Replace browser prompt() dialogs with proper floating modals for
Add Repository, Add Domain, and Add Network buttons. Replace
placeholder configureIntegration toast with real per-service config
modal (GitHub, GitLab, Jira, Slack, MCP). Add overlay click and
Escape key to close all modals. Fix Issues page to show real target
URL from run meta.json. Hide run history sidebar on asset pages.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UqW6BbQgqGkEDn3RYuCVoM
Collection import:
- parse_path() auto-detects file vs directory; parse_dir() walks a folder of
.json collections (Postman/OpenAPI/Swagger/HAR), merges and deduplicates
endpoints across all files. walkdir (already a dep) now used in collection.rs.
- CLI --collection, REPL /collection, pipeline injection, and web console all
accept a directory path transparently.
MCP server (neurosploit mcp):
- Expanded from 8 to 24 tools: added whitebox, greybox, host, aitest, mobile,
skills, pr, graph, audit, poc, traffic, assurance, agents, models, and
import_collection. neurosploit_run gained --collection and --objective params.
- Clients: Claude Code, Codex CLI, Cursor, Windsurf, VS Code — all documented
in tool descriptions.
Web console:
- Full sidebar navigation: Dashboard, Pentests, PR Reviews, Issues,
Repositories, Domains, Networks, Integrations, Settings. Chat removed.
- switchView() navigation system with lazy-loading per page.
- Pentests page: tabular list of all engagements with click-to-detail.
- PR Reviews page: filtered view of PR review runs.
- Issues page: aggregate findings across every run, filterable by severity.
- Repositories page: connect/manage source repos (persisted in .neurosploit/).
- Domains page: manage target domains for black-box scans.
- Networks page: manage network ranges for infra scanning.
- Integrations page: GitHub, GitLab, Jira, Slack, MCP status cards.
- Settings page: default model, environment, TypeSafe, network, proxy config.
- Server: CRUD API endpoints for repos/domains/networks/integrations/settings
with JSON file persistence in .neurosploit/ directory.
- New CSS: nav items, config cards, data tables, stat cards, integration cards,
form modals, accent buttons.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UqW6BbQgqGkEDn3RYuCVoM
The web console had the version hardcoded in three places (/api/meta, the
startup log, and the page title/badge), so it drifted from the CLI binary on
every release and had to be bumped by hand. Resolve it once at startup from
`neurosploit --version` and serve that through /api/meta; the sidebar badge and
the document title now follow it too. CLI and Web stay in lockstep — bump the
crate, rebuild, and the UA, the badge and the title all move together with no
web edit. Falls back to the package string only when the binary is missing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The verbose default User-Agent ("NeuroSploit/<ver> (authorized security
assessment; +https://...)") was getting blocked/fingerprinted by WAFs and
CDNs, causing false negatives and breaking scans. Shrink the default UA to a
plain `NeuroSploit/<ver>` token and move attribution to headers carried on
every request:
User-Agent: NeuroSploit/<ver>
Accept: */*
X-NeuroSploit-Scan: <ver>
New pipeline::default_scan_headers() is applied on every harness HTTP client
(probe.rs + the authz-matrix and subdomain-enum clients), so defenders still
see the scan via the header even after a browser-UA switch. The web console
shells the same binary and sets no UA override, so CLI and Web stay in sync on
the new default. Tests cover the plain UA and the attribution header.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Subscription/model and web-console fixes plus GLM and API-collection support
since 4.3.0:
- force subscription CLI login (strip stray ANTHROPIC/OPENAI keys); add
claude-opus-4-6
- scope: don't treat an endpoint's HTTP method as its host (findings no longer
wrongly quarantined; no bogus graph HOST nodes)
- web: resolve run-id to live job, collapse the pinned-leads header, parse live
findings/agent progress from decorated REPL output
- GLM 5.1/5.2/5.3 via API and via the Claude Code CLI (Z.ai devpack)
- import a Postman/OpenAPI/HAR collection as test surface (CLI/REPL/web)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add an API-collection field to the launch form (Creds panel): upload a
Postman/OpenAPI/Swagger/HAR file or point at a path on disk. Uploaded content
is written to a temp file and passed to the CLI via --collection (one-shot
modes) or /collection (REPL-backed run/greybox/whitebox), so the console
imports exactly the surface the CLI does. The picker previews the endpoint
count client-side.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Operators often already have the API mapped. Add a collection importer so a
Postman collection, an OpenAPI 3/Swagger 2 spec, or a HAR capture (JSON) is
parsed into a flat endpoint list and injected into every agent as known
in-scope surface — tested directly, alongside what recon finds, so documented
and auth-gated routes recon might miss are still covered.
