mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-08-15 14:10:22 +02:00
Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 CyberSecurityUP
|
e5c607f467 | ||
|
CyberSecurityUP
|
ea61ab1fdf | ||
|
CyberSecurityUPandClaude Opus 4.8
|
e9f81c164d | ||
|
CyberSecurityUPandClaude Opus 4.8
|
0a181782a4 | ||
|
CyberSecurityUPandClaude Opus 4.8
|
669ab44cef | ||
|
CyberSecurityUPandClaude Opus 4.8
|
64decada3e |
@@ -1,4 +1,4 @@
|
||||
<h1 align="center">🧠 NeuroSploit v3.5.2</h1>
|
||||
<h1 align="center">🧠 NeuroSploit v3.5.4</h1>
|
||||
|
||||
<p align="center">
|
||||
<a href="https://github.com/JoasASantos/NeuroSploit/stargazers"><img src="https://img.shields.io/github/stars/JoasASantos/NeuroSploit?style=for-the-badge&logo=github&color=8b5cf6" alt="Stars"></a>
|
||||
@@ -8,7 +8,7 @@
|
||||
</p>
|
||||
|
||||
<p align="center">
|
||||
<img src="https://img.shields.io/badge/Version-3.5.2-blue?style=flat-square">
|
||||
<img src="https://img.shields.io/badge/Version-3.5.4-blue?style=flat-square">
|
||||
<img src="https://img.shields.io/badge/Harness-Rust%20%7C%20tokio-e6b673?style=flat-square">
|
||||
<img src="https://img.shields.io/badge/License-MIT-green?style=flat-square">
|
||||
<img src="https://img.shields.io/badge/MD%20Agents-329-red?style=flat-square">
|
||||
@@ -24,12 +24,14 @@
|
||||
>
|
||||
> 📖 **New here? Read the [full Tutorial & User Guide →](TUTORIAL.md)** — every mode, flag, config and example explained.
|
||||
|
||||
> 🆕 **New in v3.5.2 — Exploitation Depth & Report Hygiene:** a **DEPTH doctrine**
|
||||
> makes the engine *use* what it finds (exposed → exploited), **chain** findings
|
||||
> across modules, decode/fingerprint artifacts → CVEs, and **audit tokens** (JWT
|
||||
> alg-confusion / weak HS256 secrets). A deterministic post-pass **calibrates
|
||||
> severity to proven impact** and **consolidates duplicated hygiene** findings.
|
||||
> See [RELEASE.md](RELEASE.md).
|
||||
> 🆕 **New in v3.5.4 — Robust attack chaining + fewer false positives:** a
|
||||
> multi-round, decision-driven **post-exploitation** engine takes each confirmed
|
||||
> foothold and expands new directions (cred reuse, privesc, lateral movement,
|
||||
> exfil, new surface), carrying **loot** forward across rounds (`--chain-depth`).
|
||||
> Validation is now **severity-aware** (High/Critical need ≥2 validators & ≥2/3
|
||||
> agreement) with an **adversarial refute pass** that drops findings that can't
|
||||
> withstand a skeptic.
|
||||
> *(v3.5.3 added GitHub/GitLab/Jira **[integrations](TUTORIAL-INTEGRATION.md)**; v3.5.2 the DEPTH doctrine + report-hygiene pass — see [RELEASE.md](RELEASE.md).)*
|
||||
|
||||
---
|
||||
|
||||
@@ -149,6 +151,41 @@ No login? Use an **API key** instead — see [Authentication](#authentication--r
|
||||
|
||||
---
|
||||
|
||||
## 🔌 Integrations (GitHub · GitLab · Jira)
|
||||
|
||||
Wire NeuroSploit into your SDLC. Toggle from the REPL (`/integrations`) or the CLI
|
||||
(`neurosploit integrations enable github|gitlab|jira`). **Tokens are never stored**
|
||||
— only the *name* of the env var is saved; the value is read from your environment.
|
||||
|
||||
```bash
|
||||
export GITHUB_TOKEN=ghp_... # PAT with `repo` scope (private repos)
|
||||
neurosploit integrations enable github
|
||||
|
||||
# Review a Pull Request's code (clones the PR head, white-box) and comment back:
|
||||
neurosploit pr digininja/DVWA 42 --subscription --model anthropic:claude-opus-4-8 --comment
|
||||
|
||||
# Watch a branch and re-review on every new commit:
|
||||
neurosploit watch myorg/private-app --branch main --subscription --model anthropic:claude-opus-4-8
|
||||
|
||||
# Private GitLab repo (token-injected clone) — works in whitebox/greybox:
|
||||
export GITLAB_TOKEN=glpat-... ; neurosploit integrations enable gitlab
|
||||
neurosploit whitebox https://gitlab.com/myorg/private-svc --subscription --model anthropic:claude-opus-4-8
|
||||
|
||||
# Open a Jira card per finding (any engagement):
|
||||
export JIRA_EMAIL=you@org.com JIRA_API_TOKEN=... # set base/project once: /integrations setup jira
|
||||
neurosploit whitebox https://github.com/myorg/app --jira --subscription --model anthropic:claude-opus-4-8
|
||||
```
|
||||
|
||||
| Integration | What you get | Env vars |
|
||||
|-------------|--------------|----------|
|
||||
| **GitHub** | private clone · `pr` review + comment · `watch` branch | `GITHUB_TOKEN` |
|
||||
| **GitLab** | private clone for whitebox/greybox | `GITLAB_TOKEN` |
|
||||
| **Jira** | one card per finding (`--jira`) | `JIRA_EMAIL`, `JIRA_API_TOKEN` |
|
||||
|
||||
📖 Step-by-step setup for each tool: **[TUTORIAL-INTEGRATION.md](TUTORIAL-INTEGRATION.md)**.
|
||||
|
||||
---
|
||||
|
||||
## Build
|
||||
|
||||
```bash
|
||||
|
||||
+114
@@ -1,3 +1,117 @@
|
||||
# NeuroSploit v3.5.4 — Release Notes
|
||||
|
||||
**Release Date:** July 2026
|
||||
**Codename:** Robust Attack Chaining & False-Positive Reduction
|
||||
**License:** MIT
|
||||
**Credits:** Joas A Santos & Red Team Leaders
|
||||
|
||||
---
|
||||
|
||||
## TL;DR
|
||||
|
||||
v3.5.4 makes NeuroSploit both **deeper** and **more precise**: a real multi-round
|
||||
**post-exploitation attack-chaining** engine that expands each foothold in new
|
||||
directions, plus stronger **false-positive** controls so what it reports is
|
||||
trustworthy.
|
||||
|
||||
## Attack chaining (robust, decision-driven)
|
||||
|
||||
Replaces the old single-shot chainer with **`attack_chain()`** — an iterative,
|
||||
per-foothold pivot engine:
|
||||
|
||||
- **Per-foothold decisions.** Each round takes the newest confirmed footholds
|
||||
(best-first, capped per round) and, for **each one**, an agent decides which
|
||||
directions to expand and proves new impact: **post-exploitation** (loot
|
||||
creds/keys/config/source), **credential reuse**, **privilege escalation**
|
||||
(horizontal & vertical), **lateral movement** to adjacent services/hosts,
|
||||
**data exfiltration**, and **new attack surface** the foothold exposes.
|
||||
- **Loot carried forward.** Credentials/tokens/hosts/endpoints discovered in one
|
||||
round are passed to later rounds and reused (agent returns
|
||||
`{"findings":[...],"loot":[...]}`), so the engine genuinely pivots in new
|
||||
directions instead of re-testing the same spot.
|
||||
- **No pivoting off false positives.** Each round's new findings are validated
|
||||
before they become the next round's footholds.
|
||||
- **Convergence.** Runs up to `chain_depth` rounds **or** stops when a round finds
|
||||
nothing new (loop-until-dry).
|
||||
- **Control.** New `RunConfig.chain_depth` (default **2**) and a `--chain-depth`
|
||||
flag on every engagement command (`0` disables).
|
||||
|
||||
## False-positive reduction
|
||||
|
||||
- **Robust verdict parsing** (`pool::parse_verdict`) — whitespace-insensitive,
|
||||
checks explicit rejection first, counts only explicit confirmations; ambiguous
|
||||
replies are *not* counted as confirmed. Replaces the fragile exact-JSON /
|
||||
loose-`yes` matching.
|
||||
- **Severity-aware quorum** (`pool::quorum_confirmed`) — **High/Critical now need
|
||||
≥2 validators AND ≥2/3 agreement** (a single vote can no longer confirm a
|
||||
Critical); lower severities need a strict majority. Single-model panels fall
|
||||
back to majority so they aren't nuked.
|
||||
- **Adversarial refute pass** — every confirmed High/Critical is re-examined by a
|
||||
skeptical panel that assumes false-positive; findings that can't withstand a
|
||||
majority of skeptics are dropped.
|
||||
- **Stronger validator prompt** with an explicit false-positive checklist
|
||||
(reflected-not-executed, version/banner guesses, self-XSS, error-as-injection,
|
||||
thin evidence, inflated severity).
|
||||
|
||||
## Notes
|
||||
|
||||
- Additive and back-compatible; defaults keep behavior sensible if you change
|
||||
nothing. Unit tests cover verdict parsing, quorum, and report-hygiene logic.
|
||||
|
||||
---
|
||||
|
||||
# NeuroSploit v3.5.3 — Release Notes
|
||||
|
||||
**Release Date:** June 2026
|
||||
**Codename:** Integrations (GitHub · GitLab · Jira)
|
||||
**License:** MIT
|
||||
**Credits:** Joas A Santos & Red Team Leaders
|
||||
|
||||
---
|
||||
|
||||
## TL;DR
|
||||
|
||||
v3.5.3 plugs NeuroSploit into your SDLC: review **private** GitHub/GitLab repos
|
||||
and **Pull Requests**, **watch** a branch and re-review on every commit, and open
|
||||
a **Jira card per finding** — all toggleable via a new `/integrations` command.
|
||||
|
||||
## Highlights
|
||||
|
||||
- **GitHub integration**
|
||||
- **Private repos**: when enabled, `whitebox` / `greybox --repo` / `tui --repo`
|
||||
inject your `GITHUB_TOKEN` into the clone URL (token never printed/stored).
|
||||
- **`neurosploit pr <owner/repo> <number>`** — clones the **PR head**
|
||||
(`refs/pull/N/head`), runs a white-box review, optionally **posts a summary
|
||||
comment** back on the PR (`--comment`) and/or **opens Jira cards** (`--jira`).
|
||||
- **`neurosploit watch <owner/repo> --branch <b> --interval <s>`** — polls the
|
||||
branch and runs a white-box review **each time a new commit lands**.
|
||||
- **GitLab integration** — private clone (token-injected) for `whitebox`/`greybox`
|
||||
against `gitlab.com` or a self-hosted base.
|
||||
- **Jira integration** — `--jira` on any engagement (or `pr`/`watch`) opens **one
|
||||
card per finding** (summary, severity, CVSS, CWE, location, PoC, evidence,
|
||||
remediation) in your project via the Jira REST API.
|
||||
- **`/integrations` (REPL) + `neurosploit integrations` (CLI)** — `show`,
|
||||
`enable`/`disable <github|gitlab|jira>`, and `setup <jira|gitlab|github>`
|
||||
(interactive). Config persists to `<project>/.neurosploit/integrations.json`.
|
||||
**Secrets are never stored** — only the env-var *name* is saved; values come
|
||||
from the environment at use time.
|
||||
- New harness module `integrations` + app commands `pr` / `watch` /
|
||||
`integrations`, plus a `--jira` flag on `run` / `whitebox`.
|
||||
|
||||
## Setup
|
||||
|
||||
Step-by-step for tokens, scopes and configuration is in
|
||||
**[TUTORIAL-INTEGRATION.md](TUTORIAL-INTEGRATION.md)** and summarized in the README.
|
||||
|
||||
## Notes
|
||||
|
||||
- Additive and back-compatible: all existing modes/flags are unchanged; if no
|
||||
integration is enabled the behavior is identical to v3.5.2.
|
||||
- Tokens use env vars: `GITHUB_TOKEN`, `GITLAB_TOKEN`, `JIRA_EMAIL` +
|
||||
`JIRA_API_TOKEN` (names configurable per integration).
|
||||
|
||||
---
|
||||
|
||||
# NeuroSploit v3.5.2 — Release Notes
|
||||
|
||||
**Release Date:** June 2026
|
||||
|
||||
@@ -0,0 +1,210 @@
|
||||
# NeuroSploit — Integrations Setup Guide (v3.5.3)
|
||||
|
||||
Connect NeuroSploit to **GitHub**, **GitLab** and **Jira** so it can review private
|
||||
repositories and Pull Requests, watch branches for new code, and file a Jira
|
||||
**card per vulnerability**.
|
||||
|
||||
> ⚠️ **Authorized testing only.** Use integrations against code/projects you own or
|
||||
> are explicitly permitted to test.
