zen-ai-pentest 2.2.0__py3-none-any.whl → 2.3.0__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- api/auth.py +61 -7
- api/csrf_protection.py +286 -0
- api/main.py +77 -11
- api/rate_limiter.py +317 -0
- api/rate_limiter_v2.py +586 -0
- autonomous/ki_analysis_agent.py +1033 -0
- benchmarks/__init__.py +12 -142
- benchmarks/agent_performance.py +374 -0
- benchmarks/api_performance.py +479 -0
- benchmarks/scan_performance.py +272 -0
- modules/agent_coordinator.py +255 -0
- modules/api_key_manager.py +501 -0
- modules/benchmark.py +706 -0
- modules/cve_updater.py +303 -0
- modules/false_positive_filter.py +149 -0
- modules/output_formats.py +1088 -0
- modules/risk_scoring.py +206 -0
- {zen_ai_pentest-2.2.0.dist-info → zen_ai_pentest-2.3.0.dist-info}/METADATA +134 -289
- {zen_ai_pentest-2.2.0.dist-info → zen_ai_pentest-2.3.0.dist-info}/RECORD +23 -9
- {zen_ai_pentest-2.2.0.dist-info → zen_ai_pentest-2.3.0.dist-info}/WHEEL +0 -0
- {zen_ai_pentest-2.2.0.dist-info → zen_ai_pentest-2.3.0.dist-info}/entry_points.txt +0 -0
- {zen_ai_pentest-2.2.0.dist-info → zen_ai_pentest-2.3.0.dist-info}/licenses/LICENSE +0 -0
- {zen_ai_pentest-2.2.0.dist-info → zen_ai_pentest-2.3.0.dist-info}/top_level.txt +0 -0
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.4
|
|
2
2
|
Name: zen-ai-pentest
|
|
3
|
-
Version: 2.
|
|
3
|
+
Version: 2.3.0
|
|
4
4
|
Summary: Advanced AI-Powered Penetration Testing Framework with Multi-Agent Orchestration
|
|
5
5
|
Home-page: https://github.com/SHAdd0WTAka/zen-ai-pentest
|
|
6
6
|
Author: SHAdd0WTAka
|
|
@@ -11,6 +11,7 @@ Project-URL: Documentation, https://github.com/SHAdd0WTAka/zen-ai-pentest/tree/m
|
|
|
11
11
|
Project-URL: Repository, https://github.com/SHAdd0WTAka/zen-ai-pentest.git
|
|
12
12
|
Project-URL: Bug Tracker, https://github.com/SHAdd0WTAka/zen-ai-pentest/issues
|
|
13
13
|
Project-URL: Changelog, https://github.com/SHAdd0WTAka/zen-ai-pentest/releases
|
|
14
|
+
Project-URL: Marketplace, https://github.com/marketplace/actions/zen-ai-pentest
|
|
14
15
|
Project-URL: Discussions, https://github.com/SHAdd0WTAka/zen-ai-pentest/discussions
|
|
15
16
|
Keywords: penetration-testing,security,ai,llm,multi-agent,cve,vulnerability-scanner,pentest
|
|
16
17
|
Classifier: Development Status :: 4 - Beta
|
|
@@ -63,10 +64,47 @@ Dynamic: requires-python
|
|
|
63
64
|
[](docker/)
|
|
64
65
|
[](tests/)
|
|
65
66
|
[](https://pypi.org/project/zen-ai-pentest/)
|
|
66
|
-
[](https://github.com/marketplace/actions/zen-ai-pentest)
|
|
68
|
+
[](https://github.com/SHAdd0WTAka/Zen-Ai-Pentest/actions/workflows/pypi-release.yml)
|
|
69
|
+
[](https://github.com/SHAdd0WTAka/zen-ai-pentest/releases)
|
|
67
70
|
[](#-authors--team)
|
|
68
71
|
[](ROADMAP_2026.md)
|
|
69
|
-
[](docs/
|
|
72
|
+
[](docs/ARCHITECTURE.md)
|
|
73
|
+
|
|
74
|
+
## 🚀 CI/CD & Security Status
|
|
75
|
+
|
|
76
|
+
[](https://github.com/SHAdd0WTAka/Zen-Ai-Pentest/actions/workflows/ci.yml)
|
|
77
|
+
[](https://github.com/SHAdd0WTAka/Zen-Ai-Pentest/actions/workflows/security.yml)
|
|
78
|
+
[](https://github.com/SHAdd0WTAka/Zen-Ai-Pentest/security/code-scanning)
|
|
79
|
+
[](docs/production-hardening.md)
|
|
80
|
+
[](https://github.com/SHAdd0WTAka/Zen-Ai-Pentest/security/dependabot)
|
|
81
|
+
[](https://codecov.io/gh/SHAdd0WTAka/zen-ai-pentest)
|
|
82
|
+
|
|
83
|
+
---
|
|
84
|
+
|
|
85
|
+
## 📚 Table of Contents
|
|
86
|
+
|
|
87
|
+
- [Overview](#-overview)
|
|
88
|
+
- [Features](#-features)
|
|
89
|
+
- [Quick Start](#-quick-start)
|
|
90
|
+
- [Installation](#-installation)
|
|
91
|
+
- [Usage](#-usage)
|
|
92
|
+
- [Architecture](#-architecture)
|
|
93
|
+
- [API Reference](#-api-reference)
|
|
94
|
+
- [Project Structure](#-project-structure)
|
|
95
|
+
- [Configuration](#-configuration)
|
|
96
|
+
- [Testing](#-testing)
|
|
97
|
+
- [Documentation](#-documentation)
|
|
98
|
+
- [Contributing](#-contributing)
|
|
99
|
+
- [Support](#-support)
|
|
100
|
+
- [License](#-license)
|
|
101
|
+
|
|
102
|
+
---
|
|
103
|
+
|
|
104
|
+
## 🎯 Overview
|
|
105
|
+
|
|
106
|
+
**Zen-AI-Pentest** is an autonomous, AI-powered penetration testing framework that combines cutting-edge language models with professional security tools. Built for security professionals, bug bounty hunters, and enterprise security teams.
