pentester 0.0.1__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pentester-0.0.1/.github/workflows/ci.yml +65 -0
- pentester-0.0.1/.gitignore +10 -0
- pentester-0.0.1/LICENSE +21 -0
- pentester-0.0.1/PKG-INFO +91 -0
- pentester-0.0.1/README.md +70 -0
- pentester-0.0.1/pentester/__init__.py +8 -0
- pentester-0.0.1/pentester/__main__.py +5 -0
- pentester-0.0.1/pentester/cli.py +54 -0
- pentester-0.0.1/pyproject.toml +37 -0
|
@@ -0,0 +1,65 @@
|
|
|
1
|
+
name: CI
|
|
2
|
+
|
|
3
|
+
# - On every push/PR: run the CLI smoke test, build, and validate metadata.
|
|
4
|
+
# - On a version tag (v*), a published Release, or manual dispatch: also
|
|
5
|
+
# publish to PyPI via Trusted Publishing (OIDC) — NO API token needed.
|
|
6
|
+
#
|
|
7
|
+
# PyPI trusted-publisher setup (one-time, on pypi.org -> Publishing):
|
|
8
|
+
# project = pentester, owner = vulnz, repo = pentester,
|
|
9
|
+
# workflow = ci.yml, environment = (leave blank / Any).
|
|
10
|
+
|
|
11
|
+
on:
|
|
12
|
+
push:
|
|
13
|
+
branches: [main]
|
|
14
|
+
tags: ["v*"]
|
|
15
|
+
pull_request:
|
|
16
|
+
release:
|
|
17
|
+
types: [published]
|
|
18
|
+
workflow_dispatch: {}
|
|
19
|
+
|
|
20
|
+
permissions:
|
|
21
|
+
contents: read
|
|
22
|
+
|
|
23
|
+
jobs:
|
|
24
|
+
test:
|
|
25
|
+
runs-on: ubuntu-latest
|
|
26
|
+
strategy:
|
|
27
|
+
fail-fast: false
|
|
28
|
+
matrix:
|
|
29
|
+
python-version: ["3.8", "3.10", "3.12"]
|
|
30
|
+
steps:
|
|
31
|
+
- uses: actions/checkout@v4
|
|
32
|
+
- uses: actions/setup-python@v5
|
|
33
|
+
with:
|
|
34
|
+
python-version: ${{ matrix.python-version }}
|
|
35
|
+
- name: Install package + tooling
|
|
36
|
+
run: |
|
|
37
|
+
python -m pip install --upgrade pip build twine
|
|
38
|
+
python -m pip install -e .
|
|
39
|
+
- name: Smoke-test the CLI
|
|
40
|
+
run: |
|
|
41
|
+
pentester --version
|
|
42
|
+
python -m pentester scan https://example.com
|
|
43
|
+
- name: Build sdist + wheel
|
|
44
|
+
run: python -m build
|
|
45
|
+
- name: Validate package metadata
|
|
46
|
+
run: python -m twine check dist/*
|
|
47
|
+
|
|
48
|
+
publish:
|
|
49
|
+
# Only publish on a version tag, a published release, or manual dispatch.
|
|
50
|
+
if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'release' || github.event_name == 'workflow_dispatch'
|
|
51
|
+
needs: test
|
|
52
|
+
runs-on: ubuntu-latest
|
|
53
|
+
permissions:
|
|
54
|
+
id-token: write # required for Trusted Publishing (OIDC)
|
|
55
|
+
steps:
|
|
56
|
+
- uses: actions/checkout@v4
|
|
57
|
+
- uses: actions/setup-python@v5
|
|
58
|
+
with:
|
|
59
|
+
python-version: "3.12"
|
|
60
|
+
- name: Build sdist + wheel
|
|
61
|
+
run: |
|
|
62
|
+
python -m pip install --upgrade build
|
|
63
|
+
python -m build
|
|
64
|
+
- name: Publish to PyPI
|
|
65
|
+
uses: pypa/gh-action-pypi-publish@release/v1
|
pentester-0.0.1/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2026 vulnz
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
pentester-0.0.1/PKG-INFO
ADDED
|
@@ -0,0 +1,91 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: pentester
|
|
3
|
+
Version: 0.0.1
|
|
4
|
+
Summary: Full-scale web, network & API penetration testing with AI on demand — reserved for insom.ai.