- new harness module `collection` (format auto-detected by shape; de-duped;
render capped so a huge collection can't blow the prompt budget) + 6 tests
- RunConfig.api_collection; injected in operator_directives
- CLI: global `--collection <file>` on run/greybox/aitest, validated at launch
- REPL: `/collection <file>` (and `/import-api`), persisted in the session,
shown in /status, added to help + completion
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add GLM 5.1, 5.2 and 5.3 to the Z.ai provider (harness + web). Z.ai GLM can
now run two ways:
- plain API (OpenAI-compatible, api.z.ai/api/paas/v4) as before, and
- agentically through the Claude Code CLI pointed at Z.ai's Anthropic-compatible
endpoint (the Z.ai devpack / cline / zcode setup) when the subscription
toggle is on — chat_claude_stream injects ANTHROPIC_BASE_URL +
ANTHROPIC_AUTH_TOKEN from ZAI_API_KEY for the zai provider.
cli_binary_for("zai") -> claude; cli_login_status checks ZAI_API_KEY instead of
probing the Claude login; web verifies the key against z.ai's /models. GLM is
reasoning-heavy so it keeps the larger token ceiling. Covered by a new test.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The REPL decorates every streamed line with a leading glyph (" · ",
" ✗ ", " 🧪 testing "), so the server's anchored regexes for finding_json:
and "exploit <name> via … → N candidate(s)" never matched — findings and
per-agent progress reached the attack graph (built from findings.json) but
never the live Findings tab or the "what's being tested" panel.
Normalize each line (strip the leading decoration) before matching the
machine markers, and relax the anchors accordingly.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Lock in the bugs just fixed so they can't come back:
- scope: host-relative "METHOD /path" findings stay in scope; host_of strips
a leading HTTP method (covered in scope.rs).
- graph_memory: a finding endpoint's method never becomes a HOST node.
- models/rectify: claude-opus-4-6 is in the anthropic catalog and resolves to
itself instead of being corrected to claude-opus-4-8.
- repl: add /sandbox to ACCEPTED so the completable command is dispatchable
(every_completable_command_is_accepted_by_the_dispatch now passes).
Full suite: 491 passed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Agents report endpoints as "METHOD /path" (e.g. "GET /api/search"). host_of
split on whitespace/slash and returned the method ("get"/"post") as the host,
so host-relative findings were wrongly quarantined as out-of-scope and the
attack graph grew bogus HOST "get"/HOST "post" nodes — real findings vanished
from the report.
Add scope::strip_leading_method and apply it in host_of and in the graph
finding projection. A host-relative endpoint now resolves to an empty host
(kept in scope, relative to the authorized target) and a method+URL endpoint
resolves to the real host. Covered by new scope tests.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Subscription runs were failing with "Invalid API key · Fix external API
key": the claude/codex subscription CLIs inherit the harness environment,
and a stray ANTHROPIC_API_KEY/OPENAI_API_KEY (e.g. a stale key saved in the
web console) made them switch to API-key billing and reject the request.
Strip those vars before spawning the CLI so the subscription login is always
used on the CLI path (API-key users go through the HTTP path, unaffected).
Also register claude-opus-4-6 in the anthropic model list — both the harness
allowlist (so it's no longer auto-corrected to claude-opus-4-8) and the web
console provider list.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A /run that pins every lead (hundreds of agents) printed all of them inline
in the live header, flooding the viewport and pushing the Findings/Activity
tabs below the fold — the run looked stuck on one screen when it was simply
scrolled off. Collapse #livePinned to a count + preview with "+N more",
click to expand, capped height with scroll.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Opening a running run from the sidebar attached the live view with the
run-id (ns-…), but harness jobs are keyed by their own UUID — so
/api/exploit/<run-id> 404'd and the activity log stayed empty even though
recon/exploitation was running normally in the backend.