|
|
107
|
+
|
|
70
108
|
```mermaid
|
|
71
109
|
graph TB
|
|
72
110
|
subgraph "User Interface"
|
|
@@ -109,8 +147,15 @@ Dynamic: requires-python
|
|
|
109
147
|
StateMachine --> Exploit
|
|
110
148
|
Exploit --> OpenAI
|
|
111
149
|
RiskEngine --> ThreatIntel
|
|
112
|
-
|
|
113
|
-
|
|
150
|
+
```
|
|
151
|
+
|
|
152
|
+
### Key Highlights
|
|
153
|
+
|
|
154
|
+
- 🤖 **AI-Powered**: Leverages state-of-the-art LLMs for intelligent decision making
|
|
155
|
+
- 🔒 **Security-First**: Multiple safety controls and validation layers
|
|
156
|
+
- 🚀 **Production-Ready**: Enterprise-grade with CI/CD, monitoring, and support
|
|
157
|
+
- 📊 **Comprehensive**: 20+ integrated security tools
|
|
158
|
+
- 🔧 **Extensible**: Plugin system for custom tools and integrations
|
|
114
159
|
|
|
115
160
|
---
|
|
116
161
|
|
|
@@ -204,8 +249,7 @@ cp .env.example .env
|
|
|
204
249
|
# Edit .env with your settings
|
|
205
250
|
|
|
206
251
|
# Start full stack
|
|
207
|
-
|
|
208
|
-
docker-compose -f docker-compose.full.yml up -d
|
|
252
|
+
docker-compose up -d
|
|
209
253
|
|
|
210
254
|
# Access:
|
|
211
255
|
# Dashboard: http://localhost:3000
|
|
@@ -238,7 +282,17 @@ python scripts/setup_vms.py --kali
|
|
|
238
282
|
|
|
239
283
|
---
|
|
240
284
|
|
|
241
|
-
## 📖
|
|
285
|
+
## 📖 Installation
|
|
286
|
+
|
|
287
|
+
For detailed installation instructions, see:
|
|
288
|
+
- **[Docker Installation](docs/INSTALLATION.md#quick-start-docker)**
|
|
289
|
+
- **[Local Installation](docs/INSTALLATION.md#local-installation)**
|
|
290
|
+
- **[Production Deployment](docs/INSTALLATION.md#production-deployment)**
|
|
291
|
+
- **[VirtualBox Setup](docs/setup/VIRTUALBOX_SETUP.md)**
|
|
292
|
+
|
|
293
|
+
---
|
|
294
|
+
|
|
295
|
+
## 💻 Usage
|
|
242
296
|
|
|
243
297
|
### Python API
|
|
244
298
|
|
|
@@ -320,7 +374,7 @@ ws.onmessage = (event) => {
|
|
|
320
374
|
|
|
321
375
|
```
|
|
322
376
|
┌─────────────────────────────────────────────────────────────────────────┐
|
|
323
|
-
│ ZEN-AI-PENTEST v2.
|
|
377
|
+
│ ZEN-AI-PENTEST v2.2 - System Architecture │
|
|
324
378
|
├─────────────────────────────────────────────────────────────────────────┤
|
|
325
379
|
│ │
|
|
326
380
|
│ ┌─────────────────────────────────────────────────────────────────┐ │
|
|
@@ -381,6 +435,16 @@ ws.onmessage = (event) => {
|
|
|
381
435
|
└─────────────────────────────────────────────────────────────────────────┘
|
|
382
436
|
```
|
|
383
437
|
|
|
438
|
+
For detailed architecture documentation, see [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md).
