pentesting 0.7.48 → 0.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/README.md +291 -248
  2. package/dist/{auto-update-CNT5P47B.js → auto-update-FWXZGK5Z.js} +2 -2
  3. package/dist/{chunk-2DVCF464.js → chunk-5QWIIPHH.js} +1 -1
  4. package/dist/{chunk-WWJXXJRC.js → chunk-AIBIXGJI.js} +1 -1
  5. package/dist/index.js +3 -3
  6. package/dist/{update-HVVSEVIW.js → update-OD3N757W.js} +2 -2
  7. package/package.json +5 -2
package/README.md CHANGED
@@ -1,348 +1,391 @@
1
- <div align="center">
1
+ # 🎯 Pentesting
2
2
 
3
- ```
4
- ██████╗ ███████╗███╗ ██╗████████╗███████╗███████╗████████╗██╗███╗ ██╗ ██████╗
5
- ██╔══██╗██╔════╝████╗ ██║╚══██╔══╝██╔════╝██╔════╝╚══██╔══╝██║████╗ ██║██╔════╝
6
- ██████╔╝█████╗ ██╔██╗ ██║ ██║ █████╗ ███████╗ ██║ ██║██╔██╗ ██║██║ ███╗
7
- ██╔═══╝ ██╔══╝ ██║╚██╗██║ ██║ ██╔══╝ ╚════██║ ██║ ██║██║╚██╗██║██║ ██║
8
- ██║ ███████╗██║ ╚████║ ██║ ███████╗███████║ ██║ ██║██║ ╚████║╚██████╔╝
9
- ╚═╝ ╚══════╝╚═╝ ╚═══╝ ╚═╝ ╚══════╝╚══════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═════╝
10
- ```
11
-
12
- **Autonomous AI Penetration Testing Agent**
3
+ <p align="center">
4
+ <img src="docs/assets/pentesting-logo.png" alt="Pentesting" width="400">
5
+ </p>
13
6
 
14
- [![npm version](https://badge.fury.io/js/pentesting.svg)](https://www.npmjs.com/package/pentesting)
15
- [![Docker](https://img.shields.io/badge/Docker-pentesting--tools-blue)](https://hub.docker.com/r/agnusdei1207/pentesting-tools)
7
+ <p align="center">
8
+ <strong>인간처럼 생각하고 실행하는 자율 침투 테스트 AI 에이전트</strong>
9
+ </p>
16
10
 
17
- </div>
11
+ <p align="center">
12
+ <a href="https://www.npmjs.com/package/pentesting"><img src="https://img.shields.io/npm/v/pentesting.svg?style=for-the-badge" alt="npm version"></a>
13
+ <a href="https://github.com/agnusdei1207/pentesting/actions"><img src="https://img.shields.io/github/actions/workflow/status/agnusdei1207/pentesting/ci.yml?branch=main&style=for-the-badge" alt="CI status"></a>
14
+ <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-blue.svg?style=for-the-badge" alt="MIT License"></a>
15
+ </p>
18
16
 
19
17
  ---
20
18
 
21
- ## 🚀 Quick Start
22
-
23
- ```bash
24
- # Install
25
- npm install -g pentesting
26
-
27
- # Configure
28
- export PENTEST_API_KEY=your_api_key
29
- export PENTEST_BASE_URL=https://your-api-endpoint.com/v1
30
- export PENTEST_MODEL=your-model-name
31
-
32
- # Run
33
- pentesting
34
- ```
19
+ ## 💡 철학: 왜 Pentesting인가?
35
20
 
36
- ---
21
+ ### 문제
37
22
 
38
- ## 🧠 Philosophy: Think Like a Hacker
23
+ 기존 침투 테스트는 **도구 중심**입니다:
24
+ - nmap으로 스캔하고, 결과를 보고
25
+ - sqlmap으로 테스트하고, 다른 도구로 넘어가고
26
+ - 각 도구의 출력을 해석하고, 다음 단계를 결정하고
39
27
 
40
- **Pentesting is not a brute-force tool.** It's an intelligent agent that thinks strategically.
28
+ 이것은 **반복적이고, 시간 소모적이며, 전문가 지식이 필요**합니다.
41
29
 