|
||||
|
||||
---
|
||||
|
||||
## Table of contents
|
||||
1. [How it works (config & secrets)](#1-how-it-works)
|
||||
2. [The `/integrations` command](#2-the-integrations-command)
|
||||
3. [GitHub](#3-github)
|
||||
4. [GitLab](#4-gitlab)
|
||||
5. [Jira](#5-jira)
|
||||
6. [Recipes](#6-recipes)
|
||||
7. [Troubleshooting](#7-troubleshooting)
|
||||
|
||||
---
|
||||
|
||||
## 1. How it works
|
||||
|
||||
- Integration config is **per project**, stored at
|
||||
`<cwd>/.neurosploit/integrations.json`.
|
||||
- **Secrets are never written to disk.** The config only stores the **name** of
|
||||
the environment variable that holds each token (e.g. `GITHUB_TOKEN`). The real
|
||||
value is read from your environment at use time. Keep tokens in your shell /
|
||||
secret manager, not in the repo.
|
||||
- Enable/disable per integration; each is independent.
|
||||
|
||||
Default env-var names (configurable):
|
||||
|
||||
| Integration | Token env var(s) |
|
||||
|-------------|------------------|
|
||||
| GitHub | `GITHUB_TOKEN` |
|
||||
| GitLab | `GITLAB_TOKEN` |
|
||||
| Jira | `JIRA_EMAIL` + `JIRA_API_TOKEN` |
|
||||
|
||||
---
|
||||
|
||||
## 2. The `/integrations` command
|
||||
|
||||
In the **REPL** (`neurosploit` with no args):
|
||||
|
||||
```
|
||||
/integrations # show status of all three
|
||||
/integrations enable github # toggle on (also: gitlab | jira)
|
||||
/integrations disable jira # toggle off
|
||||
/integrations setup jira # interactive: base URL, project key, issue type
|
||||
/integrations setup gitlab # set the GitLab base (gitlab.com or self-hosted)
|
||||
/integrations setup github # set the API base (change only for GitHub Enterprise)
|
||||
```
|
||||
|
||||
From the **CLI**:
|
||||
|
||||
```bash
|
||||
neurosploit integrations # show status
|
||||
neurosploit integrations enable github # enable / disable <github|gitlab|jira>
|
||||
```
|
||||
|
||||
`show` prints whether each is on and whether the token env var is currently set
|
||||
(`✓ token` / `⚠ token env not set`).
|
||||
|
||||
---
|
||||
|
||||
## 3. GitHub
|
||||
|
||||
**a. Create a token.** GitHub → *Settings → Developer settings → Personal access
|
||||
tokens*. A classic PAT with the **`repo`** scope (read access to the private repos
|
||||
you'll test) is enough. Fine-grained tokens also work (grant *Contents: Read* and,
|
||||
for PR comments, *Pull requests: Read & write*).
|
||||
|
||||
**b. Export it and enable:**
|
||||
```bash
|
||||
export GITHUB_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxx
|
||||
neurosploit integrations enable github
|
||||
```
|
||||
|
||||
**c. What you can now do:**
|
||||
|
||||
- **Clone & review a private repo** (token is injected into the clone URL,
|
||||
never printed):
|
||||
```bash
|
||||
neurosploit whitebox https://github.com/myorg/private-app \
|
||||
--subscription --model anthropic:claude-opus-4-8 -v
|
||||
```
|
||||
- **Review a Pull Request's code** — clones the PR head (`refs/pull/N/head`):
|
||||
```bash
|
||||
neurosploit pr myorg/private-app 128 \
|
||||
--subscription --model anthropic:claude-opus-4-8 --comment
|
||||
```
|
||||
- `--comment` posts a Markdown findings summary back on the PR.
|
||||
- `--jira` also opens a card per finding (needs Jira configured).
|
||||
- **Watch a branch** and re-review on every new commit:
|
||||
```bash
|
||||
neurosploit watch myorg/private-app --branch main --interval 300 \
|
||||
--subscription --model anthropic:claude-opus-4-8
|
||||
```
|
||||
It polls the branch tip via the GitHub API and runs a white-box review whenever
|
||||
the SHA changes (Ctrl-C to stop).
|
||||
|
||||
**GitHub Enterprise:** `/integrations setup github` and set the API base to your
|
||||
GHE URL (e.g. `https://ghe.mycorp.com/api/v3`).
|
||||
|
||||
---
|
||||
|
||||
## 4. GitLab
|
||||
|
||||
**a. Create a token.** GitLab → *Preferences → Access Tokens* (or a project/group
|
||||
token) with the **`read_repository`** scope (add `api` if you want more later).
|
||||
|
||||
**b. Export it and enable:**
|
||||
```bash
|
||||
export GITLAB_TOKEN=glpat-xxxxxxxxxxxxxxxxxxxx
|
||||
neurosploit integrations enable gitlab
|
||||
# self-hosted? set the base:
|
||||
# /integrations setup gitlab → https://gitlab.mycorp.com
|
||||
```
|
||||
|
||||
**c. Review a private GitLab repo** (token-injected clone, works in whitebox &
|
||||
greybox):
|
||||
```bash
|
||||
neurosploit whitebox https://gitlab.com/myorg/private-svc \
|
||||
--subscription --model anthropic:claude-opus-4-8 -v
|
||||
```
|
||||
|
||||
> To review a specific Merge Request, check out its source branch and point
|
||||
> `whitebox` at that clone, or pass the MR source branch URL.
|
||||
|
||||
---
|
||||
|
||||
## 5. Jira
|
||||
|
||||
**a. Create an API token.** https://id.atlassian.com/manage-profile/security/api-tokens
|
||||
→ *Create API token*. Note the email of the Atlassian account that owns it.
|
||||
|
||||
**b. Export credentials:**
|
||||
```bash
|
||||
export JIRA_EMAIL=you@yourorg.com
|
||||
export JIRA_API_TOKEN=xxxxxxxxxxxxxxxxxxxx
|
||||
```
|
||||
|
||||
**c. Configure base URL + project (once):**
|
||||
```
|
||||
# in the REPL:
|
||||
/integrations setup jira
|
||||
Jira base URL (https://your-org.atlassian.net): https://yourorg.atlassian.net
|
||||
Jira project key (e.g. SEC): SEC
|
||||
Issue type [Bug]: Bug
|
||||
```
|
||||
This enables Jira and saves the base URL / project key / issue type to
|
||||
`.neurosploit/integrations.json` (no secrets).
|
||||
|
||||
**d. Open cards.** Add `--jira` to any engagement (or `pr` / `watch`). One card is
|
||||
created per **validated** finding, with severity, CVSS, CWE, location, PoC,
|
||||
evidence and remediation:
|
||||
```bash
|
||||
neurosploit whitebox https://github.com/myorg/app --jira \
|
||||
--subscription --model anthropic:claude-opus-4-8 -v
|
||||
```
|
||||
The created issue keys are printed (e.g. `🪪 Jira cards opened: SEC-481, SEC-482`).
|
||||
|
||||
> Uses the Jira REST API (`POST /rest/api/2/issue`) with Basic auth
|
||||
> (`JIRA_EMAIL` : `JIRA_API_TOKEN`). The `issuetype` must exist in your project
|
||||
> (use `Vulnerability` if your project defines it).
|
||||
|
||||
---
|
||||
|
||||
## 6. Recipes
|
||||
|
||||
**PR gate in CI** (block a PR if Critical/High findings appear):
|
||||
```bash
|
||||
export GITHUB_TOKEN=... # CI secret
|
||||
neurosploit integrations enable github
|
||||
neurosploit pr "$REPO" "$PR_NUMBER" --model anthropic:claude-opus-4-8 --comment --jira
|
||||
```
|
||||
|
||||
**Nightly drift review** of a private app, filing Jira cards:
|
||||
```bash
|
||||
neurosploit integrations enable github
|
||||
neurosploit integrations enable jira
|
||||
neurosploit watch myorg/app --branch main --interval 3600 --jira \
|
||||
--model anthropic:claude-opus-4-8
|
||||
```
|
||||
|
||||
**Local private-repo audit** (no PR), cards to Jira:
|
||||
```bash
|
||||
neurosploit whitebox https://github.com/myorg/app --jira \
|
||||
--subscription --model anthropic:claude-opus-4-8 -v
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 7. Troubleshooting
|
||||
|
||||
- **`⚠ token env not set`** — the integration is enabled but the env var isn't
|
||||
exported in this shell. Export it (`export GITHUB_TOKEN=...`) and re-run.
|
||||
- **`git clone failed` on a private repo** — confirm the token scope (`repo` /
|
||||
`read_repository`) and that the integration is enabled (`neurosploit
|
||||
integrations`). The token is only injected when the matching integration is on.
|
||||
- **`jira create failed: 400`** — the `issuetype` name doesn't exist in the
|
||||
project, or a required field is enforced. Try `Bug`, or set your project's type
|
||||
via `/integrations setup jira`.
|
||||
- **`jira ... not set`** — export `JIRA_EMAIL` and `JIRA_API_TOKEN`.
|
||||
- **GitHub comment fails (403/404)** — the token needs *Pull requests: write*
|
||||
(fine-grained) or `repo` (classic), and you must have access to the repo.
|
||||
- **Tokens in CI** — pass them as masked secrets; NeuroSploit never logs or
|
||||
stores token values.
|
||||
+2
-2
@@ -1,4 +1,4 @@
|
||||
# NeuroSploit — Tutorial & User Guide (v3.5.2)
|
||||
# NeuroSploit — Tutorial & User Guide (v3.5.4)
|
||||
|
||||
A complete, hands-on guide to installing, configuring and running NeuroSploit —
|
||||
the autonomous, multi-model penetration-testing harness.
|
||||
@@ -98,7 +98,7 @@ Agents **degrade gracefully**: if `rustscan` is absent they use `nmap`; if neith
|
||||
### Verify
|
||||
|
||||
```bash
|
||||
neurosploit --version # neurosploit 3.5.2
|
||||
neurosploit --version # neurosploit 3.5.4
|
||||
neurosploit agents # {"vulns":196,...,"chains":12,"total":329}
|
||||
neurosploit models # all providers & models
|
||||
```
|
||||
|
||||
+1
-1
@@ -11,7 +11,7 @@ function Ok ($m) { Write-Host " + $m" -ForegroundColor Green }
|
||||
function Warn($m){ Write-Host " ! $m" -ForegroundColor Yellow }
|
||||
|
||||
Write-Host ""
|
||||
Write-Host " NeuroSploit installer (Windows) — v3.5.2" -ForegroundColor Cyan
|
||||
Write-Host " NeuroSploit installer (Windows) — v3.5.4" -ForegroundColor Cyan
|
||||
$arch = $env:PROCESSOR_ARCHITECTURE
|
||||
Say "Platform: Windows / $arch"
|
||||
|
||||
|
||||
Generated
+2
-2
@@ -871,7 +871,7 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "neurosploit"
|
||||
version = "3.5.2"
|
||||
version = "3.5.4"
|
||||
dependencies = [
|
||||
"anyhow",
|
||||
"clap",
|
||||
@@ -888,7 +888,7 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "neurosploit-harness"
|
||||
version = "3.5.2"
|
||||
version = "3.5.4"
|
||||
dependencies = [
|
||||
"anyhow",
|
||||
"futures",
|
||||
|
||||
@@ -3,7 +3,7 @@ members = ["crates/harness", "app"]
|
||||
resolver = "2"
|
||||
|
||||
[workspace.package]
|
||||
version = "3.5.2"
|
||||
version = "3.5.4"
|
||||
edition = "2021"
|
||||
license = "MIT"
|
||||
repository = "https://github.com/JoasASantos/NeuroSploit"
|
||||
|
||||
+247
-11
@@ -1,4 +1,4 @@
|
||||
//! NeuroSploit v3.5.2 — interactive harness + CLI (`run` / `whitebox` / `agents` / `models`).
|
||||
//! NeuroSploit v3.5.4 — interactive harness + CLI (`run` / `whitebox` / `agents` / `models`).
|
||||
|
||||
mod repl;
|
||||
mod tui;
|
||||
@@ -11,8 +11,8 @@ use std::path::{Path, PathBuf};
|
||||
#[command(
|
||||
name = "neurosploit",
|
||||
version,
|
||||
about = "NeuroSploit v3.5.2 — multi-model autonomous pentest harness",
|
||||
long_about = "NeuroSploit v3.5.2 — a Rust multi-model harness that drives a pool of LLMs \
|
||||
about = "NeuroSploit v3.5.4 — multi-model autonomous pentest harness",
|
||||
long_about = "NeuroSploit v3.5.4 — a Rust multi-model harness that drives a pool of LLMs \
|
||||
(API key or local subscription: Claude/Codex/Gemini/Grok) to autonomously test a target. \
|
||||
After recon it INTELLIGENTLY selects only the agents matching the discovered surface, runs \
|
||||
them in parallel, then validates every finding by cross-model voting before reporting.\n\n\
|
||||
@@ -46,6 +46,9 @@ enum Cmd {
|
||||
max_agents: usize,
|
||||
#[arg(long, default_value_t = 3)]
|
||||
vote_n: usize,
|
||||
/// Attack-chaining rounds (post-exploitation pivots; 0 disables).
