pentesting 0.8.44 → 0.12.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/README.md +42 -139
  2. package/dist/{auto-update-RJK3Y5UW.js → auto-update-GKO64QMO.js} +2 -2
  3. package/dist/{chunk-UCB4BWTB.js → chunk-JXR7HH4V.js} +45 -2
  4. package/dist/{chunk-TTQCHK5V.js → chunk-M5JWJSPW.js} +1 -1
  5. package/dist/index.js +11736 -5333
  6. package/dist/mcp/mcp-server.d.ts +2 -0
  7. package/dist/mcp/mcp-server.js +0 -0
  8. package/dist/{update-LQDOCICM.js → update-UMRID565.js} +2 -2
  9. package/package.json +13 -7
package/README.md CHANGED
@@ -1,185 +1,88 @@
1
1
  <div align="center">
2
2
 
3
3
  ```
4
- ██████╗ ███████╗███╗ ██╗████████╗███████╗███████╗████████╗██╗███╗ ██╗ ██████╗
5
- ██╔══██╗██╔════╝████╗ ██║╚══██╔══╝██╔════╝██╔════╝╚══██╔══╝██║████╗ ██║██╔════╝
6
- ██████╔╝█████╗ ██╔██╗ ██║ ██║ █████╗ ███████╗ ██║ ██║██╔██╗ ██║██║ ███╗
7
- ██╔═══╝ ██╔══╝ ██║╚██╗██║ ██║ ██╔══╝ ╚════██║ ██║ ██║██║╚██╗██║██║ ██║
8
- ██║ ███████╗██║ ╚████║ ██║ ███████╗███████║ ██║ ██║██║ ╚████║╚██████╔╝
9
- ╚═╝ ╚══════╝╚═╝ ╚═══╝ ╚═╝ ╚══════╝╚══════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═════╝
4
+ ██████╗ ███████╗███╗ ██╗████████╗███████╗███████╗████████╗██╗███╗ ██╗ ██████╗
5
+ ██╔══██╗██╔════╝████╗ ██║╚══██╔══╝██╔════╝██╔════╝╚══██╔══╝██║████╗ ██║██╔════╝
6
+ ██████╔╝█████╗ ██╔██╗ ██║ ██║ █████╗ ███████╗ ██║ ██║██╔██╗ ██║██║ ███╗
7
+ ██╔═══╝ ██╔══╝ ██║╚██╗██║ ██║ ██╔══╝ ╚════██║ ██║ ██║██║╚██╗██║██║ ██║
8
+ ██║ ███████╗██║ ╚████║ ██║ ███████╗███████║ ██║ ██║██║ ╚████║╚██████╔╝
9
+ ╚═╝ ╚══════╝╚═╝ ╚═══╝ ╚═╝ ╚══════╝╚══════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═════╝
10
+ ────────────────────────────────────────────────────────────────────────────────
11
+ A U T O N O M O U S S E C U R I T Y A G E N T
10
12
  ```
11
13
 
12
- **Autonomous AI Penetration Testing Agent**
14
+ **v0.12.0 | Multi-Agent System | 50+ Security Tools**
13
15
 
14
- [![npm version](https://badge.fury.io/js/pentesting.svg)](https://www.npmjs.com/package/pentesting)
15
- [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
16
+ [![npm](https://img.shields.io/badge/npm-pentesting-red)](https://www.npmjs.org/package/pentesting)
17
+ [![Docker](https://img.shields.io/badge/docker-agnusdei1207%2Fpentesting-red)](https://hub.docker.com/r/agnusdei1207/pentesting)
18
+ [![License: MIT](https://img.shields.io/badge/License-MIT-red.svg)](https://opensource.org/licenses/MIT)
16
19
 
17
20
  </div>
18
21
 
19
22
  ---
20
23
 
21
- ## Philosophy
22
-
23
- > **Think → Plan → Collaborate → Execute → Reflect → Adapt**
24
-
25
- Pentesting is not just a tool execution agent. It aims for **AGI-level autonomous thinking**:
26
-
27
- - 🧠 **Autonomous Decision** - Decide and act without asking the user
28
- - 🎯 **BFS First** - Breadth over depth, map the attack surface first
29
- - 🤝 **Agent Collaboration** - 9 specialist agents share knowledge and collaborate
30
- - 🔄 **Continuous Reflection** - Learn from failures and adjust strategy
31
- - 💾 **Shared Memory** - All agents share discoveries
32
-
33
- ---
34
-
35
24
  ## Quick Start
36
25
 