42
- ### Strategic Decision Framework
30
+ ### 해결책
43
31
 
44
- Every action is evaluated using:
32
+ Pentesting은 **사고 중심**입니다:
33
+ - "이 웹 애플리케이션을 침투하라"
34
+ - 에이전트가 스스로 도구를 선택하고, 결과를 분석하고, 다음 전략을 결정합니다
45
35
 
46
36
  ```
47
- Value = (Probability × CVSS Impact) / Time Cost
48
- ```
37
+ Before (도구 중심):
38
+ Human → [결정] → nmap → [분석] → [결정] → sqlmap → [분석] → ...
49
39
 
50
- The agent only executes actions with **confidence >50%**. Below that, it finds a better approach.
51
-
52
- ### Self-Reflection Before Every Action
40
+ After (사고 중심):
41
+ Human → "침투하라" → Pentesting Agent → [자동화된 사고-행동 루프] → 보고서
42
+ ```
53
43
 
54
- Before running any tool, the agent asks:
55
- - "What exactly am I trying to learn?"
56
- - "Is this the FASTEST way to get that information?"
57
- - "Have I already tried this? What happened?"
58
- - "Is there a simpler approach?"
44
+ ### 핵심 신념
59
45
 
60
- ### Mandatory Fallback Strategy
46
+ 1. **AI는 도구가 아니라 동료입니다**
47
+ - 명령을 실행하는 것이 아니라 목표를 달성합니다
48
+ - 실패하면 스스로 다른 방법을 찾습니다
61
49
 
62
- When a tool fails, the agent immediately tries alternatives:
50
+ 2. **신뢰할 수 있는 결과만 보고합니다**
51
+ - 80% 이상 신뢰도의 발견만 보고
52
+ - 거짓 양성을 적극적으로 필터링
63
53
 
64
- | Task | Primary | Fallback 1 | Fallback 2 |
65
- |------|---------|------------|------------|
66
- | Subdomain | subfinder | ffuf | amass |
67
- | Directory | gobuster | ffuf | dirsearch |
68
- | Port Scan | rustscan | nmap | masscan |
54
+ 3. **인간 전문가의 사고 과정을 모방합니다**
55
+ - "Think → Act → Observe → Reflect" 루프
56
+ - 막다른 길에서 시간여행으로 복구 (D-Mail)
69
57
 
70
58
  ---
71
59
 
72
- ## 🔥 Why Pentesting?
60
+ ## 🧠 ReAct: 생각하고 행동하기
73
61
 
74
- | Feature | Traditional Tools | Pentesting Agent |
75
- |---------|-------------------|------------------|
76
- | Decision Making | Manual | AI-driven with confidence scoring |
77
- | Tool Selection | You choose | Auto-selects based on context |
78
- | Failure Handling | You retry | Auto-fallback to alternatives |
79
- | Attack Planning | Manual prioritization | CVSS-based priority matrix |
80
- | Context Awareness | None | Remembers all findings |
81
- | Reporting | Manual | Auto-generated findings |
62
+ Pentesting은 [ReAct 패턴](https://arxiv.org/abs/2210.03629)을 핵심으로 합니다:
82
63
 
83
- ---
84
-
85
- ## ✨ Core Capabilities
86
-
87
- - **10-Phase Attack Workflow**: Recon → Scan → Enum → Vuln Analysis → Exploitation → PrivEsc → Pivot → Persist → Exfil → Report
88
- - **Auto Docker Management**: Pulls and starts tool container automatically
89
- - **Multi-Target Attack**: Attack multiple targets sequentially
90
- - **Real-time Feedback**: See thinking process, tool calls, results live