|
|
5
|
+
Project-URL: Homepage, https://github.com/vulnz/pentester
|
|
6
|
+
Project-URL: Source, https://github.com/vulnz/pentester
|
|
7
|
+
Project-URL: Issues, https://github.com/vulnz/pentester/issues
|
|
8
|
+
Author: vulnz
|
|
9
|
+
License: MIT
|
|
10
|
+
License-File: LICENSE
|
|
11
|
+
Keywords: ai,appsec,dast,dynamic-analysis,pentest,pentesting,scanner,security,vulnerability
|
|
12
|
+
Classifier: Development Status :: 2 - Pre-Alpha
|
|
13
|
+
Classifier: Intended Audience :: Developers
|
|
14
|
+
Classifier: Intended Audience :: Information Technology
|
|
15
|
+
Classifier: License :: OSI Approved :: MIT License
|
|
16
|
+
Classifier: Operating System :: OS Independent
|
|
17
|
+
Classifier: Programming Language :: Python :: 3
|
|
18
|
+
Classifier: Topic :: Security
|
|
19
|
+
Requires-Python: >=3.8
|
|
20
|
+
Description-Content-Type: text/markdown
|
|
21
|
+
|
|
22
|
+
# pentester
|
|
23
|
+
|
|
24
|
+
```
|
|
25
|
+
██████╗ ███████╗███╗ ██╗████████╗███████╗███████╗████████╗███████╗██████╗
|
|
26
|
+
██╔══██╗██╔════╝████╗ ██║╚══██╔══╝██╔════╝██╔════╝╚══██╔══╝██╔════╝██╔══██╗
|
|
27
|
+
██████╔╝█████╗ ██╔██╗ ██║ ██║ █████╗ ███████╗ ██║ █████╗ ██████╔╝
|
|
28
|
+
██╔═══╝ ██╔══╝ ██║╚██╗██║ ██║ ██╔══╝ ╚════██║ ██║ ██╔══╝ ██╔══██╗
|
|
29
|
+
██║ ███████╗██║ ╚████║ ██║ ███████╗███████║ ██║ ███████╗██║ ██║
|
|
30
|
+
╚═╝ ╚══════╝╚═╝ ╚═══╝ ╚═╝ ╚══════╝╚══════╝ ╚═╝ ╚══════╝╚═╝ ╚═╝
|
|
31
|
+
full-scale web · network · api pentesting — AI on demand
|
|
32
|
+
```
|
|
33
|
+
|
|
34
|
+
**`pentester`** is a full-scale offensive security toolkit that brings **web**,
|
|
35
|
+
**network**, and **API** penetration testing under one command line — with
|
|
36
|
+
**AI on demand** to drive recon, mutate requests, and triage findings.
|
|
37
|
+
|
|
38
|
+
> 🚧 **Name reserved for [insom.ai](https://insom.ai).** This release secures
|
|
39
|
+
> the package on PyPI and ships a working CLI shell. The full dynamic-analysis
|
|
40
|
+
> engine lands in upcoming releases — watch this space.