|
||||
#[arg(long, default_value_t = 2)]
|
||||
chain_depth: usize,
|
||||
#[arg(long)]
|
||||
offline: bool,
|
||||
/// Use local agentic CLI subscription (Claude/Codex/Gemini/Grok login).
|
||||
@@ -61,6 +64,9 @@ enum Cmd {
|
||||
/// Free-text focus, e.g. "injection and broken access control".
|
||||
#[arg(long)]
|
||||
focus: Option<String>,
|
||||
/// Open a Jira card per finding (needs the jira integration enabled).
|
||||
#[arg(long)]
|
||||
jira: bool,
|
||||
/// Verbose: log each agent as it launches, recon, and votes.
|
||||
#[arg(short, long)]
|
||||
verbose: bool,
|
||||
@@ -76,10 +82,16 @@ enum Cmd {
|
||||
max_agents: usize,
|
||||
#[arg(long, default_value_t = 2)]
|
||||
vote_n: usize,
|
||||
/// Attack-chaining rounds (post-exploitation pivots; 0 disables).
|
||||
#[arg(long, default_value_t = 2)]
|
||||
chain_depth: usize,
|
||||
#[arg(long)]
|
||||
offline: bool,
|
||||
#[arg(long)]
|
||||
subscription: bool,
|
||||
/// Open a Jira card per finding (needs the jira integration enabled).
|
||||
#[arg(long)]
|
||||
jira: bool,
|
||||
#[arg(short, long)]
|
||||
verbose: bool,
|
||||
},
|
||||
@@ -102,6 +114,9 @@ enum Cmd {
|
||||
max_agents: usize,
|
||||
#[arg(long, default_value_t = 3)]
|
||||
vote_n: usize,
|
||||
/// Attack-chaining rounds (post-exploitation pivots; 0 disables).
|
||||
#[arg(long, default_value_t = 2)]
|
||||
chain_depth: usize,
|
||||
#[arg(long)]
|
||||
offline: bool,
|
||||
#[arg(long)]
|
||||
@@ -127,6 +142,9 @@ enum Cmd {
|
||||
max_agents: usize,
|
||||
#[arg(long, default_value_t = 3)]
|
||||
vote_n: usize,
|
||||
/// Attack-chaining rounds (post-exploitation pivots; 0 disables).
|
||||
#[arg(long, default_value_t = 2)]
|
||||
chain_depth: usize,
|
||||
#[arg(long)]
|
||||
subscription: bool,
|
||||
#[arg(long)]
|
||||
@@ -148,6 +166,9 @@ enum Cmd {
|
||||
max_agents: usize,
|
||||
#[arg(long, default_value_t = 3)]
|
||||
vote_n: usize,
|
||||
/// Attack-chaining rounds (post-exploitation pivots; 0 disables).
|
||||
#[arg(long, default_value_t = 2)]
|
||||
chain_depth: usize,
|
||||
#[arg(long)]
|
||||
offline: bool,
|
||||
#[arg(long)]
|
||||
@@ -155,6 +176,55 @@ enum Cmd {
|
||||
#[arg(short, long)]
|
||||
verbose: bool,
|
||||
},
|
||||
/// Review a GitHub Pull Request's code (clones the PR head, white-box).
|
||||
/// Optionally comments back on the PR and/or opens Jira cards per finding.
|
||||
Pr {
|
||||
/// `owner/repo` or a GitHub URL.
|
||||
repo: String,
|
||||
/// Pull request number.
|
||||
number: u64,
|
||||
#[arg(long = "model")]
|
||||
models: Vec<String>,
|
||||
#[arg(long, default_value_t = 2)]
|
||||
vote_n: usize,
|
||||
/// Attack-chaining rounds (post-exploitation pivots; 0 disables).
|
||||
#[arg(long, default_value_t = 2)]
|
||||
chain_depth: usize,
|
||||
#[arg(long)]
|
||||
subscription: bool,
|
||||
/// Post a summary comment back on the PR (needs github integration on).
|
||||
#[arg(long)]
|
||||
comment: bool,
|
||||
/// Open a Jira card per finding (needs jira integration on).
|
||||
#[arg(long)]
|
||||
jira: bool,
|
||||
#[arg(short, long)]
|
||||
verbose: bool,
|
||||
},
|
||||
/// Watch a GitHub repo branch; white-box review each time a new commit lands.
|
||||
Watch {
|
||||
/// `owner/repo` or a GitHub URL.
|
||||
repo: String,
|
||||
#[arg(long, default_value = "main")]
|
||||
branch: String,
|
||||
/// Poll interval in seconds.
|
||||
#[arg(long, default_value_t = 300)]
|
||||
interval: u64,
|
||||
#[arg(long = "model")]
|
||||
models: Vec<String>,
|
||||
#[arg(long)]
|
||||
subscription: bool,
|
||||
#[arg(long)]
|
||||
jira: bool,
|
||||
#[arg(short, long)]
|
||||
verbose: bool,
|
||||
},
|
||||
/// Manage integrations: `integrations [show|enable|disable] [github|gitlab|jira]`.
|
||||
Integrations {
|
||||
#[arg(default_value = "show")]
|
||||
action: String,
|
||||
name: Option<String>,
|
||||
},
|
||||
/// Show agent library counts.
|
||||
Agents,
|
||||
/// List providers and models.
|
||||
@@ -215,11 +285,12 @@ async fn main() -> anyhow::Result<()> {
|
||||
}
|
||||
}
|
||||
}
|
||||
Cmd::Run { url, models, max_agents, vote_n, offline, subscription, mcp, creds, focus, verbose } => {
|
||||
Cmd::Run { url, models, max_agents, vote_n, chain_depth, offline, subscription, mcp, creds, focus, jira, verbose } => {
|
||||
let url = if url.starts_with("http") { url } else { format!("https://{url}") };
|
||||
let mut cfg = RunConfig::new(&url);
|
||||
cfg.max_agents = max_agents;
|
||||
cfg.vote_n = vote_n;
|
||||
cfg.chain_depth = chain_depth;
|
||||
cfg.offline = offline;
|
||||
cfg.subscription = subscription;
|
||||
cfg.verbose = verbose;
|
||||
@@ -230,12 +301,15 @@ async fn main() -> anyhow::Result<()> {
|
||||
apply_creds(&mut cfg, creds.as_deref()).await;
|
||||
let out = run_engagement(&base, cfg, mcp, false).await?;
|
||||
print_findings(&out);
|
||||
let ig = harness::integrations::Integrations::load(&repl::proj_dir());
|
||||
post_integrations(&ig, &url, &out, jira, false, None).await;
|
||||
}
|
||||
Cmd::Whitebox { path, models, max_agents, vote_n, offline, subscription, verbose } => {
|
||||
Cmd::Whitebox { path, models, max_agents, vote_n, chain_depth, offline, subscription, jira, verbose } => {
|
||||
let path = resolve_source(&base, &path)?; // local path OR github URL/owner/repo
|
||||
let mut cfg = RunConfig::new(&path);
|
||||
cfg.max_agents = max_agents;
|
||||
cfg.vote_n = vote_n;
|
||||
cfg.chain_depth = chain_depth;
|
||||
cfg.offline = offline;
|
||||
cfg.subscription = subscription;
|
||||
cfg.verbose = verbose;
|
||||
@@ -244,14 +318,17 @@ async fn main() -> anyhow::Result<()> {
|
||||
}
|
||||
let out = run_engagement(&base, cfg, false, true).await?;
|
||||
print_findings(&out);
|
||||
let ig = harness::integrations::Integrations::load(&repl::proj_dir());
|
||||
post_integrations(&ig, &path, &out, jira, false, None).await;
|
||||
}
|
||||
Cmd::Greybox { repo, url, models, creds, focus, max_agents, vote_n, offline, subscription, mcp, verbose } => {
|
||||
Cmd::Greybox { repo, url, models, creds, focus, max_agents, vote_n, chain_depth, offline, subscription, mcp, verbose } => {
|
||||
let repo = resolve_source(&base, &repo)?; // local path OR github URL/owner/repo
|
||||
let url = if url.starts_with("http") { url } else { format!("https://{url}") };
|
||||
let mut cfg = RunConfig::new(&url);
|
||||
cfg.repo = Some(repo);
|
||||
cfg.max_agents = max_agents;
|
||||
cfg.vote_n = vote_n;
|
||||
cfg.chain_depth = chain_depth;
|
||||
cfg.offline = offline;
|
||||
cfg.subscription = subscription;
|
||||
cfg.verbose = verbose;
|
||||
@@ -263,12 +340,13 @@ async fn main() -> anyhow::Result<()> {
|
||||
let out = run_greybox_engagement(&base, cfg, mcp).await?;
|
||||
print_findings(&out);
|
||||
}
|
||||
Cmd::Tui { url, models, repo, creds, focus, max_agents, vote_n, subscription, mcp } => {
|
||||
Cmd::Tui { url, models, repo, creds, focus, max_agents, vote_n, chain_depth, subscription, mcp } => {
|
||||
let repo = match repo { Some(r) => Some(resolve_source(&base, &r)?), None => None }; // github URL ok
|
||||
let url = if url.starts_with("http") { url } else { format!("https://{url}") };
|
||||
let mut cfg = RunConfig::new(&url);
|
||||
cfg.max_agents = max_agents;
|
||||
cfg.vote_n = vote_n;
|
||||
cfg.chain_depth = chain_depth;
|
||||
cfg.subscription = subscription;
|
||||
cfg.instructions = focus;
|
||||
cfg.repo = repo.clone();
|
||||
@@ -279,10 +357,11 @@ async fn main() -> anyhow::Result<()> {
|
||||
let mode = if repo.is_some() { Mode::Grey } else { Mode::Black };
|
||||
tui::run(&base, cfg, mcp, mode).await?;
|
||||
}
|
||||
Cmd::Host { target, models, creds, focus, max_agents, vote_n, offline, subscription, verbose } => {
|
||||
Cmd::Host { target, models, creds, focus, max_agents, vote_n, chain_depth, offline, subscription, verbose } => {
|
||||
let mut cfg = RunConfig::new(&target);
|
||||
cfg.max_agents = max_agents;
|
||||
cfg.vote_n = vote_n;
|
||||
cfg.chain_depth = chain_depth;
|
||||
cfg.offline = offline;
|
||||
cfg.subscription = subscription;
|
||||
cfg.verbose = verbose;
|
||||
@@ -294,6 +373,77 @@ async fn main() -> anyhow::Result<()> {
|
||||
let out = run_mode(&base, cfg, false, Mode::Host).await?;
|
||||
print_findings(&out);
|
||||
}
|
||||
Cmd::Pr { repo, number, models, vote_n, chain_depth, subscription, comment, jira, verbose } => {
|
||||
let ig = harness::integrations::Integrations::load(&repl::proj_dir());
|
||||
let owner_repo = normalize_repo(&repo);
|
||||
let path = clone_pr(&base, &ig, &owner_repo, number)?;
|
||||
println!(" 🔍 white-box review of {owner_repo} PR #{number}");
|
||||
let mut cfg = RunConfig::new(&path);
|
||||
cfg.vote_n = vote_n;
|
||||
cfg.chain_depth = chain_depth;
|
||||
cfg.subscription = subscription;
|
||||
cfg.verbose = verbose;
|
||||
cfg.instructions = Some(format!("This is the code of pull request #{number} of {owner_repo}. Focus on vulnerabilities introduced or touched by this change."));
|
||||
if !models.is_empty() { cfg.models = models; }
|
||||
let out = run_engagement(&base, cfg, false, true).await?;
|
||||
print_findings(&out);
|
||||
post_integrations(&ig, &format!("{owner_repo}#{number}"), &out, jira, comment, Some((&owner_repo, number))).await;
|
||||
}
|
||||
Cmd::Watch { repo, branch, interval, models, subscription, jira, verbose } => {
|
||||
let ig = harness::integrations::Integrations::load(&repl::proj_dir());
|
||||
let owner_repo = normalize_repo(&repo);
|
||||
println!(" 👀 watching {owner_repo}@{branch} every {interval}s — Ctrl-C to stop");
|
||||
let mut last = String::new();
|
||||
loop {
|
||||
match ig.github_latest_sha(&owner_repo, &branch).await {
|
||||
Ok(sha) if sha != last => {
|
||||
let short = &sha[..7.min(sha.len())];
|
||||
println!("\n 🔔 {} commit {short} on {owner_repo}@{branch} — reviewing",
|
||||
if last.is_empty() { "current" } else { "new" });
|
||||
// fresh clone of the branch tip
|
||||
let dest = base.join("repos").join(sanitize(&format!("{owner_repo}-{branch}")));
|
||||
std::fs::remove_dir_all(&dest).ok();
|
||||
let url = ig.authed_clone_url(&format!("https://github.com/{owner_repo}"));
|
||||
if run_git(&["clone", "--depth", "1", "--branch", &branch, &url, &dest.display().to_string()]).is_ok() {
|
||||
let mut cfg = RunConfig::new(&dest.display().to_string());
|
||||
cfg.subscription = subscription;
|
||||
cfg.verbose = verbose;
|
||||
if !models.is_empty() { cfg.models = models.clone(); }
|
||||
if let Ok(out) = run_engagement(&base, cfg, false, true).await {
|
||||
print_findings(&out);
|
||||
post_integrations(&ig, &format!("{owner_repo}@{short}"), &out, jira, false, None).await;
|
||||
}
|
||||
}
|
||||
last = sha;
|
||||
}
|
||||
Ok(_) => {}
|
||||
Err(e) => eprintln!(" watch: {e}"),
|
||||
}
|
||||
tokio::time::sleep(std::time::Duration::from_secs(interval.max(15))).await;
|
||||
}
|
||||
}
|
||||
Cmd::Integrations { action, name } => {
|
||||
let dir = repl::proj_dir();
|
||||
let mut ig = harness::integrations::Integrations::load(&dir);
|
||||
match action.as_str() {
|
||||
"enable" | "disable" => {
|
||||
let on = action == "enable";
|
||||
match name.as_deref() {
|
||||
Some("github") => ig.github.enabled = on,
|
||||
Some("gitlab") => ig.gitlab.enabled = on,
|
||||
Some("jira") => ig.jira.enabled = on,
|
||||
_ => { eprintln!(" usage: integrations {action} <github|gitlab|jira>"); return Ok(()); }
|
||||
}
|
||||
ig.save(&dir)?;
|
||||
println!(" {} {}", name.unwrap_or_default(), if on { "enabled ✓" } else { "disabled" });
|
||||
}
|
||||
_ => {
|
||||
println!(" integrations · {}", dir.display());
|
||||
for l in ig.status_lines() { println!(" {l}"); }
|
||||
println!(" toggle: `neurosploit integrations enable github|gitlab|jira` · full setup in the REPL: /integrations");
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
@@ -384,7 +534,7 @@ pub(crate) fn spawn_engagement(base: &Path, mut cfg: RunConfig, mcp: bool, mode:
|
||||
cfg.rl_path = Some(base.join("data").join("rl_state_rs.json").display().to_string());
|
||||
write_status(&workdir, "running", &format!("\"target\":{:?}", cfg.target));
|
||||
|
||||
println!(" ┌─ NeuroSploit v3.5.2 · by Joas A Santos & Red Team Leaders");
|
||||
println!(" ┌─ NeuroSploit v3.5.4 · by Joas A Santos & Red Team Leaders");
|
||||
println!(" │ run id : {run_id}");
|
||||
println!(" │ target : {}", cfg.target);
|
||||
println!(" │ models : {}", cfg.models.join(", "));
|
||||
@@ -564,9 +714,14 @@ pub(crate) fn resolve_source(base: &Path, arg: &str) -> anyhow::Result<String> {
|
||||
println!(" [*] repo cache hit → {} (delete it to re-clone)", dest.display());
|
||||
return Ok(dest.display().to_string());
|
||||
}
|
||||
println!(" [*] cloning {url} → {}", dest.display());
|
||||
// If a GitHub/GitLab integration is enabled, inject its token so PRIVATE
|
||||
// repos clone without an interactive prompt (token never printed).