|
|
439
|
+
|
|
440
|
+
---
|
|
441
|
+
|
|
442
|
+
## 📡 API Reference
|
|
443
|
+
|
|
444
|
+
- **[API Documentation](docs/API.md)** - Complete REST API reference
|
|
445
|
+
- **[WebSocket API](docs/API.md#websocket)** - Real-time updates
|
|
446
|
+
- **[Authentication](docs/API.md#authentication)** - Security and auth
|
|
447
|
+
|
|
384
448
|
---
|
|
385
449
|
|
|
386
450
|
## 📁 Project Structure
|
|
@@ -395,11 +459,27 @@ zen-ai-pentest/
|
|
|
395
459
|
├── agents/ # AI Agents
|
|
396
460
|
│ ├── react_agent.py # ReAct Agent
|
|
397
461
|
│ └── react_agent_vm.py # VM-based Agent
|
|
462
|
+
├── autonomous/ # Autonomous Agent System
|
|
463
|
+
│ ├── agent_loop.py # ReAct Loop Engine
|
|
464
|
+
│ ├── exploit_validator.py # Exploit Validation
|
|
465
|
+
│ ├── memory.py # Memory Management
|
|
466
|
+
│ └── tool_executor.py # Tool Execution
|
|
467
|
+
├── risk_engine/ # Risk Analysis
|
|
468
|
+
│ ├── false_positive_engine.py
|
|
469
|
+
│ ├── business_impact_calculator.py
|
|
470
|
+
│ ├── cvss.py
|
|
471
|
+
│ └── epss.py
|
|
472
|
+
├── benchmarks/ # Benchmark Framework
|
|
473
|
+
│ ├── run_benchmarks.py
|
|
474
|
+
│ └── comparison.py
|
|
475
|
+
├── integrations/ # CI/CD Integrations
|
|
476
|
+
│ ├── github.py
|
|
477
|
+
│ ├── gitlab.py
|
|
478
|
+
│ ├── jira.py
|
|
479
|
+
│ ├── slack.py
|
|
480
|
+
│ └── jenkins.py
|
|
398
481
|
├── database/ # Database Layer
|
|
399
482
|
│ └── models.py # SQLAlchemy Models
|
|
400
|
-
├── virtualization/ # VM Management
|
|
401
|
-
│ ├── vm_manager.py # VirtualBox
|
|
402
|
-
│ └── cloud_vm_manager.py # AWS/Azure/GCP
|
|
403
483
|
├── tools/ # Pentesting Tools
|
|
404
484
|
│ ├── nmap_integration.py
|
|
405
485
|
│ ├── sqlmap_integration.py
|
|
@@ -416,11 +496,12 @@ zen-ai-pentest/
|
|
|
416
496
|
│ ├── Dockerfile
|
|
417
497
|
│ └── docker-compose.full.yml
|
|
418
498
|
├── docs/ # Documentation
|
|
419
|
-
│ ├──
|
|
420
|
-
│
|
|
421
|
-
├──
|
|
422
|
-
│ └──
|
|
423
|
-
|
|
499
|
+
│ ├── ARCHITECTURE.md
|
|
500
|
+
│ ├── INSTALLATION.md
|
|
501
|
+
│ ├── API.md
|
|
502
|
+
│ └── setup/
|
|
503
|
+
├── tests/ # Test Suite
|
|
504
|
+
└── scripts/ # Setup Scripts
|
|
424
505
|
```
|
|
425
506
|
|
|
426
507
|
---
|
|
@@ -437,17 +518,17 @@ DATABASE_URL=postgresql://postgres:password@localhost:5432/zen_pentest
|
|
|
437
518
|
SECRET_KEY=your-secret-key-here
|
|
438
519
|
JWT_EXPIRATION=3600
|
|
439
520
|
|
|
521
|
+
# AI Providers
|
|
522
|
+
OPENAI_API_KEY=sk-...
|
|
523
|
+
ANTHROPIC_API_KEY=sk-ant-...
|
|
524
|
+
|
|
440
525
|
# Notifications
|
|
441
526
|
SLACK_WEBHOOK_URL=https://hooks.slack.com/...
|
|
442
527
|
SMTP_HOST=smtp.gmail.com
|
|
443
|
-
SMTP_USER=user@gmail.com
|
|
444
|
-
SMTP_PASS=password
|
|
445
528
|
|
|
446
529
|
# Cloud Providers
|
|
447
530
|
AWS_ACCESS_KEY_ID=AKIA...
|
|
448
|
-
AWS_SECRET_ACCESS_KEY=...
|
|
449
531
|
AZURE_SUBSCRIPTION_ID=...
|
|
450
|
-
GCP_PROJECT_ID=...
|
|
451
532
|
```
|
|
452
533
|
|
|
453
534
|
See `.env.example` for all options.
|
|
@@ -474,22 +555,41 @@ pytest tests/integration/ -v
|
|
|
474
555
|
|
|
475
556
|
## 📚 Documentation
|
|
476
557
|
|
|
477
|
-
- [
|
|
478
|
-
- [
|
|
479
|
-
- [
|
|
480
|
-
- [
|
|
558
|
+
- **[Getting Started](docs/tutorials/getting-started.md)** - First steps
|
|
559
|
+
- **[Installation Guide](docs/INSTALLATION.md)** - Setup instructions
|
|
560
|
+
- **[API Documentation](docs/API.md)** - REST API reference
|
|
561
|
+
- **[Architecture](docs/ARCHITECTURE.md)** - System design
|
|
562
|
+
- **[Support](SUPPORT.md)** - Help and support
|
|
481
563
|
|
|
482
564
|
---
|
|
483
565
|
|
|
484
566
|
## 🤝 Contributing
|
|
485
567
|
|
|
568
|
+
We welcome contributions! Please see:
|
|
569
|
+
- **[CONTRIBUTING.md](CONTRIBUTING.md)** - Contribution guidelines
|
|
570
|
+
- **[CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md)** - Community standards
|
|
571
|
+
- **[CONTRIBUTORS.md](CONTRIBUTORS.md)** - Our amazing contributors
|
|
572
|
+
|
|
573
|
+
Quick start:
|
|
486
574
|
1. Fork the repository
|
|
487
575
|
2. Create feature branch (`git checkout -b feature/amazing-feature`)
|
|
488
576
|
3. Commit changes (`git commit -m 'Add amazing feature'`)
|
|
489
577
|
4. Push to branch (`git push origin feature/amazing-feature`)
|
|
490
578
|
5. Open Pull Request
|
|
491
579
|
|
|
492
|
-
|
|
580
|
+
---
|
|
581
|
+
|
|
582
|
+
## 💬 Support
|
|
583
|
+
|
|
584
|
+
Need help? We've got you covered:
|
|
585
|
+
|
|
586
|
+
- 📖 **[Documentation](docs/)** - Comprehensive guides
|
|
587
|
+
- 💬 **[GitHub Discussions](https://github.com/SHAdd0WTAka/zen-ai-pentest/discussions)** - Community Q&A
|
|
588
|
+
- 🐛 **[Issue Tracker](https://github.com/SHAdd0WTAka/zen-ai-pentest/issues)** - Bug reports
|
|
589
|
+
- 🌐 **[Discord](https://discord.gg/zen-ai-pentest)** - Real-time chat
|
|
590
|
+
- 📧 **[Email Support](mailto:support@zen-ai-pentest.dev)** - Direct contact
|
|
591
|
+
|
|
592
|
+
See [SUPPORT.md](SUPPORT.md) for detailed support options.