Add resolveJobId(run): maps a run-id to the owning live job via
/api/exploit (matching job.runId), falling back to the static detail view
when no live job exists. openRun now resolves before attaching.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Web console
- LLM API keys: Save now verifies the key with a cheap authenticated call per
provider (anthropic/openai/xai/gemini/deepseek/mistral/groq/together/openrouter/
moonshot/qwen/nvidia) and shows ✓ valid / ✗ rejected / • saved; new
POST /api/keys/verify. Keys still save when a provider isn't auto-verifiable.
- Leads: a single "category" dropdown filters the board to one category.
- Provider/Model row alignment fixed (stacked-group top margin no longer applies
inside a field-row).
- "own interceptor" renamed to "NeuroSploit Interceptor" in the proxy picker.
Installers
- setup.sh: v4.3.0; detects a package manager (apt/brew/dnf/pacman/apk) and
installs missing deps (curl, git, nmap, node; rustscan + typst via cargo);
optional launch at the end (NEUROSPLOIT_RUN=1 or a prompt). Skip with
NEUROSPLOIT_NO_DEPS=1.
- install.ps1: v4.3.0; installs deps via winget (Node, Nmap, Git; typst via
cargo); optional launch at the end.
- setup.bat (new): Windows CMD entry point that bootstraps install.ps1 (local or
from GitHub).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
REPL (parity with the one-shot run flags)
- /compliance <pci-dss,hipaa,soc2,gdpr> — map confirmed findings onto frameworks.
- /budget <eco|balanced|aggressive|unlimited> and /budget token <N> — reasoning
budget + token ceiling. Both applied to the run config at /run (black-box and
whitebox/greybox), mirroring --compliance / --budget / --token-limit.
- Added to help and Tab completion.
Web console
- The run/whitebox/greybox path (interactive REPL) now also emits the settings it
was silently dropping: compliance, budget mode, token limit, and vuln-class
focus — via the REPL's own /compliance, /budget and /class commands (capability,
in-scope, intercept, sandbox, OOB, scope file stay launch-level in authArgs).
- New "Focus vuln classes" field in the Scope step.
Docs
- TUTORIAL.md: /compliance and /budget in the REPL command reference.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Harness / CLI
- redact: credentials become $SECRET_n in every human-facing report
(md/html/json/sarif/typ, findings.md); findings.json & vault keep raw values.
- poc: `--only <id> --json` re-tests a single finding (powers the web Re-test).
- version bump 4.2.4 → 4.3.0 (Cargo, CLI banner, web).
Web console
- Attack graph replaces "Generative Attack Path Chaining": one tab, findings
ordered by kill-chain stage, click a finding to open it. Mounted in detail + live.
- Finding modal: Wire evidence — the real request/response pairs behind a finding
(baseline/attack, identity pair, matrix probes, oracle) with wire provenance,
the wire-check summary, and recorded flows on the same endpoint.
- Per-finding Re-test with dated history (reproduced/changed/gone/unverifiable).
- Transcript viewer in the Traces tab (navigable blocks; search spans all agents).
- Regression vs the previous run of the same target: new / recurring badges and a
"fixed since" banner.
- Chains tab: readable formatting (node refs as chips, relations as labels).
- Custom lead: describe-it (Claude writes it) OR paste your own agent/system
prompt (verbatim); remove a custom lead from the board.
- GDPR added to compliance mapping; LLM API keys tab clarified; Reasoning-budget
and Authorization layouts fixed; NeuroSploit logo added.
Docs / config
- README rewritten as a concise landing page; TUTORIAL.md updated to v4.3.0 with
new web/graph/Neo4j/wire sections and first-time configuration.
- .env.example: v4.3.0, Z.ai/Moonshot keys, Neo4j + graph-salt + capability env.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Harness
- graph_memory: typed attack graph (web + internal network) with Neo4j sync
over the HTTP API. Graph checkpoints run after recon, validation, each
chaining round and at the end. They direct agent selection and feed the
live chains, next moves and dependency todolist into every prompt.
- wire: every reported exchange is checked against recorded flows and
re-sent through the scope-guarded replay engine. A contradiction means the
finding cannot stand as confirmed.
- traces: each agent's transcript is shared with the others as a fenced,
structured digest (endpoints, params, error signatures, versions).
- authz_matrix: role x route authorization matrix validator, with
identity tiers in creds.
- deliverables: evidence custody, exploit-as-test (honest oracles only),
detection content and personas, with no credential leakage.
