MCPManager │ │ApprovalMgr
232
+ │ (Lifecycle) │ (Extensions) │ │(Tool Safety) │ │
233
+ └──────────────┘ └──────────────┘ └──────────────┘
234
+
235
+ ┌────────────────────────────────────────────────────────────┐
236
+ │ │ 9 Built-in Specialized Agents
237
+ │ │ target-explorer exploit-researcher privesc-master
238
+ │ │ web-hacker • crypto-solver • forensics-analyst
239
+ │ │ reverse-engineer • attack-architect • finding-reviewer │ │
240
+ │ └────────────────────────────────────────────────────────────┘ │
241
+ └────────────────────────────┬────────────────────────────────────┘
242
+
243
+ ┌──────────────────┼──────────────────┐
244
+ ┌────▼────┐ ┌────▼────┐ ┌────▼────┐
245
+ Tool Bash MCP
246
+ │Executor │ │Commands │ │ Servers │
247
+ └─────────┘ └─────────┘ └─────────┘
248
+ ```
249
+
250
+ ### Module Connectivity
251
+
252
+ ```
253
+ Core Modules (src/core/):
254
+ ├── agent/ AutonomousHackingAgent, PentestingAgent, AgentOrchestrator
255
+ ├── approval/ ApprovalManager - tool execution safety
256
+ ├── commands/ SlashCommandRegistry - command handling
257
+ ├── context/ ContextManager (checkpoints) + Compaction (tokens)
258
+ ├── display/ DisplayBlocks - rich output formatting
259
+ ├── hooks/ HookExecutor - lifecycle events
260
+ ├── loop/ RalphLoop - autonomous iteration
261
+ ├── prompts/ System prompts for agents
262
+ ├── replay/ SessionReplay - wire file parsing
263
+ ├── session/ SessionManager - persistence
264
+ ├── skill/ SkillManager + FlowExecutor - workflow automation
265
+ ├── streaming/ StreamingAgent - real-time output
266
+ ├── tools/ Tool definitions, executor, registry
267
+ └── update/ AutoUpdate - version management
268
+
269
+ Support Modules:
270
+ ├── wire/ WireLogger (JSONL recording) + Wire Protocol
271
+ ├── mcp/ MCPManager, MCPClient - extensions
272
+ ├── utils/ Clipboard, Retry utilities
273
+ ├── agents/ 9 built-in specialized agents
274
+ ├── commands/ Built-in slash commands
275
+ └── config/ Constants, Theme, Agent configuration
225
276
  ```
226
277
 
227
278
  ---
@@ -231,21 +282,29 @@ await agent.addMCPServer('security-tools', 'docker', [
231
282
  ```
232
283
  src/
233
284
  ├── index.tsx # CLI entry point
234
- ├── cli/app.tsx # TUI with streaming, approval, sessions
285
+ ├── cli/
286
+ │ ├── app.tsx # TUI with streaming, approval, sessions
287
+ │ └── components/ # Rich display components
235
288
  ├── core/
236
289
  │ ├── agent/ # Agent implementations
237
290
  │ ├── approval/ # Tool approval system
238
- │ ├── context/ # Conversation compaction
291
+ │ ├── commands/ # Slash command registry
292
+ │ ├── context/ # Checkpoint + compaction
293
+ │ ├── display/ # Rich output blocks
239
294
  │ ├── hooks/ # Event hooks
240
295
  │ ├── loop/ # Ralph autonomous loop
296
+ │ ├── replay/ # Session replay
241
297
  │ ├── session/ # Session persistence
298
+ │ ├── skill/ # Flow skills (Mermaid/D2)
242
299
  │ ├── streaming/ # Real-time streaming
300
+ │ ├── update/ # Auto-update system
243
301
  │ ├── prompts/ # System prompts
244
302
  │ └── tools/ # Tool definitions & executor
245
- ├── agents/index.ts # 9 built-in specialized agents
246
- ├── commands/index.ts # Built-in slash commands