|
|
493
593
|
|
|
494
594
|
---
|
|
495
595
|
|
|
@@ -518,260 +618,6 @@ This project is licensed under the MIT License - see [LICENSE](LICENSE) file for
|
|
|
518
618
|
|
|
519
619
|
---
|
|
520
620
|
|
|
521
|
-
## 🎯 Advanced Features
|
|
522
|
-
|
|
523
|
-
### Autonomous Mode
|
|
524
|
-
|
|
525
|
-
The autonomous agent uses ReAct (Reasoning + Acting) pattern for fully automated penetration testing:
|
|
526
|
-
|
|
527
|
-
```bash
|
|
528
|
-
# Run autonomous scan
|
|
529
|
-
zen-ai-pentest --autonomous --target example.com --goal "Find all vulnerabilities"
|
|
530
|
-
|
|
531
|
-
# With custom scope
|
|
532
|
-
zen-ai-pentest --autonomous --target example.com --scope config/autonomous.json
|
|
533
|
-
```
|
|
534
|
-
|
|
535
|
-
**Features:**
|
|
536
|
-
- **State Machine**: PLANNING → EXECUTING → OBSERVING → REFLECTING → COMPLETED
|
|
537
|
-
- **Memory Management**: Short-term, long-term, and context window
|
|
538
|
-
- **Tool Orchestration**: Automatic selection and execution of 20+ tools
|
|
539
|
-
- **Self-Correction**: Retry logic and error recovery
|
|
540
|
-
- **Human-in-the-Loop**: Optional pause for critical decisions
|
|
541
|
-
|
|
542
|
-
```python
|
|
543
|
-
from autonomous import AutonomousAgentLoop
|
|
544
|
-
|
|
545
|
-
agent = AutonomousAgentLoop(max_iterations=50)
|
|
546
|
-
result = await agent.run(
|
|
547
|
-
goal="Find vulnerabilities and open ports",
|
|
548
|
-
target="example.com",
|
|
549
|
-
scope={"depth": "comprehensive"}
|
|
550
|
-
)
|
|
551
|
-
```
|
|
552
|
-
|
|
553
|
-
---
|
|
554
|
-
|
|
555
|
-
### Risk Engine
|
|
556
|
-
|
|
557
|
-
Advanced false-positive reduction and risk prioritization:
|
|
558
|
-
|
|
559
|
-
```bash
|
|
560
|
-
# Scan with risk validation
|
|
561
|
-
zen-ai-pentest --target example.com --autonomous --validate-risks
|
|
562
|
-
```
|
|
563
|
-
|
|
564
|
-
**Components:**
|
|
565
|
-
- **FalsePositiveEngine**: Multi-factor validation using Bayesian filtering and LLM voting
|
|
566
|
-
- **BusinessImpactCalculator**: Financial, compliance, and reputation impact assessment
|
|
567
|
-
- **CVSS/EPSS Scoring**: Industry-standard vulnerability scoring
|
|
568
|
-
- **Priority Ranking**: Automated finding prioritization
|
|
569
|
-
|
|
570
|
-
```python
|
|
571
|
-
from risk_engine import FalsePositiveEngine, BusinessImpactCalculator
|
|
572
|
-
|
|
573
|
-
# Validate findings
|
|
574
|
-
fp_engine = FalsePositiveEngine()
|
|
575
|
-
validation = await fp_engine.validate_finding(finding)
|
|
576
|
-
|
|
577
|
-
# Calculate business impact
|
|
578
|
-
impact_calc = BusinessImpactCalculator(
|
|
579
|
-
organization_size="large",
|
|
580
|
-
annual_revenue=100000000,
|
|
581
|
-
industry="finance"
|
|
582
|
-
)
|
|
583
|
-
impact = impact_calc.calculate_overall_impact(asset_context, finding_type, severity)
|
|
584
|
-
```
|
|
585
|
-
|
|
586
|
-
---
|
|
587
|
-
|
|
588
|
-
### CI/CD Integration
|
|
589
|
-
|
|
590
|
-
Seamless integration with DevSecOps pipelines:
|
|
591
|
-
|
|
592
|
-
**GitHub Actions:**
|
|
593
|
-
```yaml
|
|
594
|
-
- name: Security Scan
|
|
595
|
-
uses: zen-ai-pentest/action@v2
|
|
596
|
-
with:
|
|
597
|
-
target: ${{ vars.TARGET_URL }}
|
|
598
|
-
fail-on: critical
|
|
599
|
-
format: sarif
|
|
600
|
-
```
|
|
601
|
-
|
|
602
|
-
**GitLab CI:**
|
|
603
|
-
```yaml
|
|
604
|
-
security-scan:
|
|
605
|
-
image: zen-ai-pentest:latest
|
|
606
|
-
script:
|
|
607
|
-
- zen-ai-pentest --target $TARGET --ci-mode --fail-on high
|
|
608
|
-
artifacts:
|
|
609
|
-
reports:
|
|
610
|
-
sast: gl-sast-report.json
|
|
611
|
-
```
|
|
612
|
-
|
|
613
|
-
**Jenkins:**
|
|
614
|
-
```groovy
|
|
615
|
-
stage('Security Scan') {
|
|
616
|
-
steps {
|
|
617
|
-
sh 'zen-ai-pentest --target ${TARGET} --ci-mode --fail-on critical'
|
|
618
|
-
}
|
|
619