37
26
  ```bash
38
- # Docker required for security tools
39
27
  npm install -g pentesting
40
28
 
41
- # Set API key
42
29
  export PENTEST_API_KEY="your_api_key"
43
30
 
44
- # Optional: Custom API endpoint
45
- export PENTEST_BASE_URL="https://api.z.ai/api/anthropic"
46
- export PENTEST_MODEL="glm-4.7"
31
+ # Optional: Custom LLM endpoint
32
+ export PENTEST_BASE_URL="https://api.z.ai/api/anthropic"
33
+ export PENTEST_MODEL="glm-4-plus"
47
34
 
48
35
  pentesting
49
36
  ```
50
37
 
51
- ---
52
-
53
- ## Architecture
54
-
55
- ```
56
- ┌─────────────────────────────────────────────────────────────┐
57
- │ SUPERVISOR AGENT │
58
- │ (Task Planning & Coordination) │
59
- └─────────────────────────────────────────────────────────────┘
60
- │
61
- ▼
62
- ┌─────────────────────────────────────────────────────────────┐
63
- │ SHARED MEMORY │
64
- │ Short-Term │ Long-Term │ Episodic │ Attack Surface │
65
- └─────────────────────────────────────────────────────────────┘
66
- │
67
- ┌───────────────────┼───────────────────┐
68
- ▼ ▼ ▼
69
- ┌───────────────┐ ┌───────────────┐ ┌───────────────┐
70
- │target-explorer│ │exploit-research│ │ privesc-master │
71
- │ web-hacker │ │ crypto-solver │ │forensics-analyst│
72
- │reverse-engineer│ │attack-architect│ │finding-reviewer│
73
- └───────────────┘ └───────────────┘ └───────────────┘
38
+ **Docker:**
39
+ ```bash
40
+ docker run -it --rm -e PENTEST_API_KEY="your_key" agnusdei1207/pentesting:latest
74
41
  ```
75
42
 
76
- ### Core Components
77
-
78
- | Component | Role |
79
- |-----------|------|
80
- | **Supervisor Agent** | Task planning, agent selection, strategy adjustment |
81
- | **Shared Memory** | Cross-agent context sharing, failure recording |
82
- | **9 Specialists** | Domain expert agents |
83
- | **Orchestrator** | Parallel execution, result consolidation |
84
-
85
43
  ---
86
44
 
87
- ## Features
88
-
89
- - **Multi-Agent Orchestration** - 9 specialist agents collaborate
90
- - **Shared Memory System** - Cross-agent knowledge sharing
91
- - **Strategic Planning** - BFS-based attack surface mapping
92
- - **Self-Reflection** - Auto strategy change when stuck
93
- - **Handoff Protocol** - Context transfer between agents
94
- - **80%+ Confidence Filter** - Report only high-confidence findings
95
- - **50+ Security Tools** - nmap, sqlmap, gobuster, hydra...
96
-
97
- ---
45
+ ## Core Features
98
46
 
99
- ## Environment Variables
100
-
101
- | Variable | Required | Default | Description |
102
- |----------|----------|---------|-------------|
103
- | `PENTEST_API_KEY` | ✅ | - | API key |
104
- | `PENTEST_BASE_URL` | | - | Custom API endpoint |
105
- | `PENTEST_MODEL` | | `claude-sonnet-4-20250514` | LLM model |
106
- | `PENTEST_MAX_TOKENS` | | `16384` | Max response tokens |
107
-
108
- ---
109
-
110
- ## Commands
111
-
112
- | Command | Description |
47
+ | Feature | Description |
113
48
  |---------|-------------|
114
- | `/target <ip>` | Set target |
115
- | `/start [objective]` | Start autonomous pentest |
116
- | `/agent <name>` | Switch to specialist agent |
117
- | `/plan` | Show current attack plan |
118
- | `/memory` | Show shared memory state |
119
- | `/findings` | Show findings |
120
- | `/status` | Status |
121
- | `/yolo` | Toggle auto-approve |
122
- | `/help` | Help |
49
+ | **Multi-Agent System** | 5 specialist agents (Recon, Web, Exploit, PrivEsc, Lateral) |
50
+ | **Autonomous Orchestration** | Strategic planning, self-diagnostics, quality gates |
51
+ | **50+ Security Tools** | nmap, sqlmap, ffuf, gobuster, hydra, metasploit... |
52
+ | **CTF Research** | Writeup search (0xdf, IppSec), scenario-based research |
53
+ | **Audit & Safety** | Tool execution logging, risk scoring, approval system |
123
54
 
124
55
  ---
125
56
 
126
- ## Specialized Agents
127
-
128
- | Agent | Specialty |
129
- |-------|-----------|
130
- | `target-explorer` | Recon, OSINT, Enumeration |
131
- | `exploit-researcher` | CVE, Exploit Development |
132
- | `privesc-master` | Linux/Windows Privilege Escalation |
133
- | `web-hacker` | Web Vulnerabilities, Injection |
134
- | `crypto-solver` | Hash Cracking, Cryptography |
135
- | `forensics-analyst` | Memory/File Analysis |
136
- | `reverse-engineer` | Binary Analysis, PWN |
137
- | `attack-architect` | Strategy, Attack Chains |
138
- | `finding-reviewer` | Validation, Confidence Scoring |
139
-
140
- ---
57
+ ## TUI Commands
141
58
 
142
- ## Programmatic Usage
143
-
144
- ```typescript
145
- import {
146
- getSupervisor,
147
- getAgentMemory,
148
- AutonomousHackingAgent
149
- } from 'pentesting';
150
-
151
- // High-level: Supervisor orchestration
152
- const supervisor = getSupervisor();
153
- const plan = await supervisor.createPlan('Get root access', '10.10.10.5');
154
- const findings = await supervisor.executePlan();
155
-
156
- // Direct agent usage
157
- const agent = new AutonomousHackingAgent();
158
- await agent.start('Enumerate web application', 'http://target.com');
59
+ ```
60
+ /target <ip> Set target
61
+ /start Start autonomous pentest
62
+ /research <box> Search writeups & exploits
63
+ /findings Show findings
64
+ /yolo Toggle auto-approve
65
+ /help Show all commands
159
66
  ```
160
67
 