247
- ├── wire/ # Agent-UI communication
303
+ ├── agents/ # 9 built-in specialized agents
304
+ ├── commands/ # Built-in slash commands
305
+ ├── wire/ # JSONL logging + Wire protocol
248
306
  ├── mcp/ # MCP client integration
307
+ ├── utils/ # Clipboard, retry utilities
249
308
  └── config/ # Constants, theme
250
309
  ```
251
310
 
@@ -8,8 +8,8 @@ import {
8
8
  readVersionCache,
9
9
  semverTuple,
10
10
  writeVersionCache
11
- } from "./chunk-TABUHG2A.js";
12
- import "./chunk-JUHBSTKO.js";
11
+ } from "./chunk-5RFHBFIH.js";
12
+ import "./chunk-JOYCWIE7.js";
13
13
  import "./chunk-3RG5ZIWI.js";
14
14
  export {
15
15
  checkForUpdate,
@@ -1,7 +1,7 @@
1
1
  import {
2
2
  APP_NAME,
3
3
  APP_VERSION
4
- } from "./chunk-JUHBSTKO.js";
4
+ } from "./chunk-JOYCWIE7.js";
5
5
 
6
6
  // src/core/update/auto-update.ts
7
7
  import { execSync } from "child_process";
@@ -132,7 +132,7 @@ var SENSITIVE_TOOLS = [
132
132
 
133
133
  // src/config/constants.ts
134
134
  var APP_NAME = "pentesting";
135
- var APP_VERSION = "0.4.1";
135
+ var APP_VERSION = "0.4.2";
136
136
  var APP_DESCRIPTION = "Autonomous Penetration Testing AI Agent";
137
137
  var LLM_API_KEY = process.env.PENTEST_API_KEY || process.env.ANTHROPIC_API_KEY || "";
138
138
  var LLM_BASE_URL = process.env.PENTEST_BASE_URL || void 0;
package/dist/index.js CHANGED
@@ -15,7 +15,7 @@ import {
15
15
  PHASE_STATUS,
16
16
  THOUGHT_TYPE,
17
17
  TOOL_NAME
18
- } from "./chunk-JUHBSTKO.js";
18
+ } from "./chunk-JOYCWIE7.js";
19
19
  import {
20
20
  __require
21
21
  } from "./chunk-3RG5ZIWI.js";
@@ -4922,7 +4922,7 @@ var App = ({ autoApprove = false, target }) => {
4922
4922
  setCheckpointCount(contextManagerRef.current?.getCheckpoints().length || 0);
4923
4923
  }
4924
4924
  });
4925
- import("./auto-update-ZU3T3VSG.js").then(({ checkForUpdateAsync, formatUpdateNotification }) => {
4925
+ import("./auto-update-B2Z37JG3.js").then(({ checkForUpdateAsync, formatUpdateNotification }) => {
4926
4926
  checkForUpdateAsync().then((result) => {
4927
4927
  if (result.hasUpdate) {
4928
4928
  const notification = formatUpdateNotification(result);
@@ -4965,13 +4965,39 @@ var App = ({ autoApprove = false, target }) => {
4965
4965
  return duration;
4966
4966
  }, []);
4967
4967
  useEffect(() => {
4968
- addMessage(MESSAGE_TYPE.SYSTEM, "Pentesting Agent initialized. Type /help for commands.");
4968
+ const versionPadded = `v${APP_VERSION}`.padEnd(8);
4969
+ const banner = `
4970
+ \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557
4971
+ \u2551 \u2551
4972
+ \u2551 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2557 \u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2551
4973
+ \u2551 \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2551\u255A\u2550\u2550\u2588\u2588\u2554\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u255A\u2550\u2550\u2588\u2588\u2554\u2550\u2550\u255D\u2551
4974
+ \u2551 \u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2551 \u2588\u2588\u2551 \u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2551 \u2551
4975