|
-
}
|
|
620
|
-
```
|
|
621
|
-
|
|
622
|
-
**Supported Output Formats:**
|
|
623
|
-
- **JSON**: Machine-readable findings
|
|
624
|
-
- **JUnit XML**: Test result integration
|
|
625
|
-
- **SARIF**: Static analysis results format
|
|
626
|
-
- **Markdown**: Human-readable reports
|
|
627
|
-
|
|
628
|
-
**Exit Codes:**
|
|
629
|
-
- `0`: Scan passed (no findings above threshold)
|
|
630
|
-
- `1`: Findings detected (above threshold)
|
|
631
|
-
|
|
632
|
-
---
|
|
633
|
-
|
|
634
|
-
### Benchmarking
|
|
635
|
-
|
|
636
|
-
Compare Zen AI against competitors:
|
|
637
|
-
|
|
638
|
-
```bash
|
|
639
|
-
# Run full benchmark suite
|
|
640
|
-
zen-ai-pentest --benchmark
|
|
641
|
-
|
|
642
|
-
# Quick benchmark
|
|
643
|
-
python -c "from benchmarks import run_quick_benchmark; asyncio.run(run_quick_benchmark())"
|
|
644
|
-
```
|
|
645
|
-
|
|
646
|
-
**Benchmarks Include:**
|
|
647
|
-
- HackTheBox machines (Lame, Blue, Legacy)
|
|
648
|
-
- OWASP WebGoat scenarios
|
|
649
|
-
- DVWA test cases
|
|
650
|
-
- OWASP Juice Shop challenges
|
|
651
|
-
|
|
652
|
-
**Metrics:**
|
|
653
|
-
| Metric | Description |
|
|
654
|
-
|--------|-------------|
|
|
655
|
-
| Time to First Finding | Speed of initial vulnerability detection |
|
|
656
|
-
| Time to User | Initial access achievement time |
|
|
657
|
-
| Time to Root | Full compromise time |
|
|
658
|
-
| Findings Count | Total vulnerabilities discovered |
|
|
659
|
-
| False Positive Rate | Accuracy measurement |
|
|
660
|
-
| Cost per Scan | API and compute costs |
|
|
661
|
-
|
|
662
|
-
**Competitor Comparison:**
|
|
663
|
-
| Tool | HTB Easy | FP Rate | Cost |
|
|
664
|
-
|------|----------|---------|------|
|
|
665
|
-
| Zen AI | ~45min | ~12% | $0.50 |
|
|
666
|
-
| PentestGPT | ~80min | ~28% | $1.20 |
|
|
667
|
-
| AutoPentest | ~120min | ~35% | $2.00 |
|
|
668
|
-
|
|
669
|
-
---
|
|
670
|
-
|
|
671
|
-
### Exploit Validation
|
|
672
|
-
|
|
673
|
-
Safe and controlled exploit testing:
|
|
674
|
-
|
|
675
|
-
```bash
|
|
676
|
-
# Validate exploit with safety controls
|
|
677
|
-
zen-ai-pentest --validate-exploits --target example.com --exploit-type sqli
|
|
678
|
-
```
|
|
679
|
-
|
|
680
|
-
**Safety Levels:**
|
|
681
|
-
- **READ_ONLY**: Passive validation only
|
|
682
|
-
- **VALIDATE_ONLY**: Validate without full execution
|
|
683
|
-
- **CONTROLLED**: Controlled execution with limits (default)
|
|
684
|
-
- **FULL**: Full exploitation (requires explicit approval)
|
|
685
|
-
|
|
686
|
-
**Features:**
|
|
687
|
-
- Docker-based sandboxing
|
|
688
|
-
- Evidence collection (screenshots, HTTP captures)
|
|
689
|
-
- Chain of custody tracking
|
|
690
|
-
- Automatic remediation generation
|
|
691
|
-
|
|
692
|
-
```python
|
|
693
|
-
from autonomous import ExploitValidator, ExploitType, ScopeConfig
|
|
694
|
-
|
|
695
|
-
validator = ExploitValidator(
|
|
696
|
-
safety_level="controlled",
|
|
697
|
-
scope_config=ScopeConfig(allowed_hosts=["example.com"])
|
|
698
|
-
)
|
|
699
|
-
|
|
700
|
-
result = await validator.validate(
|
|
701
|
-
exploit_code="' OR '1'='1",
|
|
702
|
-
target="https://example.com/login",
|
|
703
|
-
exploit_type=ExploitType.WEB_SQLI
|
|
704
|
-
)
|
|
705
|
-
```
|
|
706
|
-
|
|
707
|
-
---
|
|
708
|
-
|
|
709
|
-
### Notifications & Integrations
|
|
710
|
-
|
|
711
|
-
**Slack Notifications:**
|
|
712
|
-
```python
|
|
713
|
-
from integrations import SlackNotifier
|
|
714
|
-
|
|
715
|
-
slack = SlackNotifier(webhook_url="...")
|
|
716
|
-
await slack.notify_scan_completed(results, target="example.com")
|
|
717
|
-
```
|
|
718
|
-
|
|
719
|
-
**JIRA Integration:**
|
|
720
|
-
```python
|
|
721
|
-
from integrations import JiraIntegration
|
|
722
|
-
|
|
723
|
-
jira = JiraIntegration(server="...", username="...", api_token="...")
