pentesting 0.7.32 → 0.7.33
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +53 -18
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -35,26 +35,61 @@ pentesting
|
|
|
35
35
|
|
|
36
36
|
---
|
|
37
37
|
|
|
38
|
-
##
|
|
38
|
+
## 🧠 Philosophy: Think Like a Hacker
|
|
39
|
+
|
|
40
|
+
**Pentesting is not a brute-force tool.** It's an intelligent agent that thinks strategically.
|
|
41
|
+
|
|
42
|
+
### Strategic Decision Framework
|
|
43
|
+
|
|
44
|
+
Every action is evaluated using:
|
|
45
|
+
|
|
46
|
+
```
|
|
47
|
+
Value = (Probability × CVSS Impact) / Time Cost
|
|
48
|
+
```
|
|
49
|
+
|
|
50
|
+
The agent only executes actions with **confidence >50%**. Below that, it finds a better approach.
|
|
51
|
+
|
|
52
|
+
### Self-Reflection Before Every Action
|
|
53
|
+
|
|
54
|
+
Before running any tool, the agent asks:
|
|
55
|
+
- "What exactly am I trying to learn?"
|
|
56
|
+
- "Is this the FASTEST way to get that information?"
|
|
57
|
+
- "Have I already tried this? What happened?"
|
|
58
|
+
- "Is there a simpler approach?"
|
|
59
|
+
|
|
60
|
+
### Mandatory Fallback Strategy
|
|
61
|
+
|
|
62
|
+
When a tool fails, the agent immediately tries alternatives:
|
|
63
|
+
|
|
64
|
+
| Task | Primary | Fallback 1 | Fallback 2 |
|
|
65
|
+
|------|---------|------------|------------|
|
|
66
|
+
| Subdomain | subfinder | ffuf | amass |
|
|
67
|
+
| Directory | gobuster | ffuf | dirsearch |
|
|
68
|
+
| Port Scan | rustscan | nmap | masscan |
|
|
69
|
+
|
|
70
|
+
---
|
|
71
|
+
|
|
72
|
+
## 🔥 Why Pentesting?
|
|
73
|
+
|
|
74
|
+
| Feature | Traditional Tools | Pentesting Agent |
|
|
75
|
+
|---------|-------------------|------------------|
|
|
76
|
+
| Decision Making | Manual | AI-driven with confidence scoring |
|
|
77
|
+
| Tool Selection | You choose | Auto-selects based on context |
|
|
78
|
+
| Failure Handling | You retry | Auto-fallback to alternatives |
|
|
79
|
+
| Attack Planning | Manual prioritization | CVSS-based priority matrix |
|
|
80
|
+
| Context Awareness | None | Remembers all findings |
|
|
81
|
+
| Reporting | Manual | Auto-generated findings |
|
|
82
|
+
|
|
83
|
+
---
|
|
84
|
+
|
|
85
|
+
## ✨ Core Capabilities
|
|
39
86
|
|
|
40
|
-
### Core Capabilities
|
|
41
|
-
- **Intelligent Agent**: Self-reflection and decision framework (inspired by Claude Code)
|
|
42
|
-
- **Confidence Scoring**: Only acts on actions with >50% success probability
|
|
43
87
|
- **10-Phase Attack Workflow**: Recon → Scan → Enum → Vuln Analysis → Exploitation → PrivEsc → Pivot → Persist → Exfil → Report
|
|
44
|
-
- **Auto Docker Management**:
|
|
45
|
-
- **Multi-Target Attack**:
|
|
46
|
-
- **Real-time Feedback**: See thinking process, tool calls,
|
|
47
|
-
- **
|
|
48
|
-
- **
|
|
49
|
-
|
|
50
|
-
### v0.7.16 New Features
|
|
51
|
-
- **Self-Reflection**: Agent asks "Is this the fastest way?" before every action
|
|
52
|
-
- **Decision Framework**: Value = (Probability × Impact) / Time Cost
|
|
53
|
-
- **Concrete Tool Commands**: Exact ffuf, nmap, hydra syntax with wordlist paths
|
|
54
|
-
- **Auto Docker**: Container starts automatically when tools are missing
|
|
55
|
-
- **Thinking Display**: See `[thinking]` and `[reasoning]` messages
|
|
56
|
-
- **Token Label**: Status bar shows `3k tok` instead of just `3k`
|
|
57
|
-
- **Approval Fix**: "Approve always" now works correctly (no repeat prompts)
|
|
88
|
+
- **Auto Docker Management**: Pulls and starts tool container automatically
|
|
89
|
+
- **Multi-Target Attack**: Attack multiple targets sequentially
|
|
90
|
+
- **Real-time Feedback**: See thinking process, tool calls, results live
|
|
91
|
+
- **Session Persistence**: Save/resume attack sessions
|
|
92
|
+
- **Context Compaction**: Automatic history summarization
|
|
58
93
|
|
|
59
94
|
---
|
|
60
95
|
|