161
68
  ---
162
69
 
163
- ## Documentation
70
+ ## Environment
164
71
 
165
- - [Architecture](docs/architecture.md) - System architecture details
166
- - [API Reference](docs/api-reference.md) - Programming interface
167
- - [Troubleshooting](docs/troubleshooting.md) - Problem solving
72
+ | Variable | Description |
73
+ |----------|-------------|
74
+ | `PENTEST_API_KEY` | API key (required) |
75
+ | `PENTEST_BASE_URL` | Custom API endpoint |
76
+ | `PENTEST_MODEL` | LLM model (default: claude-sonnet-4-20250514) |
168
77
 
169
78
  ---
170
79
 
171
- ## Design Principles
80
+ ## Documentation
172
81
 
173
- 1. **BFS Over DFS** - Map attack surface completely first
174
- 2. **Fail Fast, Pivot Quick** - Switch to alternative after 3 attempts
175
- 3. **Shared Context** - All agents share discoveries
176
- 4. **Confidence-Based** - Prioritize high-confidence findings
177
- 5. **AGI-like Autonomy** - Decide without asking
82
+ - **[ARCHITECTURE.md](docs/ARCHITECTURE.md)** - System architecture
178
83
 
179
84
  ---
180
85
 
181
86
  ## License
182
87
 
183
- MIT
184
-
185
- ⚠️ **For authorized security testing only.**
88
+ MIT | ⚠️ **For authorized security testing and CTF competitions only.**
package/dist/{auto-update-RJK3Y5UW.js → auto-update-GKO64QMO.js} RENAMED
@@ -8,8 +8,8 @@ import {
8
8
  readVersionCache,
9
9
  semverTuple,
10
10
  writeVersionCache
11
- } from "./chunk-TTQCHK5V.js";
12
- import "./chunk-UCB4BWTB.js";
11
+ } from "./chunk-M5JWJSPW.js";
12
+ import "./chunk-JXR7HH4V.js";
13
13
  import "./chunk-3RG5ZIWI.js";
14
14
  export {
15
15
  checkForUpdate,
package/dist/{chunk-UCB4BWTB.js → chunk-JXR7HH4V.js} RENAMED
@@ -111,11 +111,16 @@ var TOOL_NAME = {
111
111
  // Network - Basic Connectivity
112
112
  PING: "ping",
113
113
  TRACEROUTE: "traceroute",
114
+ MTR: "mtr",
114
115
  RUSTSCAN: "rustscan",
115
116
  NMAP_SCAN: "nmap_scan",
116
117
  MASSCAN: "masscan",
117
118
  TCPDUMP_CAPTURE: "tcpdump_capture",
119
+ TSHARK: "tshark",
120
+ NGREP: "ngrep",
121
+ ARP_SCAN: "arp_scan",
118
122
  NETCAT: "netcat",
123
+ SOCAT: "socat",
119
124
  // DNS & Subdomain
120
125
  DIG: "dig",
121
126
  HOST: "host",
@@ -124,6 +129,8 @@ var TOOL_NAME = {
124
129
  SUBFINDER: "subfinder",
125
130
  AMASS: "amass",
126
131
  DNSENUM: "dnsenum",
132
+ DNSRECON: "dnsrecon",
133
+ DNSMAP: "dnsmap",
127
134
  ZONE_TRANSFER: "zone_transfer",
128
135
  // Service Enumeration
129
136
  SNMP_WALK: "snmp_walk",
@@ -141,10 +148,15 @@ var TOOL_NAME = {
141
148
  NUCLEI: "nuclei",
142
149
  NIKTO: "nikto",
143
150
  FFUF: "ffuf",
151
+ GOBUSTER: "gobuster",
152
+ DIRB: "dirb",