|
|
724
|
-
ticket = await jira.create_finding_ticket(finding, project_key="SEC")
|
|
725
|
-
```
|
|
726
|
-
|
|
727
|
-
**Supported Integrations:**
|
|
728
|
-
- GitHub (Issues, Check Runs)
|
|
729
|
-
- GitLab (Issues, CI/CD)
|
|
730
|
-
- JIRA (Ticket creation)
|
|
731
|
-
- Slack (Notifications)
|
|
732
|
-
- Jenkins (Pipeline triggers)
|
|
733
|
-
- Email (SMTP alerts)
|
|
734
|
-
- Webhooks (Custom endpoints)
|
|
735
|
-
|
|
736
|
-
---
|
|
737
|
-
|
|
738
|
-
## 📁 Updated Project Structure
|
|
739
|
-
|
|
740
|
-
```
|
|
741
|
-
zen-ai-pentest/
|
|
742
|
-
├── autonomous/ # Autonomous Agent System
|
|
743
|
-
│ ├── agent_loop.py # ReAct Loop Engine
|
|
744
|
-
│ ├── exploit_validator.py # Exploit Validation
|
|
745
|
-
│ ├── memory.py # Memory Management
|
|
746
|
-
│ └── tool_executor.py # Tool Execution
|
|
747
|
-
├── risk_engine/ # Risk Analysis
|
|
748
|
-
│ ├── false_positive_engine.py
|
|
749
|
-
│ ├── business_impact_calculator.py
|
|
750
|
-
│ ├── cvss.py
|
|
751
|
-
│ └── epss.py
|
|
752
|
-
├── benchmarks/ # Benchmark Framework
|
|
753
|
-
│ ├── run_benchmarks.py
|
|
754
|
-
│ └── comparison.py
|
|
755
|
-
├── integrations/ # CI/CD Integrations
|
|
756
|
-
│ ├── github.py
|
|
757
|
-
│ ├── gitlab.py
|
|
758
|
-
│ ├── jira.py
|
|
759
|
-
│ ├── slack.py
|
|
760
|
-
│ └── jenkins.py
|
|
761
|
-
├── config/ # Configuration Files
|
|
762
|
-
│ ├── autonomous.json
|
|
763
|
-
│ ├── risk_engine.json
|
|
764
|
-
│ ├── benchmarks.json
|
|
765
|
-
│ └── integrations.json
|
|
766
|
-
├── api/ # FastAPI Backend
|
|
767
|
-
├── agents/ # AI Agents
|
|
768
|
-
├── database/ # Database Layer
|
|
769
|
-
├── tools/ # Pentesting Tools
|
|
770
|
-
└── ...
|
|
771
|
-
```
|
|
772
|
-
|
|
773
|
-
---
|
|
774
|
-
|
|
775
621
|
## 👥 Authors & Team
|
|
776
622
|
|
|
777
623
|
### Core Development Team
|
|
@@ -818,18 +664,17 @@ zen-ai-pentest/
|
|
|
818
664
|
- **GitHub Copilot** - Code assistance and suggestions
|
|
819
665
|
- **Security Community** - Feedback, bug reports, and feature requests
|
|
820
666
|
|
|
821
|
-
### Contributing
|
|
822
|
-
|
|
823
|
-
We welcome contributions! See [CONTRIBUTORS.md](CONTRIBUTORS.md) and [CONTRIBUTING.md](CONTRIBUTING.md) for details.
|
|
824
|
-
|
|
825
667
|
---
|
|
826
668
|
|
|
827
|
-
##
|
|
669
|
+
## 🗺️ Roadmap
|
|
670
|
+
|
|
671
|
+
See [ROADMAP_2026.md](ROADMAP_2026.md) for our detailed 2026 roadmap.
|
|
828
672
|
|
|
829
|
-
|
|
830
|
-
-
|
|
831
|
-
-
|
|
832
|
-
-
|
|
673
|
+
Highlights:
|
|
674
|
+
- **Q1 2026**: SIEM integrations, React Dashboard
|
|
675
|
+
- **Q2 2026**: Mobile app, quantum-resistant crypto
|
|
676
|
+
- **Q3 2026**: Multi-cloud native, serverless support
|
|
677
|
+
- **Q4 2026**: Autonomous SOC capabilities
|
|
833
678
|
|
|
834
679
|
---
|
|
835
680
|
|
|
@@ -11,8 +11,11 @@ agents/react_agent_enhanced.py,sha256=MGdilEKEK2Kly9kSegJnSZW8UUOvfd8DNaad_MJvER
|
|
|
11
11
|
agents/react_agent_vm.py,sha256=DF_TMWG_AfWbtvw9s4TB1MAwkFLMRaWpKw2UcM7Pa5U,11128
|
|
12
12
|
agents/research_agent.py,sha256=f_OjmEvgQX1mUdLRlsj3-QMyB1m5J0oHIsTvFkcRijc,6394
|
|
13
13
|
api/__init__.py,sha256=HQ2cFR8t_PlbtgLzir7P1Umzh-syS5iEfCNZky5uL_Y,256