|
||||
let ig = harness::integrations::Integrations::load(&repl::proj_dir());
|
||||
let clone_url = ig.authed_clone_url(&url);
|
||||
let private = clone_url != url;
|
||||
println!(" [*] cloning {url}{} → {}", if private { " (private, via token)" } else { "" }, dest.display());
|
||||
let status = std::process::Command::new("git")
|
||||
.args(["clone", "--depth", "1", &url, &dest.display().to_string()])
|
||||
.args(["clone", "--depth", "1", &clone_url, &dest.display().to_string()])
|
||||
.status()
|
||||
.map_err(|e| anyhow::anyhow!("could not start `git clone` (is git installed?): {e}"))?;
|
||||
if !status.success() {
|
||||
@@ -576,6 +731,87 @@ pub(crate) fn resolve_source(base: &Path, arg: &str) -> anyhow::Result<String> {
|
||||
Ok(dest.display().to_string())
|
||||
}
|
||||
|
||||
/// Normalize a GitHub repo reference to `owner/name`.
|
||||
fn normalize_repo(s: &str) -> String {
|
||||
s.trim()
|
||||
.trim_end_matches('/')
|
||||
.trim_end_matches(".git")
|
||||
.replace("https://github.com/", "")
|
||||
.replace("http://github.com/", "")
|
||||
.replace("git@github.com:", "")
|
||||
}
|
||||
|
||||
/// Run a git command, returning Ok(()) on success.
|
||||
fn run_git(args: &[&str]) -> anyhow::Result<()> {
|
||||
let status = std::process::Command::new("git").args(args).status()
|
||||
.map_err(|e| anyhow::anyhow!("could not run git (is it installed?): {e}"))?;
|
||||
if !status.success() { anyhow::bail!("git {:?} failed", args.first().unwrap_or(&"")); }
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Clone a repo and check out a Pull Request's HEAD (`refs/pull/N/head`).
|
||||
fn clone_pr(base: &Path, ig: &harness::integrations::Integrations, owner_repo: &str, number: u64) -> anyhow::Result<String> {
|
||||
let dest = base.join("repos").join(sanitize(&format!("{owner_repo}-pr{number}")));
|
||||
std::fs::create_dir_all(base.join("repos")).ok();
|
||||
std::fs::remove_dir_all(&dest).ok(); // always fresh — PR code changes
|
||||
let url = ig.authed_clone_url(&format!("https://github.com/{owner_repo}"));
|
||||
let private = url.contains('@');
|
||||
println!(" [*] cloning {owner_repo}{} + PR #{number} head → {}", if private { " (private)" } else { "" }, dest.display());
|
||||
let d = dest.display().to_string();
|
||||
run_git(&["clone", "--depth", "1", &url, &d])?;
|
||||
run_git(&["-C", &d, "fetch", "--depth", "1", "origin", &format!("pull/{number}/head:pr-{number}")])?;
|
||||
run_git(&["-C", &d, "checkout", &format!("pr-{number}")])?;
|
||||
Ok(d)
|
||||
}
|
||||
|
||||
/// After a run, optionally open Jira cards and/or comment on a GitHub PR.
|
||||
async fn post_integrations(
|
||||
ig: &harness::integrations::Integrations,
|
||||
target: &str,
|
||||
out: &RunOutput,
|
||||
jira: bool,
|
||||
comment: bool,
|
||||
gh_pr: Option<(&str, u64)>,
|
||||
) {
|
||||
if jira && ig.jira.enabled && !out.findings.is_empty() {
|
||||
let (keys, errs) = ig.jira_cards_for(target, &out.findings).await;
|
||||
if !keys.is_empty() { println!(" 🪪 Jira cards opened: {}", keys.join(", ")); }
|
||||
for e in errs { eprintln!(" jira: {e}"); }
|
||||
}
|
||||
if comment && ig.github.enabled {
|
||||
if let Some((repo, number)) = gh_pr {
|
||||
match ig.github_comment(repo, number, &pr_comment_body(out)).await {
|
||||
Ok(()) => println!(" 💬 commented results on {repo}#{number}"),
|
||||
Err(e) => eprintln!(" github comment: {e}"),
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Markdown summary of a run, for a PR comment.
|
||||
fn pr_comment_body(out: &RunOutput) -> String {
|
||||
let mut by = std::collections::BTreeMap::new();
|
||||
for f in &out.findings { *by.entry(f.severity.as_str()).or_insert(0) += 1; }
|
||||
let chips: Vec<String> = by.iter().map(|(k, v)| format!("{k}: {v}")).collect();
|
||||
let mut s = format!(
|
||||
"### 🧠 NeuroSploit white-box review\n\n**{} validated finding(s)** — {}\n\n",
|
||||
out.findings.len(),
|
||||
if chips.is_empty() { "none".into() } else { chips.join(" · ") }
|
||||
);
|
||||
if out.findings.is_empty() {
|
||||
s.push_str("_No vulnerabilities confirmed in the reviewed code._\n");
|
||||
} else {
|
||||
s.push_str("| Severity | Finding | CWE | Location |\n|---|---|---|---|\n");
|
||||
for f in &out.findings {
|
||||
s.push_str(&format!("| {} | {} | {} | {} |\n",
|
||||
f.severity, f.title.replace('|', "\\|"), f.cwe,
|
||||
f.endpoint.replace('|', "\\|")));
|
||||
}
|
||||
s.push_str("\n_Findings validated by multi-model voting. Authorized testing only._\n");
|
||||
}
|
||||
s
|
||||
}
|
||||
|
||||
/// Blocking yes/no prompt (default yes). Used after a graceful Ctrl-C.
|
||||
fn ask_yes_no(q: &str) -> bool {
|
||||
use std::io::Write;
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
//! NeuroSploit v3.5.2 — interactive session (Claude-Code / Codex / Cursor-CLI style).
|
||||
//! NeuroSploit v3.5.4 — interactive session (Claude-Code / Codex / Cursor-CLI style).
|
||||
//!
|
||||
//! Launched when `neurosploit` runs with no subcommand. A persistent REPL with
|
||||
//! real line editing (arrow-key history recall, Ctrl-A/E/K, paste), model
|
||||
@@ -120,7 +120,7 @@ const COMMANDS: &[&str] = &[
|
||||
"/help", "/show", "/config", "/providers", "/model", "/key", "/sub", "/target",
|
||||
"/repo", "/auth", "/creds", "/focus", "/attach", "/context", "/mcp", "/offline",
|
||||
"/votes", "/agents", "/theme", "/clear", "/run", "/stop", "/continue", "/runs", "/results", "/report",
|
||||
"/status", "/diff", "/retest", "/quit",
|
||||
"/status", "/diff", "/retest", "/integrations", "/quit",
|
||||
];
|
||||
|
||||
/// rustyline helper: Tab-completes `/commands` and `@filesystem-paths`,
|
||||
@@ -299,7 +299,7 @@ pub async fn repl(base: &Path) -> anyhow::Result<()> {
|
||||
let backends = harness::installed_cli_backends();
|
||||
println!("\x1b[1m");
|
||||
println!(" ███╗ ██╗███████╗██╗ ██╗██████╗ ██████╗");
|
||||
println!(" ████╗ ██║██╔════╝██║ ██║██╔══██╗██╔═══██╗ NeuroSploit v3.5.2");
|
||||
println!(" ████╗ ██║██╔════╝██║ ██║██╔══██╗██╔═══██╗ NeuroSploit v3.5.4");
|
||||
println!(" ██╔██╗ ██║█████╗ ██║ ██║██████╔╝██║ ██║ interactive harness");
|
||||
println!(" ██║╚██╗██║██╔══╝ ██║ ██║██╔══██╗██║ ██║ by Joas A Santos");
|
||||
println!(" ██║ ╚████║███████╗╚██████╔╝██║ ██║╚██████╔╝ & Red Team Leaders");
|
||||
@@ -430,6 +430,7 @@ pub async fn repl(base: &Path) -> anyhow::Result<()> {
|
||||
}
|
||||
"/mcp" => { s.mcp = !matches!(arg, "off" | "false" | "0" | "no"); println!(" Playwright MCP: {}", onoff(s.mcp)); }
|
||||
"/offline" => { s.offline = !matches!(arg, "off" | "false" | "0" | "no"); println!(" offline: {}", onoff(s.offline)); }
|
||||
"/integrations" | "/integration" => integrations_cmd(arg),
|
||||
"/votes" => { s.vote_n = arg.parse().unwrap_or(s.vote_n); println!(" votes: {}", s.vote_n); }
|
||||
"/agents" => { s.max_agents = arg.parse().unwrap_or(s.max_agents); println!(" max agents: {}", s.max_agents); }
|
||||
"/clear" => { print!("\x1b[2J\x1b[H"); }
|
||||
@@ -939,6 +940,64 @@ fn sev_rank(s: &str) -> u8 {
|
||||
}
|
||||
|
||||
/// Read one line synchronously (for the /stop choice prompt).
|
||||
/// `/integrations` — show / enable / disable / setup GitHub, GitLab, Jira.