- redact: credentials quoted by agents become $SECRET_n in every
human-facing report (md/html/json/sarif/typ, findings.md). findings.json
and the vault keep raw values for re-testing.
- compliance: GDPR replaces LGPD.
- New agents: authorization_matrix, session_lifecycle, api_token_structure,
exposed_datastore, postgres_superuser_rce, meta/graph_reasoning.
Web console
- New tabs, mounted in both the detail and live views: Attack graph
(replaces Generative Attack Path Chaining), Chains, Dependencies,
Traffic, Traces, Deliverables.
- Wire/Status columns, KPIs, CSV export.
- Graph recompute / Neo4j push / Re-test actions, all through the CLI.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015v24fuCWxkanS31HDmaDB6
- Add AUTHORIZATION_PREAMBLE system prompt for operator-attested pentest authorization
- Docker socket auto-discovery across user/root boundaries (macOS Desktop/Colima/standard)
- Auto-sandbox for wildcard scope engagements
- Persist vote-rejected findings to rejected.jsonl for harness refinement
- Prosecutor phase: tokio timeout (120s) prevents infinite loop on quota exhaustion
- crt.sh timeout increased to 30s for large domains
- REPL /sandbox command for on-the-fly sandbox toggling
- Add claude-mythos-5-1 model to all provider lists
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Spin Kali up for the engagement, run tool-recon in it, let the LLM refine on top,
tear it down after.
- kali_provision_recon_tools(): installs the recon toolbox (subfinder/httpx/
katana/gau/waybackurls/nuclei/naabu/dnsx/assetfinder/gf/qsreplace/anew via
go install + apt) in the Kali sandbox on demand, idempotent, once per run.
- kali_tool_recon(): deterministic tool-recon phase — gau/waybackurls/katana URL
harvest + targeted nuclei (exposures/misconfig/takeovers, high-signal only) +
gf-flagged candidate URLs by class — over the live hosts, then folded into the
recon context so the LLM works on top of the tool output and confirms each.
Runs in the sandbox (--sandbox) or on host tools via recon_tool().
- Engine autostart: if the container engine is installed but not running, start
it automatically (colima start / open -a Docker / systemctl start docker /
podman machine start) and poll until up — a --sandbox run no longer fails just
because the daemon wasn't started. Clear guidance if it can't be started.
- Teardown: the Kali container is removed at the end of the run (override with
NEUROSPLOIT_KEEP_SANDBOX=1).
Version 4.2.4 across CLI/clap/web/README/TUTORIAL. 423 tests.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
RECON_SYS enriched with the concrete bug-bounty recon arsenal and tool pipelines
(subfinder/amass/assetfinder/crt.sh → httpx liveness → gau/waybackurls/katana/
gospider URL harvest → JS analysis & secret regexes → arjun/x8 params → gf vuln
patterns + qsreplace → ffuf/feroxbuster content discovery → naabu ports → dnsx/
nuclei takeovers → cloud bucket grep → targeted nuclei → chained pipeline),
passive-first and scope-respecting. Shared by the black-box run path, so it
applies identically to the CLI, the REPL and the web console.
Version bumped to 4.2.3 across CLI/clap/web/README/TUTORIAL. 423 tests.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
(1) Preflight now checks EVERY configured model, not just the primary — a 3-model
jury that silently collapses to 1 (others not logged in / no key) is now shown:
each model prints usable/needs-login/needs-key, with a '→ N/M models usable'
summary. Fixes 'I set 3 models and only opus ran'. (qwen is API-only: use
nous:qwen3.8-max for Hermes, or export DASHSCOPE_API_KEY.)
(2) Wildcard engagement (*.domain in scope) now gets a deterministic subdomain
fan-out before recon: enumerate via crt.sh + subfinder/amass (in the Kali sandbox
when --sandbox, else host), keep only IN-SCOPE hosts, probe liveness, drop
soft-404/parked catch-alls, rank (401/403 auth hosts first — flagged for bypass —
then interesting names admin/api/dev/staging), and fold the live list into the
test surface so the run tests the WHOLE authorized domain end-to-end, not just the
seed host. Scope-respecting: one lightweight GET per host, no degradation.
(3) recon_tool() runs a recon tool in the Kali sandbox or on the host — the basis
for tool-powered recon.