|
|
14
|
-
api/auth.py,sha256=
|
|
15
|
-
api/
|
|
14
|
+
api/auth.py,sha256=iDWrJq0q0lfBycRB2jCw26FEDwsCZUvywLhzV9uxjpE,5697
|
|
15
|
+
api/csrf_protection.py,sha256=mwhGTHkCd7tteESuAjvqyE3R0MViSYyDjSQcz736YbY,9292
|
|
16
|
+
api/main.py,sha256=KZzkoz3zNK73lOh_esi8MemXoG-AGm8IL8aGN3jOB_0,35439
|
|
17
|
+
api/rate_limiter.py,sha256=yHS_RMAJisIRMUcwLsgRB470SU-pS_Fj389e1bXJJDY,10404
|
|
18
|
+
api/rate_limiter_v2.py,sha256=SMZwcrML_zwwJTZ-CJ6awbuJZCEUVL2Nywo-1Pw8vB8,19796
|
|
16
19
|
api/schemas.py,sha256=nnE-97OOOWpAAenD_sCsCpcLy-SpWW1g2WW902mbihY,10306
|
|
17
20
|
api/websocket.py,sha256=DTDKr48g6RBNCBX6LM1WljR1FLTkoYB-BTm1TtMNaOY,3602
|
|
18
21
|
api/websocket_v2.py,sha256=fVFlDhJc4iq95BBy7UdkdeQdv2QgSCbCmYGLzqL9DfM,6019
|
|
@@ -20,6 +23,7 @@ autonomous/__init__.py,sha256=Gv83jnjasidFfyD6ggCXjJlqjn6YwANLi_b0-kpBSok,2858
|
|
|
20
23
|
autonomous/agent.py,sha256=LG937JGTdiywhjDr9wCxuYaysgL7dRMbPguYWTnjrt0,8021
|
|
21
24
|
autonomous/agent_loop.py,sha256=a_WvxaKgImXyMdddXmdoJCANVbjmWz-FBiptHJn2608,47216
|
|
22
25
|
autonomous/exploit_validator.py,sha256=ZBFqh7v55_6yInqO9bcoEABH0ZxdZBPQYVP0jiSw_JQ,50148
|
|
26
|
+
autonomous/ki_analysis_agent.py,sha256=pExztrcLSyA00lOgpTMJvk-rQ-Ej-qt6OwOxQP0FnIw,37912
|
|
23
27
|
autonomous/memory.py,sha256=l-YeUVAlbI_o44WM3aO5Yn01LlZ0O5iaaBBb6q1pRWY,14891
|
|
24
28
|
autonomous/react.py,sha256=xkIGTZyaJexSFcLoaOPfQl5XOnpbJXgp1ItppBSh1Ec,11448
|
|
25
29
|
autonomous/tool_executor.py,sha256=vyDtfyPmg9MzLHlX8p7GlSIMwTN6DzQUD-OHXeOSrfQ,16095
|
|
@@ -28,12 +32,15 @@ backends/chatgpt_direct.py,sha256=bDlX0d-HkTjI2VSfCTKzwvwOBVpZwCepmivyr7r1lho,46
|
|
|
28
32
|
backends/claude_direct.py,sha256=Dh3U5d1BdRnoRseV7UM2djxvo40YwinmVp1V3F5F7tg,4280
|
|
29
33
|
backends/duckduckgo.py,sha256=btWfM2laDTIRwmzdLevpT0KMFTyV-DpnkDH1tSeHIps,4478
|
|
30
34
|
backends/openrouter.py,sha256=kMOp81yGlVyQcqswh__psapjFHwr05NeGP23OTuSx5Y,3728
|
|
31
|
-
benchmarks/__init__.py,sha256=
|
|
35
|
+
benchmarks/__init__.py,sha256=AAu1btyymoSwBCxl9Kkp0pNiHjbl-ZMv4yHFQGpScCU,594
|
|
36
|
+
benchmarks/agent_performance.py,sha256=Q0oPwW4VquDJE-fo0O7TndWj5Fz5qpj-VRCTajMtsb4,13660
|
|
37
|
+
benchmarks/api_performance.py,sha256=e_6sl6A2Z1X8IiWegS9_8gH8zaov9AXdGgybcne0q0o,16680
|
|
32
38
|
benchmarks/benchmark_engine.py,sha256=FP-Cr6nhZDozmST7fewjdgL47qFwESqtvtbYgycufRE,31260
|
|
33
39
|
benchmarks/ci_benchmark.py,sha256=XOzRmTVmYZCLzh9lPieg6rCo2bl9AiOsM-UFLtC6aLE,24815
|
|
34
40
|
benchmarks/comparison.py,sha256=6hLaCUWiNuBzFSFSr4fCjIcYDln1mhLcpkdhBB82EPQ,23587
|
|
35
41
|
benchmarks/metrics.py,sha256=p4cb27iX-LjVrAVSUpVWIQ9PHIDF8Y7s7NnRzG8buRA,19476
|
|
36
42
|
benchmarks/run_benchmarks.py,sha256=c6Q3qYVb2auICSRjw4KeK13mgosGcibDc6n7yH0iYPg,31509
|
|
43
|
+
benchmarks/scan_performance.py,sha256=grCwpdJzNq_SLm9Dyjzw-nBRH_O7HuG46jjEbgdGbo8,9333
|
|
37
44
|
ci_cd/__init__.py,sha256=ALd3sI-uoMzu1yYH6Fk0KHla8Rst2r9-XoYE1SiYaT8,72
|
|
38
45
|
core/__init__.py,sha256=N0dzS6fnWpbcLe7tegwmK4pkMnGq8zeaFjjowfaBinQ,486
|
|
39
46
|
core/async_pool.py,sha256=n3fqTVfbwa9jGed7bPVUaCpcjK5ksF-ol9B6bfyn4q8,9016
|
|
@@ -49,13 +56,20 @@ core/rate_limiter.py,sha256=poEYln6DGFs6C6n2rSnqRykax-YDi5NySk4LJnkgCpk,12423