144
153
  FEROXBUSTER: "feroxbuster",
145
154
  WAYBACKURLS: "waybackurls",
155
+ WAFW00F: "wafw00f",
156
+ GOWITNESS: "gowitness",
146
157
  // Windows/SMB/AD
147
158
  SMB_ENUM: "smb_enum",
159
+ SMBMAP: "smbmap",
148
160
  ENUM4LINUX: "enum4linux",
149
161
  CRACKMAPEXEC: "crackmapexec",
150
162
  SMBCLIENT: "smbclient",
@@ -172,16 +184,47 @@ var TOOL_NAME = {
172
184
  // Credential
173
185
  BRUTEFORCE_LOGIN: "bruteforce_login",
174
186
  CRACK_HASH: "crack_hash",
187
+ JOHN: "john",
188
+ HASHCAT: "hashcat",
189
+ HASHID: "hashid",
175
190
  DUMP_CREDENTIALS: "dump_credentials",
176
191
  HYDRA: "hydra",
192
+ MEDUSA: "medusa",
177
193
  // Privilege Escalation
178
194
  CHECK_SUDO: "check_sudo",
179
195
  FIND_SUID: "find_suid",
180
196
  RUN_PRIVESC_ENUM: "run_privesc_enum",
181
- // Post-Exploitation
197
+ // Post-Exploitation & Tunneling
198
+ SSH: "ssh",
199
+ SSH_KEYGEN: "ssh_keygen",
182
200
  SETUP_TUNNEL: "setup_tunnel",
201
+ CHISEL: "chisel",
202
+ PROXYCHAINS: "proxychains",
183
203
  LATERAL_MOVEMENT: "lateral_movement",
184
204
  REVERSE_SHELL: "reverse_shell",
205
+ // Listener & Payload Delivery
206
+ NC_LISTENER: "nc_listener",
207
+ PYTHON_HTTP_SERVER: "python_http_server",
208
+ MSFVENOM: "msfvenom",
209
+ RLWRAP: "rlwrap",
210
+ PWNCAT: "pwncat",
211
+ // Forensics
212
+ BINWALK: "binwalk",
213
+ FOREMOST: "foremost",
214
+ STEGHIDE: "steghide",
215
+ EXIFTOOL: "exiftool",
216
+ // Reversing
217
+ GDB: "gdb",
218
+ RADARE2: "radare2",
219
+ // Impacket Tools
220
+ IMPACKET_SECRETSDUMP: "impacket_secretsdump",
221
+ IMPACKET_PSEXEC: "impacket_psexec",
222
+ IMPACKET_WMIEXEC: "impacket_wmiexec",
223
+ IMPACKET_SMBEXEC: "impacket_smbexec",
224
+ IMPACKET_ATEXEC: "impacket_atexec",
225
+ IMPACKET_DCOMEXEC: "impacket_dcomexec",
226
+ IMPACKET_GETNPUSERS: "impacket_getnpusers",
227
+ IMPACKET_GETUSERSPNS: "impacket_getuserspns",
185
228
  // Reporting
186
229
  REPORT_FINDING: "report_finding",
187
230
  TAKE_SCREENSHOT: "take_screenshot"
@@ -198,7 +241,7 @@ var SENSITIVE_TOOLS = [
198
241
 
199
242
  // src/config/constants.ts
200
243
  import { createRequire } from "module";
201
- var pkgVersion = "0.8.0";
244
+ var pkgVersion = "0.12.0";
202
245
  try {
203
246
  const require2 = createRequire(import.meta.url);
204
247
  const pkg = require2("../../package.json");
package/dist/{chunk-TTQCHK5V.js → chunk-M5JWJSPW.js} RENAMED
@@ -1,7 +1,7 @@
1
1
  import {
2
2
  APP_NAME,
3
3
  APP_VERSION
4
- } from "./chunk-UCB4BWTB.js";
4
+ } from "./chunk-JXR7HH4V.js";
5
5
 
6
6
  // src/core/update/auto-update.ts
7
7
  import { execSync } from "child_process";