423 tests passing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A copy-paste full-surface focus string (all web classes, prioritise authed
surface + subdomains, chain to impact, reproducible receipt) and an
objective-vs-focus note; the engagement template now carries the broad
focus/objective in its one-file config.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Wildcard target from a scope-file (target: "*.nasa.gov") was probed literally
→ "builder error" / target unreachable. It's now reduced to the apex
(https://nasa.gov) for the seed, while the scope keeps *.nasa.gov so subdomain
enumeration stays authorized. (The /target command already did this; the
engagement-file meta path didn't.)
- Provenance was a OnceLock ("first run wins"), so in the REPL every run after
the first minted markers and the provenance line with the FIRST run's id
(nasa run showing a rockstargames id). Now a RwLock that rebinds per run —
each engagement gets its own id; the build fingerprint stays stable.
- Nous/Hermes: qwen3.8-max / qwen3.8-omni-flash added to the provider list so
`nous:qwen3.8-max` routes qwen through the Hermes portal (model name passes
through `hermes chat -m <model> --provider nous`).
- Black-box `run` now gets a broad DEFAULT objective when none is set: a
comprehensive WEB assessment grounded in OWASP Top 10 / ASVS / WSTG / CWE that
traverses every applicable web vuln class then goes deep — web-only (this path
loads only web vuln agents; mobile/binary are separate modes), so it never
drifts into mobile/exe.
423 tests passing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A copy-paste recipe (cross-model jury, /ua browser, /recon 4, scope-file +
authorization, natural-language focus on the high-value surface, /run) plus a
table of high-value knobs and an honest benchmark reality-check, so people run
NeuroSploit more effectively against real targets.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
While a run streams, every printed line makes rustyline redraw the input line.
The high-volume tool echoes (exec/net/read — the ⌘/🌐/📄 lines, dozens/sec during
recon/curl bursts) flooded the terminal so arrow keys and backspace felt stuck
while typing. Those lines are now rate-limited to ~1/200ms in the live feed (they
remain in full via /logs); findings, phase changes, votes and notices still print
immediately. Editing stays responsive during a run.
(Note: the /model-rewrite the user hit was the OLD binary — v4.2.2 keeps the exact
models typed; verified anthropic:claude-opus-4-8 + openai:gpt-5.6-sol are kept.)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
/show showed only the policy profile ('web') and hid the actual hard-scope
allowlist, the authorization reference, the pinned agents (/class, /only) and
research mode — so an operator couldn't confirm what was really configured.
Now shows: authorized (the enforced hard-scope hosts, flagged when pinned),
guardrails (rate/accounts/destructive/excludes), authz ref, pinned agent list,
and research in opts.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Field feedback: real, reproducible findings (missing HSTS, insecure cookie flags,
internal IP leaked in a header) were being down-rated/dropped by the adversarial
opinion-vote. The user's rule: never discard something real; another person must
be able to reproduce the same finding.
Validation:
- has_http_receipt(): a finding whose proof is a captured HTTP response (status
line / security headers / Set-Cookie / a header the class is proven by) or a
file:line citation is REPRODUCIBLE by definition.
- validate(): a finding unanimously rejected by the vote but carrying such a
receipt is NO LONGER dropped — it is kept as needs-review (capped to what the
receipt alone proves), because "the response lacks HSTS" is a fact, not a
story. grounded_receipt() now also recognizes an in-prose HTTP receipt.
- reproducibility: a kept finding at a URL with no explicit repro steps gets a
minimal pasteable `curl -i` so anyone can reproduce the exact finding.
Also:
- /pocs (aliases /poc /evidence /artifacts): list a run's synthesized/written
PoC + evidence files with their paths (was: "unknown command /pocs").
- version bumped to 4.2.2 across CLI/clap/web; stale v4.2.1/v4.1.0 labels fixed.
423 tests passing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Field feedback from a live run (only SQLi being hit, auth flows skipped, scanner
UA behind a CDN):
- EXPLORE_DOCTRINE injected into every exploit prompt: the agent's named class is
a starting point, not a cage. It maps what the app actually does and reports
ANY class it can prove — with authentication/identity (login, signup, password
reset, MFA, OAuth/OIDC/SAML, JWT, session) as a first-class target, plus
business-logic/multi-step flows and both client- and back-end surfaces. When
its own class yields nothing, it pivots instead of idling.