|
||||
fn integrations_cmd(arg: &str) {
|
||||
let dir = proj_dir();
|
||||
let mut ig = harness::integrations::Integrations::load(&dir);
|
||||
let mut parts = arg.splitn(2, char::is_whitespace);
|
||||
let sub = parts.next().unwrap_or("").trim();
|
||||
let name = parts.next().unwrap_or("").trim();
|
||||
match sub {
|
||||
"" | "show" | "status" => {
|
||||
println!(" \x1b[1mintegrations\x1b[0m · {}", dir.display());
|
||||
for l in ig.status_lines() { println!(" {l}"); }
|
||||
println!(" \x1b[2m/integrations enable|disable <github|gitlab|jira> · /integrations setup <jira|gitlab|github>\x1b[0m");
|
||||
println!(" \x1b[2mtokens come from env vars (never stored): GITHUB_TOKEN · GITLAB_TOKEN · JIRA_EMAIL + JIRA_API_TOKEN\x1b[0m");
|
||||
}
|
||||
"enable" | "disable" => {
|
||||
let on = sub == "enable";
|
||||
match name {
|
||||
"github" => ig.github.enabled = on,
|
||||
"gitlab" => ig.gitlab.enabled = on,
|
||||
"jira" => ig.jira.enabled = on,
|
||||
_ => { println!(" usage: /integrations {sub} <github|gitlab|jira>"); return; }
|
||||
}
|
||||
let _ = ig.save(&dir);
|
||||
println!(" {name} {}", if on { "enabled ✓" } else { "disabled" });
|
||||
}
|
||||
"setup" => match name {
|
||||
"jira" => {
|
||||
let base = ask_line(" Jira base URL (https://your-org.atlassian.net):");
|
||||
if !base.trim().is_empty() { ig.jira.base_url = base.trim().trim_end_matches('/').to_string(); }
|
||||
let proj = ask_line(" Jira project key (e.g. SEC):");
|
||||
if !proj.trim().is_empty() { ig.jira.project_key = proj.trim().to_string(); }
|
||||
let it = ask_line(" Issue type [Bug]:");
|
||||
if !it.trim().is_empty() { ig.jira.issue_type = it.trim().to_string(); }
|
||||
ig.jira.enabled = true;
|
||||
let _ = ig.save(&dir);
|
||||
println!(" ✓ jira configured (project {}, {}). Now export {} and {} in your shell.",
|
||||
ig.jira.project_key, ig.jira.base_url, ig.jira.email_env, ig.jira.token_env);
|
||||
}
|
||||
"gitlab" => {
|
||||
let b = ask_line(" GitLab base [https://gitlab.com]:");
|
||||
if !b.trim().is_empty() { ig.gitlab.base = b.trim().trim_end_matches('/').to_string(); }
|
||||
ig.gitlab.enabled = true;
|
||||
let _ = ig.save(&dir);
|
||||
println!(" ✓ gitlab enabled (base {}). Export {} (PAT with read_repository).", ig.gitlab.base, ig.gitlab.token_env);
|
||||
}
|
||||
"github" => {
|
||||
let a = ask_line(" GitHub API base [https://api.github.com] (change for GHE):");
|
||||
if !a.trim().is_empty() { ig.github.api = a.trim().trim_end_matches('/').to_string(); }
|
||||
ig.github.enabled = true;
|
||||
let _ = ig.save(&dir);
|
||||
println!(" ✓ github enabled (api {}). Export {} (PAT with repo scope).", ig.github.api, ig.github.token_env);
|
||||
}
|
||||
_ => println!(" usage: /integrations setup <jira|gitlab|github>"),
|
||||
},
|
||||
_ => println!(" usage: /integrations [show | enable <name> | disable <name> | setup <name>]"),
|
||||
}
|
||||
}
|
||||
|
||||
fn ask_line(prompt: &str) -> String {
|
||||
use std::io::Write;
|
||||
print!("{prompt} ");
|
||||
@@ -1047,6 +1106,9 @@ fn help() {
|
||||
h("/runs", "list runs · /results [n] · /report [n]");
|
||||
h("/diff /retest [n]", "what changed vs last run · re-verify a past run");
|
||||
|
||||
println!("\n \x1b[2mINTEGRATIONS\x1b[0m");
|
||||
h("/integrations", "show · enable/disable github|gitlab|jira · setup <name>");
|
||||
|
||||
println!("\n \x1b[2mOPTIONS\x1b[0m");
|
||||
h("/mcp on|off", "Playwright MCP browser /offline on|off self-test");
|
||||
h("/votes <n>", "validator votes /agents <n> cap agents");
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
//! NeuroSploit v3.5.2 — TUI "Mission Control" mode.
|
||||
//! NeuroSploit v3.5.4 — TUI "Mission Control" mode.
|
||||
//!
|
||||
//! Concurrent panels that update live while the engagement runs in the
|
||||
//! background, with a composer input that stays active during execution:
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
//! POMDP belief-state world model (v3.5.2).
|
||||
//! POMDP belief-state world model (v3.5.4).
|
||||
//!
|
||||
//! The target is only partially observable, so we don't track booleans — we
|
||||
//! track a **belief**: a property graph whose nodes (host / service / vuln /
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
//! Verification / grounding engine (v3.5.2).
|
||||
//! Verification / grounding engine (v3.5.4).
|
||||
//!
|
||||
//! Hard rule: **no claim enters the world model without a tool receipt** — raw
|
||||
//! tool output, not the LLM's paraphrase. This is the empirical anti-hallucination
|
||||
|
||||
@@ -0,0 +1,199 @@
|
||||
//! External integrations (v3.5.3): GitHub / GitLab (private repos, PR/MR code
|
||||
//! review, commit watching) and Jira (open one vulnerability card per finding).
|
||||
//!
|
||||
//! Config persists to `<project>/.neurosploit/integrations.json`. **Secrets are
|
||||
//! never stored** — only the *name* of the env var holding each token is saved;
|
||||
//! the value is read from the environment at use time.
|
||||
use crate::types::Finding;
|
||||
use anyhow::{anyhow, Result};
|
||||
use serde::{Deserialize, Serialize};
|
||||
use std::path::Path;
|
||||
|
||||
#[derive(Serialize, Deserialize, Clone)]
|
||||
pub struct GithubCfg {
|
||||
pub enabled: bool,
|
||||
pub token_env: String, // e.g. GITHUB_TOKEN (a PAT with `repo` scope for private repos)
|
||||
pub api: String, // https://api.github.com (or GHE base)
|
||||
}
|
||||
impl Default for GithubCfg {
|
||||
fn default() -> Self { Self { enabled: false, token_env: "GITHUB_TOKEN".into(), api: "https://api.github.com".into() } }
|
||||
}
|
||||
|
||||
#[derive(Serialize, Deserialize, Clone)]
|
||||
pub struct GitlabCfg {
|
||||
pub enabled: bool,
|
||||
pub token_env: String, // GITLAB_TOKEN
|
||||
pub base: String, // https://gitlab.com (or self-hosted)
|
||||
}
|
||||
impl Default for GitlabCfg {
|
||||
fn default() -> Self { Self { enabled: false, token_env: "GITLAB_TOKEN".into(), base: "https://gitlab.com".into() } }
|
||||
}
|
||||
|
||||
#[derive(Serialize, Deserialize, Clone)]
|
||||
pub struct JiraCfg {
|
||||
pub enabled: bool,
|
||||
pub base_url: String, // https://your-org.atlassian.net
|
||||
pub email_env: String, // JIRA_EMAIL
|
||||
pub token_env: String, // JIRA_API_TOKEN
|
||||
pub project_key: String,
|
||||
pub issue_type: String, // Bug / Vulnerability / Task
|
||||
}
|
||||
impl Default for JiraCfg {
|
||||
fn default() -> Self {
|
||||
Self { enabled: false, base_url: String::new(), email_env: "JIRA_EMAIL".into(),
|
||||
token_env: "JIRA_API_TOKEN".into(), project_key: String::new(), issue_type: "Bug".into() }
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Serialize, Deserialize, Clone, Default)]
|
||||
pub struct Integrations {
|
||||
pub github: GithubCfg,
|
||||
pub gitlab: GitlabCfg,
|
||||
pub jira: JiraCfg,
|
||||
}
|
||||
|
||||
fn env(name: &str) -> Option<String> {
|
||||
std::env::var(name).ok().filter(|v| !v.trim().is_empty())
|
||||
}
|
||||
|
||||
fn client() -> reqwest::Client {
|
||||
reqwest::Client::builder()
|
||||
.timeout(std::time::Duration::from_secs(30))
|
||||
.build()
|
||||
.unwrap_or_default()
|
||||
}
|
||||
|
||||
impl Integrations {
|
||||
pub fn path(dir: &Path) -> std::path::PathBuf { dir.join("integrations.json") }
|
||||
|
||||
pub fn load(dir: &Path) -> Self {
|
||||
std::fs::read_to_string(Self::path(dir))
|
||||
.ok()
|
||||
.and_then(|t| serde_json::from_str(&t).ok())
|
||||
.unwrap_or_default()
|
||||
}
|
||||
|
||||
pub fn save(&self, dir: &Path) -> Result<()> {
|
||||
std::fs::create_dir_all(dir).ok();
|
||||
std::fs::write(Self::path(dir), serde_json::to_string_pretty(self)?)?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub fn github_token(&self) -> Option<String> { env(&self.github.token_env) }
|
||||
pub fn gitlab_token(&self) -> Option<String> { env(&self.gitlab.token_env) }
|
||||
|
||||
/// Inject a token into an https git URL so private repos can be cloned.
|
||||
/// No-op if the matching integration is off, the token env is unset, or the
|
||||
/// URL doesn't match the configured host.
|
||||
pub fn authed_clone_url(&self, url: &str) -> String {
|
||||
if self.github.enabled {
|
||||
if let Some(rest) = url.strip_prefix("https://github.com/") {
|
||||
if let Some(tok) = self.github_token() {
|
||||
return format!("https://x-access-token:{tok}@github.com/{rest}");
|
||||
}
|
||||
}
|
||||
}
|
||||
if self.gitlab.enabled {
|
||||
let host = self.gitlab.base.trim_start_matches("https://").trim_start_matches("http://").trim_end_matches('/');
|
||||
let prefix = format!("https://{host}/");
|
||||
if let Some(rest) = url.strip_prefix(&prefix) {
|
||||
if let Some(tok) = self.gitlab_token() {
|
||||
return format!("https://oauth2:{tok}@{host}/{rest}");
|
||||
}
|
||||
}
|
||||
}
|
||||
url.to_string()
|
||||
}
|
||||
|
||||
/// Post a comment on a GitHub PR/issue (`repo` = `owner/name`).
|
||||
pub async fn github_comment(&self, repo: &str, number: u64, body: &str) -> Result<()> {
|
||||
let tok = self.github_token().ok_or_else(|| anyhow!("{} not set", self.github.token_env))?;
|
||||
let url = format!("{}/repos/{}/issues/{}/comments", self.github.api.trim_end_matches('/'), repo, number);
|
||||
let resp = client().post(&url)
|
||||
.header("User-Agent", "NeuroSploit")
|
||||
.header("Accept", "application/vnd.github+json")
|
||||
.bearer_auth(tok)
|
||||
.json(&serde_json::json!({ "body": body }))
|
||||
.send().await?;
|
||||
if !resp.status().is_success() {
|
||||
return Err(anyhow!("github comment failed: {} {}", resp.status(), resp.text().await.unwrap_or_default()));
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Latest commit SHA of a branch via the GitHub API (for `watch`).
|
||||
pub async fn github_latest_sha(&self, repo: &str, branch: &str) -> Result<String> {
|
||||
let url = format!("{}/repos/{}/commits/{}", self.github.api.trim_end_matches('/'), repo, branch);
|
||||
let mut req = client().get(&url)
|
||||
.header("User-Agent", "NeuroSploit")
|
||||
.header("Accept", "application/vnd.github+json");
|
||||
if let Some(t) = self.github_token() { req = req.bearer_auth(t); }
|
||||
let resp = req.send().await?;
|
||||
if !resp.status().is_success() {
|
||||
return Err(anyhow!("github commits API {}: {}", resp.status(), resp.text().await.unwrap_or_default()));
|
||||
}
|
||||
let v: serde_json::Value = resp.json().await?;
|
||||
v["sha"].as_str().map(|s| s.to_string()).ok_or_else(|| anyhow!("no sha in response"))
|
||||
}
|
||||
|
||||
/// Create one Jira issue. Returns the issue key (e.g. SEC-123).
|
||||
pub async fn jira_card(&self, summary: &str, description: &str) -> Result<String> {
|
||||
let email = env(&self.jira.email_env).ok_or_else(|| anyhow!("{} not set", self.jira.email_env))?;
|
||||
let token = env(&self.jira.token_env).ok_or_else(|| anyhow!("{} not set", self.jira.token_env))?;
|
||||
if self.jira.base_url.is_empty() || self.jira.project_key.is_empty() {
|
||||
return Err(anyhow!("jira base_url/project_key not configured (run /integrations setup jira)"));
|
||||
}
|
||||
let url = format!("{}/rest/api/2/issue", self.jira.base_url.trim_end_matches('/'));
|
||||
let payload = serde_json::json!({
|
||||
"fields": {
|
||||
"project": { "key": self.jira.project_key },
|
||||
"summary": summary,
|
||||
"description": description,
|
||||
"issuetype": { "name": self.jira.issue_type },
|
||||
}
|
||||
});
|
||||
let resp = client().post(&url)
|
||||
.basic_auth(email, Some(token))
|
||||
.header("Accept", "application/json")
|
||||
.json(&payload)
|
||||
.send().await?;
|
||||
let status = resp.status();
|
||||
let text = resp.text().await.unwrap_or_default();
|
||||
if !status.is_success() {
|
||||
return Err(anyhow!("jira create failed: {} {}", status, text));
|
||||
}
|
||||
let v: serde_json::Value = serde_json::from_str(&text)?;
|
||||
Ok(v["key"].as_str().unwrap_or("?").to_string())
|
||||
}
|
||||
|
||||
/// Open one Jira card per finding. Returns (created keys, errors).