91
- - **Session Persistence**: Save/resume attack sessions
92
- - **Context Compaction**: Automatic history summarization
64
+ ```
65
+ ┌─────────────────────────────────────────────────────────────────┐
66
+ │ │
67
+ │ 🤔 THINK │
68
+ │ "타겟이 Apache 2.4.49를 실행 중이다. │
69
+ │ Path Traversal 취약점(CVE-2021-41773)이 있을 수 있다." │
70
+ │ │
71
+ │ ⚡ ACT │
72
+ │ [nmap_scan] target=192.168.1.1 ports=80,443 │
73
+ │ │
74
+ │ 👁️ OBSERVE │
75
+ │ "포트 80에서 Apache/2.4.49 확인. │
76
+ │ mod_cgi 활성화됨." │
77
+ │ │
78
+ │ 💭 REFLECT │
79
+ │ "CVE-2021-41773 가능성 높음. 익스플로잇 시도해야 함. │
80
+ │ 신뢰도: 85%. 다음: exploit-researcher에게 위임." │
81
+ │ │
82
+ └─────────────────────────────────────────────────────────────────┘
83
+ ```
93
84
 
94
85
  ---
95
86
 
96
- ## 📖 CLI Commands
87
+ ## 🚀 빠른 시작
97
88
 
98
- ### Target Management
99
- ```bash
100
- /target <domain|ip> Set primary target
101
- /target add <t> Add target to list
102
- /target list Show all targets (★ = primary)
103
- /target rm <t> Remove target from list
104
- /target set <t> Set as primary target
105
- /target clear Remove ALL targets
106
- ```
89
+ ### 설치
107
90
 
108
- ### Attack Execution
109
91
  ```bash
110
- /start [objective] Start pentest on primary target
111
- /start all Attack ALL registered targets sequentially
112
- /stop Stop current operation
113
- /status Show status report
92
+ npm install -g pentesting
93
+ # 또는
94
+ npx pentesting
114
95
  ```
115
96
 
116
- ### Session Management
117
- ```bash
118
- /checkpoint [desc] Create checkpoint with optional description
119
- /checkpoints List all checkpoints
120
- /undo Undo to last checkpoint
121
- /revert <id> Revert to specific checkpoint
122
- /compact Compact context (keep last 3 messages)
123
- /sessions List saved sessions
124
- /resume [id] Resume a session
125
- /replay Show session recordings
126
- ```
97
+ ### API 키 설정
127
98
 
128
- ### Skills & Extras
129
99
  ```bash
130
- /skills List available skills
131
- /update Check for updates
132
- /update now Install update
100
+ export ANTHROPIC_API_KEY=sk-ant-xxx
133
101
  ```
134
102
 
135
- ### Findings & Reports
103
+ ### 실행
104
+
136
105
  ```bash
137
- /findings Show discovered findings
138
- /report Generate pentest report
106
+ pentesting
139
107
  ```
140
108
 
141
- ### Utility
142
- ```bash
143
- /paste Paste from clipboard (text or image)
144
- /yolo Toggle auto-approve mode
145
- /clear Clear screen
146
- /exit Exit
147
- /y /n /ya Approve/Deny/Always approve (for pending tools)
109
+ ### 첫 번째 공격
110
+
111
+ ```
112
+ 🎯 Pentesting > scan 192.168.1.1
148
113
  ```
149
114
 