- Selection (SELECT_SYS) now covers the surface instead of collapsing into one
family: diverse set, MUST include auth/identity agents when any auth/OAuth/JWT
surface is present, include business-logic/access-control on authed/multi-step
flows, cover client + back-end when both exist.
- UA quality: /ua browser sets a realistic Chrome UA (attribution stays in the
X-NeuroSploit-Scan header) for accuracy behind a WAF/CDN, where a self-declaring
scanner UA gets blocked/challenged and causes false negatives; /ua identify
keeps the transparent NeuroSploit UA. The UA doctrine now tells agents to
compare both early and switch to the browser UA if responses differ.
422 tests passing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- /scope-file now reads optional engagement keys from the SAME YAML (target,
models, focus, objective, authorization, classes) so one file defines the
whole engagement, not just scope. examples/scopes/nasa.yaml and
engagement.example.yaml show the keys.
- When importing a scope (/scope-file) or declaring one (/authorize), a target
left over from a previous session that falls OUTSIDE the new scope is reset to
a host inside it (was: silently kept, then denied on /run — the "nothing
changed" confusion). Added scope_seed_target() + in_hard_scope() check.
- UI/help strings are English; the natural-language REPL still accepts input in
any language (the two example lines are now English).
- README + TUTORIAL updated: new REPL commands (/authorize, /scope-file, /class,
/research, /quick, /authorization, /guardrail), a "Scope — three ways" section
with the one-file YAML, version/counts refreshed to 4.2.1 / 480 agents.
422 tests passing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Hard scope stays the safety boundary (you must say what you're allowed to test),
but setting it is now frictionless for a normal client pentest where authorization
comes from a signed SOW/contract — no bug-bounty program or capability token.
- /authorize <host|*.dom|cidr|url> ... (aliases /grant, /inscope-set): set the
entire authorized scope in one line (multiple entries), pins it so /target
won't re-derive, and seeds the target so /run works immediately. The operator
asserts written authorization for the listed assets; guardrails (rate,
accounts, destructive) remain tunable via /guardrail.
- examples/scopes/engagement.example.yaml — neutral direct-engagement template
(no program framing): fill hard scope from the SOW, guardrails documented as
yours to tune (e.g. allow destructive in a staging env, raise rate for a lab).
The frictionless path already worked (/target x -> authorized against x); this
makes the multi-asset direct engagement a single clear command. 422 tests.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- /scope-file <path> (aliases /scopefile, /import-scope): import a ready scope
config (hard allowlist + exclusions + guardrails) in the REPL — one step to
"scope set correctly", instead of typing /inscope repeatedly. Pins the scope.
- scope_pinned: once scope is set explicitly (scope-file / /inscope / capability),
/target no longer re-derives the scope from the target, so an imported
allowlist is not clobbered by picking a target.
- examples/scopes/rockstargames.yaml and examples/scopes/nasa.yaml — ready
TEMPLATES scoped to *.rockstargames.com / *.nasa.gov with conservative,
bounty/VDP-safe guardrails (no destructive verbs, no mass accounts, low rate,
forbidden payloads) and a clear "verify the program's current in/out-of-scope
before running" banner. Both parse and enforce; subdomain enumeration happens
inside the wildcard boundary.
422 tests passing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Three improvements prompted by a real bug-bounty run:
1. /class idor,sqli,xss,ssrf — focus a run on specific vulnerability CLASSES.
Expands each class to the matching library agents (by name/title/CWE) and
pins them, so /run tests exactly those classes and skips recon-based
selection. Friendlier than naming each agent via /only. Known aliases cover
idor/bola, sqli, xss, ssrf, csrf, ssti, xxe, rce, lfi, auth/jwt, graphql,
race, upload, cors, prototype-pollution, smuggling, and more.
2. /authorization <url> (aliases /authz, /program) — declare the engagement's
authorization (e.g. https://hackerone.com/<program>). Recorded and added to
the rules-of-engagement context so the run is framed as the authorized test
it is, which reduces false model refusals on in-scope bounty targets. It does
NOT widen scope — the grant still comes from /target, /scope-file or a
capability — and the RoE context tells agents to keep within the program's
rules (no DoS/mass-account-creation/out-of-scope; report those as leads).
3. Model-refusal detection: when an agent DECLINES a technique (safety/RoE
pushback, e.g. "can't run mass account creation at a production service"),
the harness now says so plainly instead of hiding it as "0 parseable
findings (malformed JSON)". The operator sees WHY an agent found nothing.