|
||||
pub async fn jira_cards_for(&self, target: &str, findings: &[Finding]) -> (Vec<String>, Vec<String>) {
|
||||
let (mut keys, mut errs) = (Vec::new(), Vec::new());
|
||||
for f in findings {
|
||||
let summary = format!("[{}] {} — {}", f.severity, f.title, target);
|
||||
let description = format!(
|
||||
"*Target:* {target}\n*Severity:* {} | *CVSS:* {} | *CWE:* {}\n*Location:* {}\n\n*Impact:*\n{}\n\n*PoC / payload:*\n{{code}}{}{{code}}\n\n*Evidence:*\n{{code}}{}{{code}}\n\n*Remediation:*\n{}\n\n_Filed automatically by NeuroSploit._",
|
||||
f.severity, f.cvss, f.cwe, f.endpoint, f.impact, f.payload, f.evidence, f.remediation
|
||||
);
|
||||
match self.jira_card(&summary, &description).await {
|
||||
Ok(k) => keys.push(k),
|
||||
Err(e) => errs.push(format!("{}: {e}", f.title)),
|
||||
}
|
||||
}
|
||||
(keys, errs)
|
||||
}
|
||||
|
||||
/// Human-readable status (for `/integrations` and the CLI).
|
||||
pub fn status_lines(&self) -> Vec<String> {
|
||||
let badge = |on: bool, tok: bool| if !on { "off".to_string() }
|
||||
else if tok { "on ✓ token".to_string() } else { "on ⚠ token env not set".to_string() };
|
||||
vec![
|
||||
format!("github : {:<18} (clone private repos · PR review · watch) env={}", badge(self.github.enabled, self.github_token().is_some()), self.github.token_env),
|
||||
format!("gitlab : {:<18} (clone private repos · MR review) env={}", badge(self.gitlab.enabled, self.gitlab_token().is_some()), self.gitlab.token_env),
|
||||
format!("jira : {:<18} (open a card per finding) project={} base={}",
|
||||
badge(self.jira.enabled, env(&self.jira.token_env).is_some()),
|
||||
if self.jira.project_key.is_empty() { "-" } else { &self.jira.project_key },
|
||||
if self.jira.base_url.is_empty() { "-" } else { &self.jira.base_url }),
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -1,4 +1,4 @@
|
||||
//! NeuroSploit v3.5.2 harness — a robust multi-model runtime for the
|
||||
//! NeuroSploit v3.5.4 harness — a robust multi-model runtime for the
|
||||
//! markdown-driven autonomous pentest engine.
|
||||
//!
|
||||
//! The harness loads the `agents_md/` library, drives a *pool* of LLM models
|
||||
@@ -12,6 +12,7 @@ pub mod belief;
|
||||
pub mod creds;
|
||||
pub mod grounding;
|
||||
pub mod hygiene;
|
||||
pub mod integrations;
|
||||
pub mod pomdp;
|
||||
pub mod models;
|
||||
pub mod pipeline;
|
||||
|
||||
@@ -60,7 +60,11 @@ fn tool_doctrine(mcp_on: bool) -> String {
|
||||
Use only what is installed; degrade gracefully. Never run destructive or DoS actions.\n\n"
|
||||
)
|
||||
}
|
||||
const VOTE_SYS: &str = "You are an adversarial security validator. Decide if the candidate finding is a REAL, reproducible, exploitable vulnerability with proof. Reply with JSON {\"verdict\":\"confirmed\"|\"rejected\",\"reason\":\"...\"}. Default to rejected when uncertain.";
|
||||
const VOTE_SYS: &str = "You are an adversarial security validator. Decide if the candidate finding is a REAL, reproducible, exploitable vulnerability whose EVIDENCE actually proves impact. Reject common false positives: input merely reflected but not executed; version/banner guesses with no working PoC; self-XSS; theoretical issues; an error message or stack trace mistaken for injection; missing, generic, or non-reproducible evidence; severity inflated beyond what the evidence demonstrates. Confirm only if the provided evidence (request/response) concretely proves the vulnerability. Reply with JSON {\"verdict\":\"confirmed\"|\"rejected\",\"reason\":\"...\"}. Default to rejected when uncertain.";
|
||||
/// Adversarial second pass for High/Critical findings: assume false positive
|
||||
/// until the evidence forces otherwise. A finding that can't withstand the
|
||||
/// skeptics is dropped.
|
||||
const REFUTE_SYS: &str = "You are a skeptical senior reviewer trying to DISPROVE a reported vulnerability. Assume it is a FALSE POSITIVE unless the evidence forces otherwise. Scrutinize: does the evidence PROVE execution/impact, or only that input was reflected/accepted? Is there a real working PoC, or just a version/banner/theory? Could it be self-XSS, an error message, or an unreachable path? Reply JSON {\"verdict\":\"confirmed\"|\"rejected\",\"reason\":\"...\"} where confirmed means the vulnerability is REAL and proven by the evidence. When in doubt, reject.";
|
||||
const CODE_VOTE_SYS: &str = "You are an adversarial source-code reviewer. Decide if the reported issue is a REAL vulnerability in the provided code (reachable, exploitable, not a false positive). Reply JSON {\"verdict\":\"confirmed\"|\"rejected\",\"reason\":\"...\"}.";
|
||||
|
||||
/// ReAct loop directive: make the agent reason → act with a tool → observe →
|
||||
@@ -217,14 +221,11 @@ pub async fn run(cfg: RunConfig, lib: &Library, pool: &ModelPool, tx: Sender<Str
|
||||
// ---- 4. Validate by N-model voting ---------------------------------
|
||||
let mut findings = validate(candidates, pool, VOTE_SYS, cfg.vote_n, &tx).await;
|
||||
|
||||
// ---- 5. Chain confirmed findings into deeper impact ----------------
|
||||
let chained = chain_round(pool, &cfg.target, &recon, &operator_directives(&cfg), &findings, &lib.chains, &tx).await;
|
||||
if !chained.is_empty() {
|
||||
let extra = validate(dedup_findings(chained), pool, VOTE_SYS, cfg.vote_n, &tx).await;
|
||||
let _ = tx.send(format!("chaining added {} validated finding(s)", extra.len())).await;
|
||||
findings.extend(extra);
|
||||
findings = dedup_findings(findings);
|
||||
}
|
||||
// ---- 5. Attack chaining: multi-round post-exploitation pivots ------
|
||||
let chained = attack_chain(pool, &cfg, &recon, &findings, &lib.chains, &tx).await;
|
||||
findings.extend(chained);
|
||||
findings = dedup_findings(findings);
|
||||
let findings = refute_pass(findings, pool, cfg.vote_n, &tx).await;
|
||||
finish(cfg, lib, recon, transcript, findings, selected, &mut rl, tx).await
|
||||
}
|
||||
|
||||
@@ -286,6 +287,7 @@ pub async fn run_whitebox(cfg: RunConfig, lib: &Library, pool: &ModelPool, tx: S
|
||||
let candidates = dedup_findings(raw.iter().flat_map(|(_, _, f)| f.clone()).collect());
|
||||
let _ = tx.send(format!("{} candidate finding(s) (deduped) — validating", candidates.len())).await;
|
||||
let findings = validate(candidates, pool, CODE_VOTE_SYS, cfg.vote_n, &tx).await;
|
||||
let findings = refute_pass(findings, pool, cfg.vote_n, &tx).await;
|
||||
finish(cfg, lib, "{}".into(), transcript, findings, selected, &mut rl, tx).await
|
||||
}
|
||||
|
||||
@@ -421,52 +423,174 @@ pub async fn run_greybox(cfg: RunConfig, lib: &Library, pool: &ModelPool, tx: Se
|
||||
let candidates = dedup_findings(raw.iter().flat_map(|(_, _, f)| f.clone()).collect());
|
||||
let _ = tx.send(format!("{} candidate finding(s) (deduped) — validating", candidates.len())).await;
|
||||
let mut findings = validate(candidates, pool, VOTE_SYS, cfg.vote_n, &tx).await;
|
||||
let chained = chain_round(pool, &cfg.target, &recon, &operator_directives(&cfg), &findings, &lib.chains, &tx).await;
|
||||
if !chained.is_empty() {
|
||||
let extra = validate(dedup_findings(chained), pool, VOTE_SYS, cfg.vote_n, &tx).await;
|
||||
let _ = tx.send(format!("chaining added {} validated finding(s)", extra.len())).await;
|
||||
findings.extend(extra);
|
||||
findings = dedup_findings(findings);
|
||||
}
|
||||
let chained = attack_chain(pool, &cfg, &recon, &findings, &lib.chains, &tx).await;
|
||||
findings.extend(chained);
|
||||
findings = dedup_findings(findings);
|
||||
let findings = refute_pass(findings, pool, cfg.vote_n, &tx).await;
|
||||
finish(cfg, lib, recon, transcript, findings, selected, &mut rl, tx).await
|
||||
}
|
||||
|
||||
const CHAIN_SYS: &str = "You are an exploit-chaining specialist. Given already-CONFIRMED findings, chain them into deeper impact — e.g. SSRF→cloud metadata creds, SQLi→DB dump→credential reuse, IDOR→account takeover, arbitrary file read→secrets→RCE, auth bypass→admin. Use your tools to actually carry the chain forward and PROVE the escalated impact. Report ONLY NEW findings beyond the inputs.";
|
||||
const CHAIN_SYS: &str = "You are a post-exploitation & attack-chaining specialist. You are given ONE confirmed foothold plus any loot already gathered. DECIDE the most promising directions to expand from THIS foothold and pursue them with real tools: post-exploitation (loot credentials/tokens/keys/config/source), credential reuse, privilege escalation (horizontal AND vertical), lateral movement to adjacent services/hosts, data exfiltration, and reaching NEW attack surface the foothold exposes (e.g. SSRF→cloud metadata creds→IAM, SQLi→DB dump→credential reuse→admin, arbitrary file read→secrets→RCE, IDOR→account takeover, auth bypass→internal APIs). PROVE each escalated step with a real tool receipt. Report ONLY NEW findings beyond the input, plus any new loot you discovered (creds, tokens, hosts, internal endpoints) so later stages can reuse it. Authorized engagement; never destructive/DoS.";
|
||||
|
||||
/// One orchestration round: take the confirmed findings and try to chain them
|
||||
/// into higher-impact follow-ups, reusing the recon/auth context. Returns the
|
||||
/// (unvalidated) new candidate findings produced by chaining.
|
||||
async fn chain_round(pool: &ModelPool, target: &str, recon: &str, directives: &str,
|
||||
confirmed: &[Finding], chains: &[Agent], tx: &Sender<String>) -> Vec<Finding> {
|
||||
if confirmed.is_empty() {
|
||||
/// Dedup / identity key for a finding (cwe|endpoint|title-prefix).
|
||||
fn finding_key(f: &Finding) -> String {
|
||||
format!("{}|{}|{}", f.cwe.to_lowercase(), f.endpoint.to_lowercase(),
|
||||
f.title.to_lowercase().chars().take(40).collect::<String>())
|
||||
}
|
||||
|
||||
fn sev_rank(sev: &str) -> u8 {
|
||||
match sev.to_lowercase().as_str() {
|
||||
x if x.starts_with("crit") => 4,
|
||||
x if x.starts_with("high") => 3,
|
||||
x if x.starts_with("med") => 2,
|
||||
x if x.starts_with("low") => 1,
|
||||
_ => 0,
|
||||
}
|
||||
}
|
||||
|
||||
/// Max footholds expanded per round (keeps token cost bounded).
|
||||
const CHAIN_SEEDS_PER_ROUND: usize = 6;
|
||||
|
||||
/// Robust attack-chaining engine (v3.5.4): iterative, decision-driven,
|
||||
/// post-exploitation pivoting. Each round takes the newest confirmed footholds,
|
||||
/// and for EACH one an agent decides which directions to expand (post-ex, cred
|
||||
/// reuse, privesc, lateral, exfil, new surface), proves new impact, and reports
|
||||
/// new findings + **loot** (creds/tokens/hosts/endpoints). Loot is carried
|
||||
/// forward so later rounds reuse it. New validated findings become the next
|
||||
/// round's footholds; the loop stops at `chain_depth` rounds or when a round
|
||||
/// yields nothing new (loop-until-dry). Findings are validated each round so we
|
||||
/// never pivot off a false positive.