150
- ---
115
+ 에이전트가 자동으로:
116
+ 1. 포트 스캔 수행
117
+ 2. 서비스 버전 확인
118
+ 3. 취약점 검색
119
+ 4. 익스플로잇 시도
120
+ 5. 결과 보고
151
121
 
152
- ## Multi-Target Workflow
122
+ ---
153
123
 
154
- ```bash
155
- # Start pentesting CLI
156
- pentesting
124
+ ## 🏗️ 아키텍처
157
125
 
158
- # Register multiple targets
159
- /target add example1.com
160
- /target add example2.com
161
- /target add 192.168.1.1
162
- /target add internal.corp
126
+ ```
127
+ ┌─────────────────────────────────────────────────────────────────────┐
128
+ │ PENTESTING SOUL │
129
+ │ │
130
+ │ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐ │
131
+ │ │ ReAct Loop │ │ D-Mail │ │ Planner │ │
132
+ │ │ │ │ System │ │ │ │
133
+ │ │ Think/Act/ │ │ Time Travel │ │ Attack Plan │ │
134
+ │ │ Observe/ │ │ Checkpoint │ │ Generation │ │
135
+ │ │ Reflect │ │ Rollback │ │ │ │
136
+ │ └───────┬───────┘ └───────┬───────┘ └───────┬───────┘ │
137
+ │ │ │ │ │
138
+ │ └──────────────────┼──────────────────┘ │
139
+ │ │ │
140
+ │ ┌──────────────────────────▼──────────────────────────────────┐ │
141
+ │ │ RUNTIME │ │
142
+ │ │ Context │ Toolset │ Memory │ Approval │ │
143
+ │ └──────────────────────────────────────────────────────────────┘ │
144
+ └──────────────────────────────┬──────────────────────────────────────┘
145
+ │
146
+ ▼
147
+ ┌─────────────────────────────────────────────────────────────────────┐
148
+ │ LABOR MARKET │
149
+ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │
150
+ │ │ Recon │ │ Exploit │ │ Web │ │
151
+ │ │ Agent │ │ Agent │ │ Agent │ │
152
+ │ └──────────────┘ └──────────────┘ └──────────────┘ │
153
+ └─────────────────────────────────────────────────────────────────────┘
154
+ ```
163
155
 
164
- # View registered targets
165
- /target list
166
- Targets (4):
167
- 1. * example1.com (primary)
168
- 2. example2.com
169
- 3. 192.168.1.1
170
- 4. internal.corp
156
+ ### 핵심 컴포넌트
171
157
 
172
- # Attack all targets sequentially
173
- /start all
158
+ | 컴포넌트 | 역할 |
159
+ |---------|------|
160
+ | **PentestingSoul** | 메인 에이전트 루프, 모든 것을 조율 |
161
+ | **ReActLoop** | Think/Act/Observe/Reflect 패턴 구현 |
162
+ | **DMailSystem** | 시간여행 디버깅, 체크포인트 롤백 |
163
+ | **Planner** | 공격 계획 생성 및 관리 |
164
+ | **LaborMarket** | 전문 서브에이전트 할당 |
165
+ | **ContextManager** | 대화 히스토리 압축 |
166
+ | **ConfidenceFilter** | 80%+ 신뢰도 필터링 |
174
167
 
175
- Starting multi-target attack on 4 targets
168
+ ---
176
169
 
177
- --- [1/4] example1.com ---
178
- Session: session-1707325423
179
- ... reconnaissance & exploitation ...
170
+ ## ⏱️ D-Mail: 시간여행 디버깅