422 tests passing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Two reported bugs:
1) A scope left over from a previous session persisted in the project session and
kept denying every new target (DENY_TARGET_OUTSIDE_GRANT ... scope *.example.com
even after /target zoom.us). With no verified capability, /target now re-derives
the authorized scope from the new target (preserving excludes + guardrails), so
the target you pick is the target you test — same model as `neurosploit run <url>`.
2) A wildcard target (`*.zoom.us`) now authorizes the apex AND all subdomains and
seeds recon with the apex (a literal `*.zoom.us` has no DNS record to probe), so
subdomain enumeration happens inside the wildcard scope. Applied in both the REPL
/target and the one-shot `run` path.
Also: the run banner and clap about showed v4.1.0 — now use CARGO_PKG_VERSION / 4.2.1.
421 tests passing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
New --research mode for whitebox/greybox (REPL /research, web 🔬 checkbox, or
auto-detected from natural-language focus/objective in PT/EN). Steers the source
review to find a NOVEL, CVE-reportable issue instead of a known one:
- WHITEBOX_RESEARCH_DOCTRINE: pin version/commit; research known CVEs/advisories
(SECURITY.md, CHANGELOG, GHSA, NVD, git history) to de-duplicate; patch-diff /
n-day->0-day variant analysis (incomplete fixes, bypasses of a new check,
sibling sinks, reintroductions); strict novelty gate (each finding states
novel-why + checked-against); benign PoC + dynamic confirm on greybox.
- RunConfig.research + is_research_intent(); injected in run_whitebox and the
greybox code-review half.
- 6 research skills (code/): known_cve_dedup, patch_diff_variant,
attack_surface_map, source_to_sink_taint, logic_authz_flaw,
dependency_nday_reachability.
- Methodology modeled on a real AppSec-research workflow (no specifics copied).
479 agents, 421 tests.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The REPL banner and HTML-report footer hardcoded v4.2.0 while the crate is 4.2.1.
Both now interpolate env!("CARGO_PKG_VERSION"); web title/sidebar/comments set to
4.2.1. --version already read the crate version.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds robust AD pentest coverage spanning the full kill chain (initial access →
enumeration → exploitation → lateral movement → privilege escalation →
persistence → pivoting), with concrete tooling, per-technique decision points,
benign-proof-only guidance, lockout/state awareness, and chaining hooks. All
GENERIC — no lab-specific hosts/IPs/creds/flags; works in any AD environment.
New infra/ skills: ad_recon_enum, ad_bloodhound_paths, ad_llmnr_poisoning,
ad_ntlm_relay, ad_password_spray, ad_kerberos_delegation, ad_adcs_esc,
ad_pth_ptt, ad_coerce_auth, ad_critical_cve (Zerologon/noPac), ad_smb_share_hunt,
ad_laps_gmsa_read, ad_gpo_abuse, ad_dpapi_looting, ad_trust_abuse,
ad_persistence_review, ad_mssql_abuse. Enriched: ad_kerberoasting, ad_asreproasting,
ad_dcsync, ad_acl_privesc, ad_default_creds, windows_priv_esc.
New chains/: chain_ad_web_to_forest_root, chain_ad_rbcd_s4u_to_adcs,
chain_ad_coerce_relay_adcs, chain_ad_kerberoast_to_domain,
chain_ad_mssql_linked_pivot, chain_ad_trust_cross_forest, chain_ad_local_to_domain.
attack_graph: map CWE-294/295/1392/269 to OWASP/MITRE/stage + CVSS bands so AD
findings grade and place in the kill chain correctly. 473 agents, 421 tests.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Parse per-agent activity from the stream (launching agent / exploit·analyze·test
<name> via <model> -> N candidate(s) / failed) into a status map, surfaced in the
live view as a grid of chips coloured by state (pending/running/found/done/failed)
with a per-agent finding count and a running/done tally. Answers 'what is it
testing right now' at a glance; resets per engagement.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The REPL-backed path (run/whitebox/greybox) spawns `neurosploit` with NO
subcommand, so only global flags are valid in argv — but authArgs() emitted
run-subcommand flags there (--environment, --policy, --in-scope, --budget,
--compliance, --revalidate-poc, --token-limit, --deep-test-limit, --order,
--sample-per-route, --scope-file). clap aborted on the first one
("unexpected argument '--environment'"), so the engagement died at launch and
the live view sat empty. authArgs now emits only the real global flags with
their global names (--session-environment / --session-in-scope / --session-policy,
plus --capability-token/--transport/--oob-*/--sms/--typesafe/--decision-backend/
--intercept/--sandbox); run-only knobs ride the REPL script or defaults.