|
||||
async fn attack_chain(pool: &ModelPool, cfg: &RunConfig, recon: &str,
|
||||
confirmed: &[Finding], chains: &[Agent], tx: &Sender<String>) -> Vec<Finding> {
|
||||
let max_rounds = cfg.chain_depth;
|
||||
if max_rounds == 0 || confirmed.is_empty() || pool.stop_exploiting() {
|
||||
return vec![];
|
||||
}
|
||||
let summary: String = confirmed.iter().take(20)
|
||||
.map(|f| format!("- [{}] {} @ {} ({})", f.severity, f.title, f.endpoint, f.cwe))
|
||||
.collect::<Vec<_>>().join("\n");
|
||||
// Offer the known chain recipes as a menu so the LLM applies proven multi-stage paths.
|
||||
let recipes: String = chains.iter().map(|a| format!("- {}", a.title.replace(" Agent", ""))).collect::<Vec<_>>().join("\n");
|
||||
let recipe_block = if recipes.is_empty() { String::new() } else { format!("KNOWN CHAIN RECIPES (apply any that fit):\n{recipes}\n\n") };
|
||||
let _ = tx.send(format!("chaining {} confirmed finding(s) for deeper impact…", confirmed.len())).await;
|
||||
let recon_ctx: String = recon.chars().take(2500).collect();
|
||||
let recon_ctx: String = recon.chars().take(2000).collect();
|
||||
let directives = operator_directives(cfg);
|
||||
|
||||
let mut all_new: Vec<Finding> = Vec::new();
|
||||
let mut loot: Vec<String> = Vec::new();
|
||||
let mut seen: std::collections::HashSet<String> = confirmed.iter().map(finding_key).collect();
|
||||
|
||||
// Frontier = footholds to expand this round; start with confirmed, best-first.
|
||||
let mut frontier: Vec<Finding> = confirmed.to_vec();
|
||||
frontier.sort_by(|a, b| sev_rank(&b.severity).cmp(&sev_rank(&a.severity)));
|
||||
|
||||
for round in 1..=max_rounds {
|
||||
if pool.stop_exploiting() || frontier.is_empty() {
|
||||
break;
|
||||
}
|
||||
let seeds: Vec<Finding> = frontier.iter().take(CHAIN_SEEDS_PER_ROUND).cloned().collect();
|
||||
let _ = tx.send(format!("⛓ attack-chain round {round}/{max_rounds} — expanding {} foothold(s), {} loot item(s)", seeds.len(), loot.len())).await;
|
||||
|
||||
let loot_snapshot = loot.clone();
|
||||
let results: Vec<(Vec<Finding>, Vec<String>)> = stream::iter(seeds.into_iter())
|
||||
.map(|seed| {
|
||||
let (dir, rc, rb, ls, txc) = (directives.clone(), recon_ctx.clone(), recipe_block.clone(), loot_snapshot.clone(), tx.clone());
|
||||
async move { chain_from_seed(pool, &cfg.target, &dir, &rc, &rb, &seed, &ls, round, max_rounds, &txc).await }
|
||||
})
|
||||
.buffer_unordered(4)
|
||||
.collect()
|
||||
.await;
|
||||
|
||||
// Merge round output: accumulate loot, gather candidate findings.
|
||||
let mut round_cands: Vec<Finding> = Vec::new();
|
||||
for (fs, lt) in results {
|
||||
for l in lt {
|
||||
if !loot.iter().any(|x| x.eq_ignore_ascii_case(&l)) { loot.push(l); }
|
||||
}
|
||||
round_cands.extend(fs);
|
||||
}
|
||||
// Keep only genuinely NEW findings (unseen key).
|
||||
let fresh: Vec<Finding> = dedup_findings(round_cands)
|
||||
.into_iter()
|
||||
.filter(|f| seen.insert(finding_key(f)))
|
||||
.collect();
|
||||
if fresh.is_empty() {
|
||||
let _ = tx.send("⛓ no new paths this round — chain exhausted".into()).await;
|
||||
break;
|
||||
}
|
||||
// Validate before pivoting further (don't chain off false positives).
|
||||
let validated = validate(fresh, pool, VOTE_SYS, cfg.vote_n, tx).await;
|
||||
let _ = tx.send(format!("⛓ round {round}: +{} validated finding(s), {} loot item(s) total", validated.len(), loot.len())).await;
|
||||
if validated.is_empty() {
|
||||
break;
|
||||
}
|
||||
all_new.extend(validated.clone());
|
||||
// Next round expands the freshly-validated footholds, best-first.
|
||||
frontier = validated;
|
||||
frontier.sort_by(|a, b| sev_rank(&b.severity).cmp(&sev_rank(&a.severity)));
|
||||
}
|
||||
if !all_new.is_empty() {
|
||||
let _ = tx.send(format!("⛓ attack-chaining added {} finding(s) across pivots", all_new.len())).await;
|
||||
}
|
||||
all_new
|
||||
}
|
||||
|
||||
/// Expand ONE foothold: the agent decides directions, does post-exploitation and
|
||||
/// pivots, and returns new findings + discovered loot.
|
||||
async fn chain_from_seed(pool: &ModelPool, target: &str, directives: &str, recon_ctx: &str,
|
||||
recipe_block: &str, seed: &Finding, loot: &[String],
|
||||
round: usize, max: usize, tx: &Sender<String>) -> (Vec<Finding>, Vec<String>) {
|
||||
if pool.stop_exploiting() {
|
||||
return (vec![], vec![]);
|
||||
}
|
||||
let loot_block = if loot.is_empty() {
|
||||
"(none yet)".to_string()
|
||||
} else {
|
||||
loot.iter().take(30).map(|l| format!("- {l}")).collect::<Vec<_>>().join("\n")
|
||||
};
|
||||
let short: String = seed.title.chars().take(28).collect();
|
||||
let user = format!(
|
||||
"AUTHORIZED engagement on {target}.\n\n{directives}{react}{depth}{doctrine}{recipe_block}\
|
||||
CONFIRMED FINDINGS TO CHAIN:\n{summary}\n\nRecon:\n{recon_ctx}\n\n\
|
||||
Chain these into deeper impact (e.g. SQLi→RCE→LPE, SSRF→cloud creds, upload→LFI→RCE) and PROVE each stage. \
|
||||
Reply ONLY a JSON array of NEW findings \
|
||||
(may be []): {{id,title,severity,cwe,endpoint,payload,evidence,impact,remediation,confidence}}.",
|
||||
"AUTHORIZED engagement on {target}.\n\n{directives}{react}{depth}{doctrine}\
|
||||
FOOTHOLD TO EXPAND (round {round}/{max}):\n- [{}] {} @ {} ({})\n payload: {}\n evidence: {}\n\n\
|
||||
LOOT GATHERED (reuse it):\n{loot_block}\n\n{recipe_block}RECON:\n{recon_ctx}\n\n\
|
||||
From THIS foothold, DECIDE the best directions and PROVE new impact — post-exploitation (loot creds/keys/config/source), credential reuse, privilege escalation (horizontal & vertical), lateral movement to adjacent services/hosts, data exfiltration, and NEW attack surface it exposes. Every claim needs a real tool receipt.\n\n\
|
||||
Reply ONLY JSON: {{\"findings\":[{{id,title,severity,cwe,endpoint,payload,evidence,impact,remediation,confidence}}],\"loot\":[\"cred:user:pass@host\",\"token:...\",\"host:10.0.0.5\",\"endpoint:/internal/api\"]}} (empty arrays are fine).",
|
||||
seed.severity, seed.title, seed.endpoint, seed.cwe, seed.payload, seed.evidence,
|
||||
react = REACT_DOCTRINE, depth = DEPTH_DOCTRINE, doctrine = tool_doctrine(pool.mcp_config.is_some()),
|
||||
);
|
||||
match pool.complete_routed(Task::Exploit, "chain", CHAIN_SYS, &user).await {
|
||||
let label = format!("chain:{short}");
|
||||
match pool.complete_routed(Task::Exploit, &label, CHAIN_SYS, &user).await {
|
||||
Ok((m, text)) => {
|
||||
let f = extract_findings(&text, "chain");
|
||||
let _ = tx.send(format!("chain via {} → {} new candidate(s)", m.label(), f.len())).await;
|
||||
f
|
||||
let (f, lt) = extract_chain(&text, "chain");
|
||||
if !f.is_empty() || !lt.is_empty() {
|
||||
let _ = tx.send(format!("chain[{short}] via {} → {} new finding(s), {} loot", m.label(), f.len(), lt.len())).await;
|
||||
}
|
||||
(f, lt)
|
||||
}
|
||||
Err(e) => {
|
||||
let _ = tx.send(format!("chain[{short}] failed: {e}")).await;
|
||||
(vec![], vec![])
|
||||
}
|
||||
Err(e) => { let _ = tx.send(format!("chaining failed: {e}")).await; vec![] }
|
||||
}
|
||||
}
|
||||
|
||||
/// Parse a chain agent reply into (new findings, loot). Accepts the object form
|
||||
/// `{"findings":[...],"loot":[...]}` and falls back to a bare findings array.
|
||||
fn extract_chain(text: &str, agent: &str) -> (Vec<Finding>, Vec<String>) {
|
||||
if let (Some(a), Some(b)) = (text.find('{'), text.rfind('}')) {
|
||||
if b > a {
|
||||
if let Ok(serde_json::Value::Object(o)) = serde_json::from_str::<serde_json::Value>(&text[a..=b]) {
|
||||
if o.contains_key("findings") {
|
||||
let findings = o.get("findings").map(|v| extract_findings(&v.to_string(), agent)).unwrap_or_default();
|
||||
let loot = o.get("loot").and_then(|v| v.as_array())
|
||||
.map(|arr| arr.iter().filter_map(|x| x.as_str().map(|s| s.to_string())).collect())
|
||||
.unwrap_or_default();
|
||||
return (findings, loot);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
(extract_findings(text, agent), vec![])
|
||||
}
|
||||
|
||||
// --------------------------------------------------------------------------- shared
|
||||
|
||||
const SELECT_SYS: &str = "You are a penetration-test orchestrator. Given recon of a target and a catalog of specialist agents, choose ONLY the agents whose preconditions clearly match the target's attack surface. Be selective. Reply with a JSON array of agent names (strings) drawn exactly from the catalog. No prose.";
|
||||
@@ -603,11 +727,11 @@ async fn validate(candidates: Vec<Finding>, pool: &ModelPool, sys: &str, vote_n:
|
||||
let finder = finder.clone();
|
||||
async move {
|
||||
let q = format!(
|
||||
"Finding: {} | severity {} | {} | at {} | payload {} | evidence {}",
|
||||
f.title, f.severity, f.cwe, f.endpoint, f.payload, f.evidence
|
||||
"Finding: {} | severity {} | {} | at {} | payload {} | evidence {} | impact {}",
|
||||
f.title, f.severity, f.cwe, f.endpoint, f.payload, f.evidence, f.impact
|
||||
);
|
||||
let (yes, total) = pool.vote(sys, &q, vote_n, finder.as_deref()).await;
|
||||
f.validated = total > 0 && yes * 2 >= total;
|
||||
f.validated = crate::pool::quorum_confirmed(&f.severity, yes, total);
|
||||
f.votes = format!("{yes}/{total}");
|
||||
if f.confidence == 0.0 && total > 0 {
|
||||
f.confidence = yes as f64 / total as f64;
|
||||
@@ -622,6 +746,37 @@ async fn validate(candidates: Vec<Finding>, pool: &ModelPool, sys: &str, vote_n:
|
||||
validated.into_iter().filter(|f| f.validated).collect()
|
||||
}
|
||||
|
||||
/// Adversarial refutation pass: every confirmed **High/Critical** finding is
|
||||
/// re-examined by a skeptical panel that tries to prove it's a false positive.
|
||||
/// A finding that fails to withstand a majority of skeptics is dropped. Lower
|
||||
/// severities pass through unchanged. Runs only when a real panel exists.
|
||||
async fn refute_pass(findings: Vec<Finding>, pool: &ModelPool, vote_n: usize, tx: &Sender<String>) -> Vec<Finding> {
|
||||
let finder = pool.candidates.first().map(|m| m.label());
|
||||
let mut kept = Vec::new();
|
||||
for mut f in findings {
|
||||
let s = f.severity.to_lowercase();
|
||||
let high = s.starts_with("crit") || s.starts_with("high");
|
||||
if !high || pool.stop_exploiting() {
|
||||
kept.push(f);
|
||||
continue;
|
||||
}
|
||||
let q = format!(
|
||||
"Finding: {} | severity {} | {} | at {} | payload {} | evidence {} | impact {}",
|
||||
f.title, f.severity, f.cwe, f.endpoint, f.payload, f.evidence, f.impact
|
||||
);
|
||||
let (yes, total) = pool.vote(REFUTE_SYS, &q, vote_n.max(2), finder.as_deref()).await;
|
||||
// Survive on no-response (infra failure) or a surviving majority.