|
|
41
|
+
|
|
42
|
+
[](https://pypi.org/project/pentester/)
|
|
43
|
+
[](https://pypi.org/project/pentester/)
|
|
44
|
+
[](LICENSE)
|
|
45
|
+
|
|
46
|
+
## What it will do
|
|
47
|
+
|
|
48
|
+
| Surface | Capabilities (shipping incrementally) |
|
|
49
|
+
|---------|----------------------------------------|
|
|
50
|
+
| **Web** | Crawling & spidering, authenticated sessions, fuzzing, OWASP-class detection (injection, XSS, SSRF, auth flaws), tech/CMS fingerprinting |
|
|
51
|
+
| **Network** | Host & port discovery, service fingerprinting, protocol enumeration, known-CVE matching, misconfiguration checks |
|
|
52
|
+
| **API** | REST / GraphQL / gRPC discovery, schema-aware fuzzing, auth / BOLA / mass-assignment testing |
|
|
53
|
+
| **AI on demand** | Attack-surface reasoning, request mutation, exploit-path suggestion, finding triage, and natural-language report narration — opt-in, bring-your-own model |
|
|
54
|
+
|
|
55
|
+
## Install
|
|
56
|
+
|
|
57
|
+
```bash
|
|
58
|
+
pip install pentester
|
|
59
|
+
# or, isolated and always on PATH:
|
|
60
|
+
pipx install pentester
|
|
61
|
+
```
|
|
62
|
+
|
|
63
|
+
## Usage
|
|
64
|
+
|
|
65
|
+
```bash
|
|
66
|
+
pentester --version
|
|
67
|
+
pentester scan https://example.com # engine coming soon
|
|
68
|
+
```
|
|
69
|
+
|
|
70
|
+
If the `pentester` command isn't found after a `pip install --user`, run it as
|
|
71
|
+
a module (works regardless of `PATH`):
|
|
72
|
+
|
|
73
|
+
```bash
|
|
74
|
+
python -m pentester --version
|
|
75
|
+
```
|
|
76
|
+
|
|
77
|
+
## Roadmap
|
|
78
|
+
|
|
79
|
+
- [ ] Live web/network/API target fingerprinting
|
|
80
|
+
- [ ] Active scanning & fuzzing engine
|
|
81
|
+
- [ ] Component & dependency vulnerability detection
|
|
82
|
+
- [ ] AI-assisted request mutation and finding triage
|
|
83
|
+
- [ ] HTML / JSON / SARIF reports with CI exit-code gating
|
|
84
|
+
|
|
85
|
+
## License
|
|
86
|
+
|
|
87
|
+
MIT — see [LICENSE](LICENSE).
|
|
88
|
+
|
|
89
|
+
---
|
|
90
|
+
|
|
91
|
+
© CQR Cybersecurity LLC · part of the [insom.ai](https://insom.ai) security platform.
|
|
@@ -0,0 +1,70 @@
|
|
|
1
|
+
# pentester
|
|
2
|
+
|
|
3
|
+
```
|
|
4
|
+
██████╗ ███████╗███╗ ██╗████████╗███████╗███████╗████████╗███████╗██████╗
|
|
5
|
+
██╔══██╗██╔════╝████╗ ██║╚══██╔══╝██╔════╝██╔════╝╚══██╔══╝██╔════╝██╔══██╗
|
|
6
|
+
██████╔╝█████╗ ██╔██╗ ██║ ██║ █████╗ ███████╗ ██║ █████╗ ██████╔╝
|
|
7
|
+
██╔═══╝ ██╔══╝ ██║╚██╗██║ ██║ ██╔══╝ ╚════██║ ██║ ██╔══╝ ██╔══██╗
|
|
8
|
+
██║ ███████╗██║ ╚████║ ██║ ███████╗███████║ ██║ ███████╗██║ ██║
|
|
9
|
+
╚═╝ ╚══════╝╚═╝ ╚═══╝ ╚═╝ ╚══════╝╚══════╝ ╚═╝ ╚══════╝╚═╝ ╚═╝
|
|
10
|
+
full-scale web · network · api pentesting — AI on demand
|
|
11
|
+
```
|
|
12
|
+
|
|
13
|
+
**`pentester`** is a full-scale offensive security toolkit that brings **web**,
|
|
14
|
+
**network**, and **API** penetration testing under one command line — with
|
|
15
|
+
**AI on demand** to drive recon, mutate requests, and triage findings.
|
|
16
|
+
|
|
17
|
+
> 🚧 **Name reserved for [insom.ai](https://insom.ai).** This release secures
|
|
18
|
+
> the package on PyPI and ships a working CLI shell. The full dynamic-analysis
|
|
19
|
+
> engine lands in upcoming releases — watch this space.