180
171
 
181
- --- [2/4] example2.com ---
182
- ...
172
+ 막다른 길에 도달했을 때, 에이전트는 과거로 메시지를 보내 다른 경로를 시도합니다:
183
173
 
184
- # Press ESC to stop between targets
185
- Stopped at target 2/4
174
+ ```
175
+ 현재: SQLi 시도 5회 모두 실패
176
+ ↓
177
+ D-Mail 전송: "SQLi 실패함. XSS 시도할 것"
178
+ ↓
179
+ 체크포인트로 롤백
180
+ ↓
181
+ 새로운 전략으로 재시도
182
+ ```
186
183
 
187
- Complete
184
+ ```typescript
185
+ // 에이전트 내부 동작
186
+ if (isStuck) {
187
+ dmailSystem.sendDMail(
188
+ 'SQLi approach failed. Try XSS instead.',
189
+ lastCheckpoint,
190
+ 'Stuck after 5 SQLi attempts'
191
+ );
192
+ throw new BackToTheFuture('Time travel initiated', lastCheckpoint);
193
+ }
188
194
  ```
189
195
 
190
196
  ---
191
197
 
192
- ## 🤖 AI Agents
193
-
194
- Pentesting automatically switches between specialized AI agents based on the current attack phase:
195
-
196
- | Phase | Agent | What it does |
197
- |-------|-------|--------------|
198
- | Reconnaissance | **Recon Agent** | Discovers hosts, ports, services, subdomains |
199
- | Web Scanning | **Web Agent** | Tests for OWASP Top 10, SQLi, XSS, SSRF |
200
- | Exploitation | **Exploit Agent** | Researches CVEs, selects and runs exploits |
201
- | Privilege Escalation | **PrivEsc Agent** | Finds SUID, sudo misconfigs, kernel exploits |
202
- | Data Extraction | **Crypto Agent** | Cracks hashes, analyzes encryption |
198
+ ## 👥 멀티 에이전트 시스템
203
199
 
204
- ### How it works
200
+ ### 전문 에이전트
205
201
 
206
- 1. **You set a target** → Agent starts in Recon mode
207
- 2. **Finds web services** → Automatically switches to Web Agent
208
- 3. **Discovers vulnerability** → Switches to Exploit Agent
209
- 4. **Gets shell access** → Switches to PrivEsc Agent
210
- 5. **Finds password hashes** → Crypto Agent takes over
202
+ | 에이전트 | 전문 분야 | 도구 |
203
+ |---------|-----------|------|
204
+ | **target-explorer** | 정찰, 정보 수집 | nmap, whois, dig |
205
+ | **exploit-researcher** | 취약점 연구 | searchsploit, cve-search |
206
+ | **web-hacker** | 웹 애플리케이션 | sqlmap, nuclei |
207
+ | **crypto-analyst** | 암호 분석 | hashcat, john |
211
208
 
212
- > No manual agent switching needed. The system automatically picks the best agent for each situation.
209
+ ### 에이전트 위임
213
210
 
214
- ---
211
+ ```
212
+ Main Agent: "웹 서버에서 SQLi 가능성 발견"
213
+ ↓
214
+ └──→ [web-hacker] "로그인 폼에서 SQLi 테스트"
215
+ ↓
216
+ └──→ 결과 반환: "SQLi 확인, 데이터베이스 덤프 가능"
217
+ ```
215
218
 
216
- ## ⚙️ Configuration
219
+ ### 병렬 Swarm 실행
217
220
 
218
- ### Environment Variables
221
+ ```typescript
222
+ const swarm = new AgentSwarm(runtime);
219
223
 
