pentesting 0.47.2 → 0.47.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +58 -5
- package/dist/cloud/prompt.md +1 -1
- package/dist/file-sharing/prompt.md +2 -2
- package/dist/main.js +1294 -889
- package/dist/network/prompt.md +1 -1
- package/dist/orchestrator/orchestrator.md +44 -43
- package/dist/prompts/base.md +40 -10
- package/dist/prompts/infra.md +1 -1
- package/dist/prompts/vuln.md +3 -3
- package/dist/web/prompt.md +2 -2
- package/dist/wireless/prompt.md +8 -8
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -34,16 +34,69 @@ Pentesting support tool
|
|
|
34
34
|
## Quick Start with Docker (Recommended)
|
|
35
35
|
|
|
36
36
|
```bash
|
|
37
|
+
# One-time use (data deleted after exit)
|
|
37
38
|
docker run -it --rm \
|
|
38
|
-
-e PENTEST_API_KEY="
|
|
39
|
-
-e PENTEST_BASE_URL="https://
|
|
39
|
+
-e PENTEST_API_KEY="your_glm_api_key" \
|
|
40
|
+
-e PENTEST_BASE_URL="https://open.bigmodel.cn/api/paas/v4" \
|
|
40
41
|
-e PENTEST_MODEL="glm-5" \
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
42
|
+
agnusdei1207/pentesting
|
|
43
|
+
|
|
44
|
+
# Persistent data (saved to ./pentest-data/)
|
|
45
|
+
docker run -it --rm \
|
|
46
|
+
-e PENTEST_API_KEY="your_glm_api_key" \
|
|
47
|
+
-e PENTEST_BASE_URL="https://open.bigmodel.cn/api/paas/v4" \
|
|
48
|
+
-e PENTEST_MODEL="glm-5" \
|
|
49
|
+
-v ./pentest-data:/root/.pentest \
|
|
44
50
|
agnusdei1207/pentesting
|
|
45
51
|
```
|
|
46
52
|
|
|
53
|
+
Web search is automatically configured to use GLM Web Search with your `PENTEST_API_KEY`.
|
|
54
|
+
|
|
55
|
+
### Using Brave Search
|
|
56
|
+
|
|
57
|
+
```bash
|
|
58
|
+
docker run -it --rm \
|
|
59
|
+
-e PENTEST_API_KEY="your_glm_api_key" \
|
|
60
|
+
-e PENTEST_BASE_URL="https://open.bigmodel.cn/api/paas/v4" \
|
|
61
|
+
-e PENTEST_MODEL="glm-5" \
|
|
62
|
+
-e SEARCH_API_KEY="your_brave_api_key" \
|
|
63
|
+
-e SEARCH_API_URL="https://api.search.brave.com/res/v1/web/search" \
|
|
64
|
+
-v ./pentest-data:/root/.pentest \
|
|
65
|
+
agnusdei1207/pentesting
|
|
66
|
+
```
|
|
67
|
+
|
|
68
|
+
Get Brave Search API key at: https://brave.com/search/api/
|
|
69
|
+
|
|
70
|
+
### Using Serper (Google Search)
|
|
71
|
+
|
|
72
|
+
```bash
|
|
73
|
+
docker run -it --rm \
|
|
74
|
+
-e PENTEST_API_KEY="your_glm_api_key" \
|
|
75
|
+
-e PENTEST_BASE_URL="https://open.bigmodel.cn/api/paas/v4" \
|
|
76
|
+
-e PENTEST_MODEL="glm-5" \
|
|
77
|
+
-e SEARCH_API_KEY="your_serper_api_key" \
|
|
78
|
+
-e SEARCH_API_URL="https://google.serper.dev/search" \
|
|
79
|
+
-v ./pentest-data:/root/.pentest \
|
|
80
|
+
agnusdei1207/pentesting
|
|
81
|
+
```
|
|
82
|
+
|
|
83
|
+
Get Serper API key at: https://serper.dev/
|
|
84
|
+
|
|
85
|
+
## Environment Variables
|
|
86
|
+
|
|
87
|
+
| Variable | Required | Default | Description |
|
|
88
|
+
|----------|----------|---------|-------------|
|
|
89
|
+
| `PENTEST_API_KEY` | ✅ Yes | - | LLM API key (also used for web search if `SEARCH_API_KEY` not set) |
|
|
90
|
+
| `PENTEST_BASE_URL` | No | - | Custom API endpoint URL |
|
|
91
|
+
| `PENTEST_MODEL` | No | - | Model name (e.g., `glm-5`) |
|
|
92
|
+
| `SEARCH_API_KEY` | No | Uses `PENTEST_API_KEY` | Web search API key (optional, falls back to main key) |
|
|
93
|
+
| `SEARCH_API_URL` | No | GLM Web Search | Web search API URL |
|
|
94
|
+
|
|
95
|
+
### Web Search Defaults
|
|
96
|
+
|
|
97
|
+
- **Default**: GLM Web Search (`https://open.bigmodel.cn/api/paas/v4/tools/web-search-pro`)
|
|
98
|
+
- **API Key**: Falls back to `PENTEST_API_KEY` if `SEARCH_API_KEY` not set
|
|
99
|
+
|
|
47
100
|
## Issue
|
|
48
101
|
|
|
49
102
|
email: agnusdei1207@gmail.com
|
package/dist/cloud/prompt.md
CHANGED
|
@@ -16,7 +16,7 @@ curl -s -H "Metadata-Flavor: Google" http://metadata.google.internal/computeMeta
|
|
|
16
16
|
|
|
17
17
|
# S3 Bucket Enumeration
|
|
18
18
|
aws s3 ls s3://<bucket> --no-sign-request
|
|
19
|
-
aws s3 cp s3://<bucket>/sensitive.txt /tmp/ --no-sign-request
|
|
19
|
+
aws s3 cp s3://<bucket>/sensitive.txt .pentesting/tmp/ --no-sign-request
|
|
20
20
|
|
|
21
21
|
# Azure Storage
|
|
22
22
|
curl -s "https://<account>.blob.core.windows.net/<container>?restype=container&comp=list"
|
|
@@ -38,8 +38,8 @@ hydra -L users.txt -P passwords.txt <target> ftp
|
|
|
38
38
|
showmount -e <target>
|
|
39
39
|
nmap -p 2049 --script nfs-ls,nfs-showmount,nfs-statfs <target>
|
|
40
40
|
# NFS Mount
|
|
41
|
-
mkdir /tmp/nfs && mount -t nfs <target>:/<export> /tmp/nfs
|
|
42
|
-
ls -la /tmp/nfs/
|
|
41
|
+
mkdir -p .pentesting/tmp/nfs && mount -t nfs <target>:/<export> .pentesting/tmp/nfs
|
|
42
|
+
ls -la .pentesting/tmp/nfs/
|
|
43
43
|
|
|
44
44
|
# WebDAV
|
|
45
45
|
davtest -url http://<target>/webdav/
|