|
|
20
|
+
|
|
21
|
+
[](https://pypi.org/project/pentester/)
|
|
22
|
+
[](https://pypi.org/project/pentester/)
|
|
23
|
+
[](LICENSE)
|
|
24
|
+
|
|
25
|
+
## What it will do
|
|
26
|
+
|
|
27
|
+
| Surface | Capabilities (shipping incrementally) |
|
|
28
|
+
|---------|----------------------------------------|
|
|
29
|
+
| **Web** | Crawling & spidering, authenticated sessions, fuzzing, OWASP-class detection (injection, XSS, SSRF, auth flaws), tech/CMS fingerprinting |
|
|
30
|
+
| **Network** | Host & port discovery, service fingerprinting, protocol enumeration, known-CVE matching, misconfiguration checks |
|
|
31
|
+
| **API** | REST / GraphQL / gRPC discovery, schema-aware fuzzing, auth / BOLA / mass-assignment testing |
|
|
32
|
+
| **AI on demand** | Attack-surface reasoning, request mutation, exploit-path suggestion, finding triage, and natural-language report narration — opt-in, bring-your-own model |
|
|
33
|
+
|
|
34
|
+
## Install
|
|
35
|
+
|
|
36
|
+
```bash
|
|
37
|
+
pip install pentester
|
|
38
|
+
# or, isolated and always on PATH:
|
|
39
|
+
pipx install pentester
|
|
40
|
+
```
|
|
41
|
+
|
|
42
|
+
## Usage
|
|
43
|
+
|
|
44
|
+
```bash
|
|
45
|
+
pentester --version
|
|
46
|
+
pentester scan https://example.com # engine coming soon
|
|
47
|
+
```
|
|
48
|
+
|
|
49
|
+
If the `pentester` command isn't found after a `pip install --user`, run it as
|
|
50
|
+
a module (works regardless of `PATH`):
|
|
51
|
+
|
|
52
|
+
```bash
|
|
53
|
+
python -m pentester --version
|
|
54
|
+
```
|
|
55
|
+
|
|
56
|
+
## Roadmap
|
|
57
|
+
|
|
58
|
+
- [ ] Live web/network/API target fingerprinting
|
|
59
|
+
- [ ] Active scanning & fuzzing engine
|
|
60
|
+
- [ ] Component & dependency vulnerability detection
|
|
61
|
+
- [ ] AI-assisted request mutation and finding triage
|
|
62
|
+
- [ ] HTML / JSON / SARIF reports with CI exit-code gating
|
|
63
|
+
|
|
64
|
+
## License
|
|
65
|
+
|
|
66
|
+
MIT — see [LICENSE](LICENSE).
|
|
67
|
+
|
|
68
|
+
---
|
|
69
|
+
|
|
70
|
+
© CQR Cybersecurity LLC · part of the [insom.ai](https://insom.ai) security platform.
|
|
@@ -0,0 +1,8 @@
|
|
|
1
|
+
"""pentester — full-scale web/network/API penetration testing with AI on demand.
|
|
2
|
+
|
|
3
|
+
Name reserved for insom.ai. The full dynamic-analysis engine lands in upcoming
|
|
4
|
+
releases; this build ships a working CLI shell.
|
|
5
|
+
"""
|
|
6
|
+
|
|
7
|
+
__version__ = "0.0.1"
|
|
8
|
+
__all__ = ["__version__"]
|
|
@@ -0,0 +1,54 @@
|
|
|
1
|
+
"""Command-line entry point for `pentester`.
|
|
2
|
+
|
|
3
|
+
Name reserved for insom.ai. This early release ships a working CLI shell; the
|
|
4
|
+
full-scale web/network/API dynamic-analysis engine (with AI on demand) is added
|
|
5
|
+
in later releases.