220
- | Variable | Description | Default |
221
- |----------|-------------|---------|
222
- | `PENTEST_API_KEY` | LLM API key | Required |
223
- | `PENTEST_BASE_URL` | API endpoint URL | - |
224
- | `PENTEST_MODEL` | Model name | claude-sonnet-4-20250514 |
225
- | `PENTEST_MAX_TOKENS` | Max response tokens | 16384 |
226
- | `PENTESTING_DOCKER` | Force Docker execution | 0 |
227
- | `PENTESTING_CONTAINER` | Docker container name | pentesting-tools |
224
+ const results = await swarm.executeParallel([
225
+ { agentName: 'web-hacker', task: 'Test SQLi on login' },
226
+ { agentName: 'web-hacker', task: 'Test XSS on search' },
227
+ { agentName: 'target-explorer', task: 'Find hidden endpoints' },
228
+ ]);
229
+ ```
228
230
 
229
- > **Note**: `ANTHROPIC_API_KEY` is also accepted as fallback for `PENTEST_API_KEY`.
231
+ ---
230
232
 
233
+ ## 🔒 신뢰도 기반 필터링
231
234
 
232
- ---
235
+ **80% 이상 신뢰도만 보고합니다.**
233
236
 
234
- ## 💻 For Developers
237
+ ```
238
+ 신뢰도 계산:
239
+ 기본값: 50%
240
+ + 증거 수 × 10% (최대 30%)
241
+ + 익스플로잇 가능: +15%
242
+ + 심각도 높음: +5-10%
243
+ + CVE 참조: +10%
244
+ = 최종 신뢰도
245
+ ```
235
246
 
236
- Pentesting can be used as a library in your own projects. See [Architecture Docs](./docs/architecture.md) for:
237
- - API Reference
238
- - Event System
239
- - Custom Agent Integration
247
+ ```typescript
248
+ const finding = createFinding({
249
+ title: 'SQL Injection in login',
250
+ description: 'Time-based blind SQLi',
251
+ severity: 'critical',
252
+ evidence: ['sqlmap output', 'response time analysis', 'CVE-2021-xxxx'],
253
+ exploitable: true,
254
+ });
255
+
256
+ // 신뢰도: 50 + 30 + 15 + 10 + 10 = 115% → 100%
257
+ // → 보고됨 ✅
258
+ ```
240
259
 
241
260
  ---
242
261
 
243
- ## 🐳 Docker Toolkit (Auto-Managed)
262
+ ## 📋 명령어
244
263
 
245
- Pentesting automatically manages a Docker container with 50+ pre-installed tools.
264
+ | 명령어 | 설명 |
265
+ |--------|------|
266
+ | `scan <target>` | 타겟 스캔 및 정찰 |
267
+ | `exploit <target>` | 취약점 익스플로잇 |
268
+ | `report` | 발견 사항 보고서 생성 |
269
+ | `status` | 현재 진행 상황 |
270
+ | `plan` | 공격 계획 조회 |
271
+ | `agents` | 사용 가능한 에이전트 목록 |
246
272
 
247
- ### Automatic Setup
273
+ ---
248
274
 
249
- **No manual Docker setup required!** When you run a command that needs tools like `nmap` or `rustscan`:
275
+ ## ⚙️ 설정
276
+
277
+ ```typescript
278
+ // pentesting.config.ts
279
+ export default {
280
+ // LLM 설정
281
+ model: 'claude-opus-4-0',
282
+ maxTokens: 8096,
283
+
284
+ // 에이전트 설정
285
+ maxStepsPerTurn: 50,
286
+ confidenceThreshold: 80,
287
+
288
+ // 컨텍스트 설정
289
+ maxContextTokens: 150000,
290
+ compactionThreshold: 0.8,
291
+
292
+ // 승인 설정
293
+ yoloMode: false, // true면 모든 도구 자동 승인
294
+ };
295
+ ```
250
296
 
251
- 1. Pentesting checks if tool exists locally
252
- 2. If not, it automatically pulls `agnusdei1207/pentesting-tools:latest`
253
- 3. Starts container `pentesting-tools` with host network
254
- 4. Executes command via `docker exec`
297
+ ---
255
298
 
256
- ### Manual Docker Control
299
+ ## 🧪 테스트
257
300
 
258
301
  ```bash
259
- # Force all commands through Docker
260
- export PENTESTING_DOCKER=1
261
-
262
- # Use custom container name
263
- export PENTESTING_CONTAINER=my-pentest-container
302
+ npm test
303
+ ```
264
304
 
265
- # Manual pull (optional - auto-pulled on first use)
266
- docker pull agnusdei1207/pentesting-tools:latest
305
+ ```