|
|
|
49
56
|
core/secure_config.py,sha256=tTDVXKoLiGKdfCQkLorgEKw2qdVyPjwhaxwyuFlGD_8,10361
|
|
50
57
|
core/shield_integration.py,sha256=ktL_25WY0JBH5dBNvqcJLw42mQFkKr6ku5lkgH119Mw,9997
|
|
51
58
|
modules/__init__.py,sha256=eIfsYjpXtuo4cH4TQOIOrXLa6OXrP168ESPM3OuQYT0,1418
|
|
59
|
+
modules/agent_coordinator.py,sha256=c_LSGKa9QozR-eknmcYXfmf6_3JhyY216qyM8ShhSpI,9325
|
|
60
|
+
modules/api_key_manager.py,sha256=L46OkC2VTb9V8CjbrMV0aVzPq0VlNkKWzsNt6G9oBuQ,16188
|
|
61
|
+
modules/benchmark.py,sha256=gDefaFcJ4AVYefYX1qxu0lgm5FL2BaxPZ61qCRZIqog,23537
|
|
52
62
|
modules/cve_database.py,sha256=46ucXLdWjEUed4qh4wznn3oWEyoxWay2r3EVgVMmBrg,13137
|
|
63
|
+
modules/cve_updater.py,sha256=hoETsPyvmvpE8O_nVbNuXELnp_GZuXKU1GUk2F7PMS8,10315
|
|
53
64
|
modules/exploit_assist.py,sha256=xMcIYgwP6XSNuJDw8hI3FM1GsvvL9B3uMiYE8w-OBbY,10254
|
|
65
|
+
modules/false_positive_filter.py,sha256=hadNvFeMZoqNUYVQ7La-IvbezHE8iQx1qQ8RCh4mlBU,4733
|
|
54
66
|
modules/nuclei_integration.py,sha256=2pvFCcTpEpC6M6YV2QWoHBxpKYswoYnD7dX4GJTQnX4,14814
|
|
55
67
|
modules/osint.py,sha256=SZG1rfMQ-zPIasYtKRzFlsjXR3wDSrVLRUtg6extUok,20600
|
|
68
|
+
modules/output_formats.py,sha256=5994G6TJ3XfFKju8pCu_1uoWI0ilN-xd2hAJMBrmt5o,37195
|
|
56
69
|
modules/protonvpn.py,sha256=4G-tLL3JyjJm-ryQIt4-hQTX4eKX_OTZnKFkZaK_F8Q,18133
|
|
57
70
|
modules/recon.py,sha256=utS-wfdRBS7XaGtr1mcpMuetyJcCi2B8LZrAmVJjhcM,5002
|
|
58
71
|
modules/report_export.py,sha256=PKZNWrwK_x0XFpSjDzoI3-BoXYBnZ5VyQJ1V-nyhVj8,7622
|
|
72
|
+
modules/risk_scoring.py,sha256=Ls_PQ92wcgzAs6--6p6EAJXhoea4Knem0fGFbQVQHV0,7095
|
|
59
73
|
modules/siem_integration.py,sha256=GbG8sbyziItdQhRArNku7pV6yZW8jR9AQgUxU2dvJ98,18594
|
|
60
74
|
modules/sql_injection_db.py,sha256=x9VVIaXkykXo0zFmcPqIMk9gh_CF-Lrs9Ht2hrb9DLk,28945
|
|
61
75
|
modules/tool_orchestrator.py,sha256=6FwR-EMR-HIrLFFimWf5MUMf_AYIYPUuZPaL8oTUNVU,15868
|
|
@@ -70,9 +84,9 @@ risk_engine/example_usage.py,sha256=eM54wLDy3eZtiDGjOSZ4YrsCcEUzfVKjV_A_Pkn07is,
|
|
|
70
84
|
risk_engine/false_positive_engine.py,sha256=8u0wI3W25fsEq9eXfskUtcHfV3D2V6ElzVSgY_TAA-c,37961
|
|
71
85
|
risk_engine/scorer.py,sha256=BklUfMo26IaOYOJse-mjvY8NwjpbI4UEIlqZ6MhCmwU,10282
|
|
72
86
|
web_ui/backend/main.py,sha256=DTVmsvbDH7EvMmeohbcl8vYyKPyaLU8oHMvwWAqAF8k,15402
|
|
73
|
-
zen_ai_pentest-2.
|
|
74
|
-
zen_ai_pentest-2.
|
|
75
|
-
zen_ai_pentest-2.
|
|
76
|
-
zen_ai_pentest-2.
|
|
77
|
-
zen_ai_pentest-2.
|
|
78
|
-
zen_ai_pentest-2.
|
|
87
|
+
zen_ai_pentest-2.3.0.dist-info/licenses/LICENSE,sha256=C1sNTmgBbFuCm9vPCctuz6pQr4khkgqoQEMUE6cP-FY,1068
|
|
88
|
+
zen_ai_pentest-2.3.0.dist-info/METADATA,sha256=NVXfqeDZ_R_gY14Z6xITYXY753jBq8eMHf-JKecgIKE,28304
|
|
89
|
+
zen_ai_pentest-2.3.0.dist-info/WHEEL,sha256=wUyA8OaulRlbfwMtmQsvNngGrxQHAvkKcvRmdizlJi0,92
|
|
90
|
+
zen_ai_pentest-2.3.0.dist-info/entry_points.txt,sha256=qZRuz7yjZdEMiUrfflMiGzMUHUZWasT49-HNE-EKmTE,55
|
|
91
|
+
zen_ai_pentest-2.3.0.dist-info/top_level.txt,sha256=ExWeAuK-0xRpcWS7QsL8LEdPVJy1-Z-83qwOJ1-CERA,80
|
|
92
|
+
zen_ai_pentest-2.3.0.dist-info/RECORD,,
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|