|
|
6
|
+
"""
|
|
7
|
+
import argparse
|
|
8
|
+
import sys
|
|
9
|
+
|
|
10
|
+
from . import __version__
|
|
11
|
+
|
|
12
|
+
_BANNER = r"""
|
|
13
|
+
██████╗ ███████╗███╗ ██╗████████╗███████╗███████╗████████╗███████╗██████╗
|
|
14
|
+
██╔══██╗██╔════╝████╗ ██║╚══██╔══╝██╔════╝██╔════╝╚══██╔══╝██╔════╝██╔══██╗
|
|
15
|
+
██████╔╝█████╗ ██╔██╗ ██║ ██║ █████╗ ███████╗ ██║ █████╗ ██████╔╝
|
|
16
|
+
██╔═══╝ ██╔══╝ ██║╚██╗██║ ██║ ██╔══╝ ╚════██║ ██║ ██╔══╝ ██╔══██╗
|
|
17
|
+
██║ ███████╗██║ ╚████║ ██║ ███████╗███████║ ██║ ███████╗██║ ██║
|
|
18
|
+
╚═╝ ╚══════╝╚═╝ ╚═══╝ ╚═╝ ╚══════╝╚══════╝ ╚═╝ ╚══════╝╚═╝ ╚═╝
|
|
19
|
+
full-scale web · network · api pentesting — AI on demand v{ver}
|
|
20
|
+
"""
|
|
21
|
+
|
|
22
|
+
|
|
23
|
+
def build_parser() -> argparse.ArgumentParser:
|
|
24
|
+
p = argparse.ArgumentParser(
|
|
25
|
+
prog="pentester",
|
|
26
|
+
description="Full-scale web/network/API penetration testing with AI on demand.",
|
|
27
|
+
)
|
|
28
|
+
p.add_argument("--version", action="version",
|
|
29
|
+
version=f"pentester {__version__}")
|
|
30
|
+
sub = p.add_subparsers(dest="command")
|
|
31
|
+
scan = sub.add_parser(
|
|
32
|
+
"scan", help="(coming soon) run a dynamic scan against a target")
|
|
33
|
+
scan.add_argument("target", nargs="?", help="target URL or host")
|
|
34
|
+
return p
|
|
35
|
+
|
|
36
|
+
|
|
37
|
+
def main(argv=None) -> int:
|
|
38
|
+
argv = list(sys.argv[1:] if argv is None else argv)
|
|
39
|
+
parser = build_parser()
|
|
40
|
+
args = parser.parse_args(argv)
|
|
41
|
+
print(_BANNER.format(ver=__version__))
|
|
42
|
+
if args.command == "scan":
|
|
43
|
+
print(f"[pentester] the dynamic-analysis engine is not implemented yet "
|
|
44
|
+
f"(target: {args.target or 'none given'}).")
|
|
45
|
+
print(" This package name is reserved for insom.ai — "
|
|
46
|
+
"watch the releases.")
|
|
47
|
+
else:
|
|
48
|
+
print(" Reserved for insom.ai. Engine arriving in upcoming releases.")
|
|
49
|
+
print(" Usage: pentester scan <target>")
|
|
50
|
+
return 0
|
|
51
|
+
|
|
52
|
+
|
|
53
|
+
if __name__ == "__main__":
|
|
54
|
+
raise SystemExit(main())
|
|
@@ -0,0 +1,37 @@
|
|
|
1
|
+
[build-system]
|
|
2
|
+
requires = ["hatchling"]
|
|
3
|
+
build-backend = "hatchling.build"
|
|
4
|
+
|
|
5
|
+
[project]
|
|
6
|
+
name = "pentester"
|
|
7
|
+
version = "0.0.1"
|
|
8
|
+
description = "Full-scale web, network & API penetration testing with AI on demand — reserved for insom.ai."
|
|
9
|
+
readme = "README.md"
|
|
10
|
+
requires-python = ">=3.8"
|
|
11
|
+
license = { text = "MIT" }
|
|
12
|
+
authors = [{ name = "vulnz" }]
|
|
13
|
+
keywords = [
|
|
14
|
+
"security", "pentest", "pentesting", "dast", "dynamic-analysis",
|
|
15
|
+
"vulnerability", "scanner", "ai", "appsec",
|
|
16
|
+
]
|
|
17
|
+
classifiers = [
|
|
18
|
+
"Development Status :: 2 - Pre-Alpha",
|
|
19
|
+
"Intended Audience :: Developers",
|
|
20
|
+
"Intended Audience :: Information Technology",
|
|
21
|
+
"Topic :: Security",
|
|
22
|
+
"License :: OSI Approved :: MIT License",
|
|
23
|
+
"Programming Language :: Python :: 3",
|
|
24
|
+
"Operating System :: OS Independent",
|
|
25
|
+
]
|
|
26
|
+
dependencies = []
|
|
27
|
+
|
|
28
|
+
[project.urls]
|
|
29
|
+
Homepage = "https://github.com/vulnz/pentester"
|
|
30
|
+
Source = "https://github.com/vulnz/pentester"
|
|
31
|
+
Issues = "https://github.com/vulnz/pentester/issues"
|
|
32
|
+
|
|
33
|
+
[project.scripts]
|
|
34
|
+
pentester = "pentester.cli:main"
|
|
35
|
+
|
|
36
|
+
[tool.hatch.build.targets.wheel]
|
|
37
|
+
packages = ["pentester"]
|