306
+ ✓ tests/soul.test.ts (24 tests) 10ms
307
+ ✓ Context
308
+ ✓ AgentRegistry
309
+ ✓ ConfidenceFilter
310
+ ✓ ReActLoop
311
+ ✓ DMailSystem
312
+ ✓ MessageBus
313
+ ✓ MemoryManager
314
+ ✓ Integration Tests
267
315
  ```
268
316
 
269
- ### Included Tools (50+)
317
+ ---
270
318
 
271
- | Category | Tools |
272
- |----------|-------|
273
- | **Network** | nmap, rustscan, masscan, netcat, tcpdump |
274
- | **Web** | ffuf, nikto, sqlmap, httpx, whatweb |
275
- | **Discovery** | subfinder, amass, nuclei, dnsrecon |
276
- | **Bruteforce** | hydra, hashcat, john |
277
- | **AD/Windows** | impacket, crackmapexec, smbclient |
278
- | **Database** | mysql-client, postgresql-client, redis-tools |
279
- | **Utilities** | curl, wget, jq, python3, go |
319
+ ## 📁 프로젝트 구조
320
+
321
+ ```
322
+ src/
323
+ ├── soul/ # 핵심 에이전트 시스템
324
+ │ ├── pentesting-soul.ts # 메인 에이전트 루프
325
+ │ ├── react.ts # ReAct 패턴
326
+ │ ├── dmail.ts # 시간여행 시스템
327
+ │ ├── planner.ts # 계획 시스템
328
+ │ ├── swarm.ts # 병렬 에이전트
329
+ │ ├── confidence.ts # 신뢰도 필터링
330
+ │ └── ...
331
+ ├── tools/ # 도구 정의
332
+ ├── agents/ # 에이전트 스펙
333
+ ├── experience/ # 학습 시스템
334
+ └── prompts/ # 프롬프트 템플릿
335
+ ```
280
336
 
281
337
  ---
282
338
 
283
- ## 🔌 MCP Integration
339
+ ## 📖 문서
284
340
 
285
- Pentesting supports MCP (Model Context Protocol) for extending capabilities with additional tools and servers. See [Architecture Docs](./docs/architecture.md) for integration details.
341
+ - [시스템 아키텍처](docs/architecture.md) - 상세 기술 문서
342
+ - [OpenClaw 분석](docs/OPENCLAW_ANALYSIS.md) - 개선 계획
343
+ - [API 레퍼런스](docs/api-reference.md) - API 문서
344
+ - [구현 진행 상황](docs/IMPLEMENTATION_PROGRESS.md) - 개발 상태
286
345
 
287
346
  ---
288
347
 
289
- ## 🏗️ How It Works
348
+ ## 🛣️ 로드맵
290
349
 
291
- ```
292
- ┌──────────────────────────────────────────────┐
293
- │ Your Terminal │
294
- │ ┌────────────────────────────────────────┐ │
295
- │ │ pentesting CLI (Interactive TUI) │ │
296
- │ │ - Target management │ │
297
- │ │ - Session recording │ │
298
- │ │ - Real-time output │ │
299
- │ └────────────────────────────────────────┘ │
300
- └─────────────────────┬────────────────────────┘
301
- ▼
302
- ┌──────────────────────────────────────────────┐
303
- │ AI Agent Core │
304
- │ ┌────────────────────────────────────────┐ │
305
- │ │ 5 Specialized Agents (auto-switching) │ │
306
- │ │ Recon → Web → Exploit → PrivEsc → Crypto│
307
- │ └────────────────────────────────────────┘ │
308
- └─────────────────────┬────────────────────────┘
309
- ▼
310
- ┌──────────────────────────────────────────────┐
311
- │ Tool Execution │
312
- │ ┌──────────┐ ┌──────────┐ ┌──────────┐ │
313
- │ │ Docker │ │ Local │ │ MCP │ │
314
- │ │ (50+ │ │ Tools │ │ Servers │ │
315
- │ │ tools) │ │ │ │ │ │
316
- │ └──────────┘ └──────────┘ └──────────┘ │
317
- └──────────────────────────────────────────────┘
318
- ```
350
+ ### v1.0 (현재) ✅
351
+ - [x] ReAct 패턴 구현
352
+ - [x] D-Mail 시간여행
353
+ - [x] 멀티 에이전트 시스템
354
+ - [x] 신뢰도 필터링
355
+ - [x] 컨텍스트 압축
319
356
 
320
- ---
357
+ ### v1.1 (다음)
358
+ - [ ] 영구 벡터 메모리
359
+ - [ ] 세션 영속성
360
+ - [ ] 강화된 훅 시스템
321
361
 
322
- ## 🛠️ Development
362
+ ### v1.2 (계획)
363
+ - [ ] Docker 샌드박스
364
+ - [ ] 스킬 마켓플레이스
365
+ - [ ] 인증 프로필 관리
323
366
 
324
- ```bash
325
- # Clone
326
- git clone https://github.com/agnusdei1207/pentesting.git
327
- cd pentesting
367
+ ---
328
368
 