|
||||
let survives = total == 0 || yes * 2 > total;
|
||||
if survives {
|
||||
if total > 0 { f.votes = format!("{} · refute {yes}/{total}", f.votes); }
|
||||
kept.push(f);
|
||||
} else {
|
||||
let _ = tx.send(format!("vote {} → dropped by adversarial refute ({yes}/{total})", f.title)).await;
|
||||
}
|
||||
}
|
||||
kept
|
||||
}
|
||||
|
||||
async fn finish(cfg: RunConfig, _lib: &Library, recon: String, transcript: String, mut findings: Vec<Finding>,
|
||||
selected: Vec<Agent>, rl: &mut RlState, tx: Sender<String>) -> RunOutput {
|
||||
// --- Grounding gate: no claim without a tool receipt (anti-hallucination) ---
|
||||
@@ -839,13 +994,7 @@ fn conf(v: Option<&serde_json::Value>) -> f64 {
|
||||
fn dedup_findings(mut v: Vec<Finding>) -> Vec<Finding> {
|
||||
v.sort_by(|a, b| b.confidence.partial_cmp(&a.confidence).unwrap_or(std::cmp::Ordering::Equal));
|
||||
let mut seen = std::collections::HashSet::new();
|
||||
v.into_iter()
|
||||
.filter(|f| {
|
||||
let key = format!("{}|{}|{}", f.cwe.to_lowercase(), f.endpoint.to_lowercase(),
|
||||
f.title.to_lowercase().chars().take(40).collect::<String>());
|
||||
seen.insert(key)
|
||||
})
|
||||
.collect()
|
||||
v.into_iter().filter(|f| seen.insert(finding_key(f))).collect()
|
||||
}
|
||||
|
||||
fn norm_sev(s: &str) -> String {
|
||||
@@ -988,11 +1137,9 @@ pub async fn run_host(cfg: RunConfig, lib: &Library, pool: &ModelPool, tx: Sende
|
||||
let candidates = dedup_findings(raw.iter().flat_map(|(_, _, f)| f.clone()).collect());
|
||||
let _ = tx.send(format!("{} candidate finding(s) (deduped) — validating", candidates.len())).await;
|
||||
let mut findings = validate(candidates, pool, VOTE_SYS, cfg.vote_n, &tx).await;
|
||||
let chained = chain_round(pool, &cfg.target, &recon, &operator_directives(&cfg), &findings, &lib.chains, &tx).await;
|
||||
if !chained.is_empty() {
|
||||
let extra = validate(dedup_findings(chained), pool, VOTE_SYS, cfg.vote_n, &tx).await;
|
||||
findings.extend(extra);
|
||||
findings = dedup_findings(findings);
|
||||
}
|
||||
let chained = attack_chain(pool, &cfg, &recon, &findings, &lib.chains, &tx).await;
|
||||
findings.extend(chained);
|
||||
findings = dedup_findings(findings);
|
||||
let findings = refute_pass(findings, pool, cfg.vote_n, &tx).await;
|
||||
finish(cfg, lib, recon, transcript, findings, selected, &mut rl, tx).await
|
||||
}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
//! POMDP decision layer (v3.5.2): value-of-information planning + the
|
||||
//! POMDP decision layer (v3.5.4): value-of-information planning + the
|
||||
//! anti-hallucination gate.
|
||||
//!
|
||||
//! The choice "scan more vs exploit now" is **not** a heuristic here — it falls
|
||||
|
||||
@@ -312,12 +312,7 @@ impl ModelPool {
|
||||
};
|
||||
if let Ok(text) = self.one("validate", m, system, user).await {
|
||||
total += 1;
|
||||
let t = text.to_lowercase();
|
||||
if t.contains("\"verdict\": \"confirmed\"")
|
||||
|| t.trim_start().starts_with("yes")
|
||||
|| t.contains("confirmed: true")
|
||||
|| t.contains("is_real\": true")
|
||||
{
|
||||
if parse_verdict(&text) == Verdict::Confirmed {
|
||||
confirmed += 1;
|
||||
}
|
||||
}
|
||||
@@ -333,3 +328,97 @@ async fn wait_cancelled(flag: &Arc<AtomicBool>) {
|
||||
tokio::time::sleep(Duration::from_millis(120)).await;
|
||||
}
|
||||
}
|
||||
|
||||
/// A validator's verdict on a candidate finding.
|
||||
#[derive(Debug, PartialEq, Eq)]
|
||||
pub enum Verdict {
|
||||
Confirmed,
|
||||
Rejected,
|
||||
/// No clear yes/no — treated conservatively as NOT confirmed.
|
||||
Unclear,
|
||||
}
|
||||
|
||||
/// Robustly parse a validator reply into a verdict. Whitespace-insensitive
|
||||
/// (so `{"verdict":"confirmed"}` and `{ "verdict": "confirmed" }` both match),
|
||||
/// checks explicit rejection first, and only counts an *explicit* confirmation.
|
||||
/// Anything ambiguous is `Unclear` (does not count as confirmed) — biasing the
|
||||
/// pipeline against false positives.
|
||||
pub fn parse_verdict(text: &str) -> Verdict {
|
||||
let lower = text.to_lowercase();
|
||||
let dense: String = lower.chars().filter(|c| !c.is_whitespace()).collect();
|
||||
|
||||
// Explicit rejection wins (conservative).
|
||||
let rejected = [
|
||||
"\"verdict\":\"rejected\"", "\"verdict\":\"reject\"", "verdict:rejected",
|
||||
"\"is_real\":false", "\"isreal\":false", "\"confirmed\":false", "\"real\":false",
|
||||
"\"exploitable\":false", "\"valid\":false",
|
||||
];
|
||||
if rejected.iter().any(|k| dense.contains(k)) {
|
||||
return Verdict::Rejected;
|
||||
}
|
||||
// Explicit confirmation.
|
||||
let confirmed = [
|
||||
"\"verdict\":\"confirmed\"", "verdict:confirmed",
|
||||
"\"is_real\":true", "\"isreal\":true", "\"confirmed\":true", "\"real\":true",
|
||||
"\"exploitable\":true", "\"valid\":true",
|
||||
];
|
||||
if confirmed.iter().any(|k| dense.contains(k)) {
|
||||
return Verdict::Confirmed;
|
||||
}
|
||||
// Fallback: only a leading, unambiguous "yes" counts as confirmation.
|
||||
if lower.trim_start().starts_with("yes") {
|
||||
return Verdict::Confirmed;
|
||||
}
|
||||
Verdict::Unclear
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod verdict_tests {
|
||||
use super::*;
|
||||
#[test]
|
||||
fn parses_json_and_prose() {
|
||||
assert_eq!(parse_verdict(r#"{"verdict":"confirmed","reason":"x"}"#), Verdict::Confirmed);
|
||||
assert_eq!(parse_verdict(r#"{ "verdict": "confirmed" }"#), Verdict::Confirmed);
|
||||
assert_eq!(parse_verdict(r#"{ "verdict": "rejected" }"#), Verdict::Rejected);
|
||||
assert_eq!(parse_verdict(r#"{"is_real": false}"#), Verdict::Rejected);
|
||||
assert_eq!(parse_verdict("Yes, the evidence proves RCE."), Verdict::Confirmed);
|
||||
assert_eq!(parse_verdict("This looks theoretical."), Verdict::Unclear); // not counted
|
||||
}
|
||||
#[test]
|
||||
fn rejection_beats_confirmation_when_both_present() {
|
||||
// an answer that says confirmed:false must not be read as confirmed
|
||||
assert_eq!(parse_verdict(r#"{"confirmed": false, "note": "verdict was confirmed earlier"}"#), Verdict::Rejected);
|
||||
}
|
||||
#[test]
|
||||
fn quorum_is_severity_aware() {
|
||||
// high/critical: need >=2 votes AND >=2/3
|
||||
assert!(!quorum_confirmed("High", 1, 2));
|
||||
assert!(quorum_confirmed("High", 2, 2));
|
||||
assert!(quorum_confirmed("Critical", 2, 3));
|
||||
assert!(!quorum_confirmed("Critical", 1, 3));
|
||||
// single validator: majority applies to all
|
||||
assert!(quorum_confirmed("Critical", 1, 1));
|
||||
// low/medium: strict majority (more than half)
|
||||
assert!(quorum_confirmed("Low", 1, 1));
|
||||
assert!(!quorum_confirmed("Medium", 1, 2));
|
||||
assert!(quorum_confirmed("Low", 2, 3));
|
||||
assert!(!quorum_confirmed("Low", 0, 2));
|
||||
}
|
||||
}
|
||||
|
||||
/// Severity-aware confirmation quorum. False High/Critical findings are the most
|
||||
/// costly, so they require ≥2 validators AND ≥2/3 agreement; lower severities
|
||||
/// pass on a strict majority (more than half). With only one validator available
|
||||
/// (single-model panel) the majority rule applies to all severities.
|
||||
pub fn quorum_confirmed(severity: &str, yes: usize, total: usize) -> bool {
|
||||
if total == 0 {
|
||||
return false;
|
||||
}
|
||||
let s = severity.to_lowercase();
|
||||
let high = s.starts_with("crit") || s.starts_with("high");
|
||||
if high && total >= 2 {
|
||||
yes * 3 >= total * 2 // ≥ two-thirds
|
||||
} else {
|
||||
yes * 2 > total // strict majority
|
||||
}
|
||||
}
|
||||
|
||||
@@ -97,9 +97,9 @@ pub fn html(target: &str, findings: &[Finding]) -> String {
|
||||
h4{{margin:12px 0 3px;font-size:12px;text-transform:uppercase;letter-spacing:.5px;color:#8b5cf6}}\
|
||||
.b{{color:#8b5cf6;font-weight:800}}</style></head><body>\
|
||||
<h1><span class=b>NeuroSploit</span> Penetration Test Report</h1>\
|
||||
<div class=meta>Target: <b>{t}</b> · v3.5.2 Rust harness · multi-model validated</div>\
|
||||
<div class=meta>Target: <b>{t}</b> · v3.5.4 Rust harness · multi-model validated</div>\
|
||||
<div>{chips}</div>{graph_block}<h2>Findings ({n})</h2>{body}\
|
||||
<p class=meta>Authorized testing only. Findings confirmed by multi-model adversarial voting.<br>NeuroSploit v3.5.2 · by <b>Joas A Santos</b> & <b>Red Team Leaders</b></p></body></html>",
|
||||
<p class=meta>Authorized testing only. Findings confirmed by multi-model adversarial voting.<br>NeuroSploit v3.5.4 · by <b>Joas A Santos</b> & <b>Red Team Leaders</b></p></body></html>",
|
||||
t = esc(target), chips = chips, n = sorted.len(), body = body, graph_block = graph_block,
|
||||
)
|
||||
}
|
||||
@@ -135,7 +135,7 @@ pub fn typst_report(target: &str, findings: &[Finding], dir: &Path) -> std::io::
|
||||
let mut data = String::new();
|
||||
data.push_str(&format!(
|
||||
"#let meta = (target: {}, run_id: {}, generated: {}, model: {})\n",
|
||||
tq(target), tq(&run_id), tq("NeuroSploit v3.5.2"), tq("multi-model")
|
||||
tq(target), tq(&run_id), tq("NeuroSploit v3.5.4"), tq("multi-model")
|
||||
));
|
||||
data.push_str("#let findings = (\n");
|
||||
for f in sorted_findings(findings) {
|
||||
|
||||
@@ -123,11 +123,20 @@ pub struct RunConfig {
|
||||
/// agents (skipping recon-based selection) — used by the category picker.
|
||||
#[serde(default)]
|
||||
pub pinned: Vec<String>,
|
||||
/// Attack-chaining depth: how many post-exploitation pivot rounds to run
|
||||
/// from confirmed findings (0 disables chaining). Each round expands the
|
||||
/// newest footholds in new directions, carrying discovered loot forward.
|
||||
#[serde(default = "default_chain_depth")]
|
||||
pub chain_depth: usize,
|
||||
}
|
||||
|
||||
fn default_vote() -> usize {
|
||||
3
|
||||
}
|
||||
|
||||
fn default_chain_depth() -> usize {
|
||||
2
|
||||
}
|
||||
fn default_concurrency() -> usize {
|
||||
8
|
||||
}
|
||||
@@ -149,6 +158,7 @@ impl RunConfig {
|
||||
auth: None,
|
||||
repo: None,
|
||||
pinned: Vec::new(),
|
||||
chain_depth: 2,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -25,7 +25,7 @@ cat <<'BANNER'
|
||||
|
||||
███╗ ██╗███████╗██╗ ██╗██████╗ ██████╗
|
||||
████╗ ██║██╔════╝██║ ██║██╔══██╗██╔═══██╗ NeuroSploit installer
|
||||
██╔██╗ ██║█████╗ ██║ ██║██████╔╝██║ ██║ v3.5.2 — Rust harness
|
||||
██╔██╗ ██║█████╗ ██║ ██║██████╔╝██║ ██║ v3.5.4 — Rust harness
|
||||
██║╚██╗██║██╔══╝ ██║ ██║██╔══██╗██║ ██║ by Joas A Santos
|
||||
██║ ╚████║███████╗╚██████╔╝██║ ██║╚██████╔╝ & Red Team Leaders
|
||||
╚═╝ ╚═══╝╚══════╝ ╚═════╝ ╚═╝ ╚═╝ ╚═════╝
|
||||
|
||||
Reference in New Issue
Block a user