+ \u2551 \u2588\u2588\u2554\u2550\u2550\u2550\u255D \u2588\u2588\u2554\u2550\u2550\u255D \u2588\u2588\u2551\u255A\u2588\u2588\u2557\u2588\u2588\u2551 \u2588\u2588\u2551 \u2588\u2588\u2554\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2588\u2588\u2551 \u2588\u2588\u2551 \u2551
4976
+ \u2551 \u2588\u2588\u2551 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2551 \u255A\u2588\u2588\u2588\u2588\u2551 \u2588\u2588\u2551 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551 \u2588\u2588\u2551 \u2551
4977
+ \u2551 \u255A\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D\u255A\u2550\u255D \u255A\u2550\u2550\u2550\u255D \u255A\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D \u2551
4978
+ \u2551 \u2551
4979
+ \u2551 \u{1F3AF} DEF CON-level Autonomous Pentesting Agent ${versionPadded}\u2551
4980
+ \u2551 \u26A1 Powered by Claude + MCP + Ralph Loop \u2551
4981
+ \u2551 \u2551
4982
+ \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D`;
4983
+ addMessage(MESSAGE_TYPE.SYSTEM, banner);
4984
+ addMessage(MESSAGE_TYPE.SYSTEM, `
4985
+ \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
4986
+ \u2502 \u{1F680} Quick Start \u2502
4987
+ \u2502 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 \u2502
4988
+ \u2502 /target <ip> Set target IP/hostname \u2502
4989
+ \u2502 /start [goal] Start autonomous pentesting \u2502
4990
+ \u2502 /help Show all commands \u2502
4991
+ \u2502 \u2502
4992
+ \u2502 \u{1F527} Features: 10 Attack Phases \u2022 9 Specialized Agents \u2502
4993
+ \u2502 \u{1F4E1} Session Recording \u2022 Checkpoints \u2022 Auto-Update \u2502
4994
+ \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518`);
4969
4995
  if (autoApprove) {
4970
- addMessage(MESSAGE_TYPE.SYSTEM, "\u26A0\uFE0F YOLO mode: Auto-approving all tools");
4996
+ addMessage(MESSAGE_TYPE.SYSTEM, "\u26A0\uFE0F YOLO Mode: Auto-approving all tool executions");
4971
4997
  }
4972
4998
  if (target) {
4973
4999
  agent.setTarget(target);
4974
- addMessage(MESSAGE_TYPE.SYSTEM, `Target: ${target}`);
5000
+ addMessage(MESSAGE_TYPE.SYSTEM, `\u{1F3AF} Target: ${target}`);
4975
5001
  }
4976
5002
  agent.on(AGENT_EVENT.THOUGHT, (thought) => {
4977
5003
  setCurrentStatus(thought.content.slice(0, 60));
@@ -5384,7 +5410,7 @@ var App = ({ autoApprove = false, target }) => {
5384
5410
  return;
5385
5411
  case "update":
5386
5412
  try {
5387
- const { checkForUpdate, formatUpdateNotification, doUpdate } = await import("./update-4H3DBFBE.js");
5413
+ const { checkForUpdate, formatUpdateNotification, doUpdate } = await import("./update-NZKK32L2.js");
5388
5414
  const result = checkForUpdate(true);
5389
5415
  if (result.hasUpdate) {
5390
5416
  const notification = formatUpdateNotification(result);
@@ -8,8 +8,8 @@ import {
8
8
  readVersionCache,
9
9
  semverTuple,
10
10
  writeVersionCache
11
- } from "./chunk-TABUHG2A.js";
12
- import "./chunk-JUHBSTKO.js";
11
+ } from "./chunk-5RFHBFIH.js";
12
+ import "./chunk-JOYCWIE7.js";
13
13
  import "./chunk-3RG5ZIWI.js";
14
14
  export {
15
15
  checkForUpdate,
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "pentesting",
3
- "version": "0.4.1",
3
+ "version": "0.4.2",
4
4
  "description": "Autonomous Penetration Testing AI Agent",
5
5
  "type": "module",
6
6
  "main": "dist/index.js",