329
- # Install
330
- npm install
369
+ ## 🤝 기여
331
370
 
332
- # Build
333
- npm run build
371
+ 기여를 환영합니다! [CONTRIBUTING.md](CONTRIBUTING.md)를 참고하세요.
334
372
 
335
- # Dev mode
336
- npm run dev
337
- ```
373
+ ---
338
374
 
339
- ## Documentation
375
+ ## 📜 라이선스
340
376
 
341
- - [Architecture](./docs/ARCHITECTURE.md) - System design and components
342
- - [Docker Image](https://hub.docker.com/r/agnusdei1207/pentesting-tools) - Pre-built security tools
377
+ MIT License - [LICENSE](LICENSE)
343
378
 
344
379
  ---
345
380
 
346
- ## 📄 License
381
+ ## ⚠️ 면책 조항
382
+
383
+ 이 도구는 **합법적인 보안 테스트 목적**으로만 사용해야 합니다.
384
+ 허가 없이 시스템을 테스트하는 것은 불법입니다.
385
+ 사용자는 모든 행동에 대한 책임을 집니다.
386
+
387
+ ---
347
388
 
348
- MIT
389
+ <p align="center">
390
+ <sub>Built with 🧠 by <a href="https://github.com/agnusdei1207">agnusdei1207</a></sub>
391
+ </p>
package/dist/{auto-update-CNT5P47B.js → auto-update-FWXZGK5Z.js} RENAMED
@@ -8,8 +8,8 @@ import {
8
8
  readVersionCache,
9
9
  semverTuple,
10
10
  writeVersionCache
11
- } from "./chunk-WWJXXJRC.js";
12
- import "./chunk-2DVCF464.js";
11
+ } from "./chunk-AIBIXGJI.js";
12
+ import "./chunk-5QWIIPHH.js";
13
13
  import "./chunk-3RG5ZIWI.js";
14
14
  export {
15
15
  checkForUpdate,
package/dist/{chunk-2DVCF464.js → chunk-5QWIIPHH.js} RENAMED
@@ -186,7 +186,7 @@ var SENSITIVE_TOOLS = [
186
186
 
187
187
  // src/config/constants.ts
188
188
  import { createRequire } from "module";
189
- var pkgVersion = "0.7.47";
189
+ var pkgVersion = "0.7.48";
190
190
  try {
191
191
  const require2 = createRequire(import.meta.url);
192
192
  const pkg = require2("../../package.json");
package/dist/{chunk-WWJXXJRC.js → chunk-AIBIXGJI.js} RENAMED
@@ -1,7 +1,7 @@
1
1
  import {
2
2
  APP_NAME,
3
3
  APP_VERSION
4
- } from "./chunk-2DVCF464.js";
4
+ } from "./chunk-5QWIIPHH.js";
5
5
 
6
6
  // src/core/update/auto-update.ts
7
7
  import { execSync } from "child_process";
package/dist/index.js CHANGED
@@ -15,7 +15,7 @@ import {
15
15
  PHASE_STATUS,
16
16
  THOUGHT_TYPE,
17
17
  TOOL_NAME
18
- } from "./chunk-2DVCF464.js";
18
+ } from "./chunk-5QWIIPHH.js";
19
19
  import {
20
20
  __require
21
21
  } from "./chunk-3RG5ZIWI.js";
@@ -6983,7 +6983,7 @@ var App = ({ autoApprove = false, target }) => {
6983
6983
  setCheckpointCount(contextManagerRef.current?.getCheckpoints().length || 0);
6984
6984
  }
6985
6985
  });
6986
- import("./auto-update-CNT5P47B.js").then(({ checkForUpdateAsync, formatUpdateNotification }) => {
6986
+ import("./auto-update-FWXZGK5Z.js").then(({ checkForUpdateAsync, formatUpdateNotification }) => {
6987
6987
  checkForUpdateAsync().then((result) => {
6988
6988
  if (result.hasUpdate) {
6989
6989
  const notification = formatUpdateNotification(result);
@@ -7686,7 +7686,7 @@ ${list}`);
7686
7686
  return;
7687
7687
  case "update":
7688
7688
  try {
7689
- const { checkForUpdate, formatUpdateNotification, doUpdate } = await import("./update-HVVSEVIW.js");
7689
+ const { checkForUpdate, formatUpdateNotification, doUpdate } = await import("./update-OD3N757W.js");
7690
7690
  const result = checkForUpdate(true);
7691
7691
  if (result.hasUpdate) {
7692
7692
  const notification = formatUpdateNotification(result);
package/dist/{update-HVVSEVIW.js → update-OD3N757W.js} RENAMED
@@ -8,8 +8,8 @@ import {
8
8
  readVersionCache,
9
9
  semverTuple,
10
10
  writeVersionCache
11
- } from "./chunk-WWJXXJRC.js";
12
- import "./chunk-2DVCF464.js";
11
+ } from "./chunk-AIBIXGJI.js";
12
+ import "./chunk-5QWIIPHH.js";
13
13
  import "./chunk-3RG5ZIWI.js";
14
14
  export {
15
15
  checkForUpdate,
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "pentesting",
3
- "version": "0.7.48",
3
+ "version": "0.8.0",
4
4
  "description": "Autonomous Penetration Testing AI Agent",
5
5
  "type": "module",
6
6
  "main": "dist/index.js",
@@ -18,6 +18,8 @@
18
18
  "dev": "tsx src/index.tsx",
19
19
  "build": "tsup src/index.tsx --format esm --dts --clean",
20
20
  "start": "node dist/index.js",
21
+ "test": "vitest run",
22
+ "test:watch": "vitest",
21
23
  "lint": "tsc --noEmit",
22
24
  "prepublishOnly": "npm run build",
23
25
  "release:patch": "npm version patch && npm run build && npm publish",
@@ -78,6 +80,7 @@
78
80
  "@types/react": "^18.3.18",
79
81
  "tsup": "^8.3.6",
80
82
  "tsx": "^4.19.2",
81
- "typescript": "^5.7.3"
83
+ "typescript": "^5.7.3",
84
+ "vitest": "^4.0.18"
82
85
  }
83
86
  }