Also:
- sidebar: a disk run whose status says "running" but has no live job is shown
as "interrupted", not "running" (no more stale RUNNING entries); brand-new
in-memory jobs are injected so an engagement appears the moment it starts;
new "Interrupted" group; clicking a running/interrupted row attaches the live
stream or offers resume.
- stop: robust now — graceful /stop then SIGTERM/SIGKILL fallback, a second
press escalates, a job whose child already exited is marked done so the UI
stops showing it as running.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The runs/evidence and pocs folders were always empty on the API-key path: there
the model only returns findings JSON and never executes a tool to write files,
so nothing populated them (they were only ever written by the subscription
agentic CLIs). The harness already holds the structured evidence (evidence_data:
baseline/attack/identity exchanges, marker) and the payload/endpoint.
synthesize_pocs_and_evidence() now writes, per finding and without overwriting
anything an agent already produced:
- evidence/<slug>.md — the request/response proof (baseline/attack/identity
pairs, marker, callback/browser flags, notes), or the prose receipt as fallback
- pocs/<slug>.md — a runnable curl repro from the recorded request(s),
incl. the cross-identity pair for BOLA/IDOR; falls back to endpoint+payload
and cites the PoC path back into the finding's evidence. Runs in the main
pipeline after evidence collection; idempotent. 421 tests passing.
Closes#44
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The one-shot `neurosploit run|whitebox|greybox <target>` path dropped the
pause/resume handles and never read stdin, so when the pool parked on quota/auth
exhaustion it printed "type /continue …" into a void — nothing accepted it and
the process hung forever on the parked task; only Ctrl-C worked. This is exactly
the "can't /continue, it's stuck" a run that exhausts during recon hits.
run_mode now, at a real terminal, reads stdin and accepts:
/continue [provider:model] resume (optionally switching model)
/model provider:model switch provider/model, then resume
Ctrl-C still stops and offers a partial report; it also clears the pause so a
parked task can't swallow the interrupt. Over a pipe (CI/web) stdin is skipped.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A single out-of-credit event (Anthropic's 400 "credit balance too low", which
is_exhaustion correctly classifies) made every in-flight parallel agent print
its own "PAUSED — /continue" line, flooding the console with identical notices.
Now only the agent that wins the paused false->true transition emits the notice;
the rest park quietly. Resume clears the flag so the next episode notices again.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Billing concern: a full run with 2-3 voters, deep chaining and exhaustive recon
burns a lot of tokens. --quick is one switch for a fast, cheap pass:
one voter, one chain round, light recon (intensity 1), ≤6 agents, eco budget.
Dropping voting from 3 models to 1 is the biggest saver.
- CLI: --quick on run/whitebox/greybox (apply_quick, applied last so it wins)
- REPL: /quick (aliases /economy /eco), listed in help + completion
- web: ⚡ Quick-mode checkbox in the wizard -> /quick in the REPL script
- README: documented in the flags table
- 420 tests passing
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The web server's job state was in-memory only, so a node restart/crash lost the
live run (the harness still checkpointed to .neurosploit/active_run.json, but
the console couldn't see or re-attach it).
- persist each job to .neurosploit/web-jobs/<id>.json (snapshot + feed tail +
sanitized launch params; NO api keys or creds contents), throttled, on
findings/phase/done
- loadPersistedJobs() on boot: a job that was live becomes `interrupted`, and
`resumable` when it was a REPL-backed run/whitebox/greybox
- POST /api/exploit/:id/resume: relaunch the REPL (NEUROSPLOIT_AUTO_RESUME=1),
which recovers the on-disk checkpoint and /continue's it, carrying findings
forward; reuses the same job id so the live view resumes streaming
- API-key jobs need the provider key re-entered after a full restart (kept only
in memory) — resume returns a clear 409 saying which; subscription resumes clean
- frontend: boot offers a dismissible "N interrupted run(s) — Resume" banner
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
