mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-03-30 16:10:55 +02:00
79acfe04a3
## AI-Everywhere Auto Pentest - Pre-stream AI master planning (_ai_master_plan) runs before parallel streams - Stream 1 AI recon analysis (Phase 9: hidden endpoint probing, priority routing) - Stream 2 AI payload generation (replaces hardcoded payloads with context-aware AI) - Stream 3 AI tool output analysis (real findings vs noise classification) - 4 new prompt builders in ai_prompts.py (master_plan, junior_ai_test, tool_analysis, recon_analysis) ## LLM-as-VulnEngine: AI Deep Testing - New _ai_deep_test() iterative loop: OBSERVE→PLAN→EXECUTE→ANALYZE→ADAPT (3 iterations max) - AI-first for top 15 injection types, hardcoded fallback for rest - Per-endpoint AI testing in Phase C instead of single _ai_dynamic_test() - New system prompt context: deep_testing + iterative_testing - Token budget adaptive: 15 normal, 5 when <50k tokens remain ## Container Fix (Critical) - Fixed ENTRYPOINT ["/bin/bash", "-c"] → CMD ["bash"] in Dockerfile.kali - Root cause: Docker ran /bin/bash -c "sleep" "infinity" → missing operand → container exit - All Kali sandbox tools (nuclei, naabu, etc.) now start and execute correctly ## Deep Recon Overhaul - JS analysis: 10→30 files, 11 regex patterns, source map parsing, parameter extraction - Sitemaps: recursive index following (depth 3), 8 candidates, 500 URL cap - API discovery: 7→20 Swagger/OpenAPI paths, 1→6 GraphQL paths, request body schema extraction - Framework detection: 9 frameworks (WordPress, Laravel, Django, Spring, Express, ASP.NET, Rails, Next.js, Flask) - 40+ common hidden/sensitive paths checked (.env, .git, /actuator, /debug, etc.) - API pattern fuzzing: infers endpoints from discovered patterns, batch existence checks - HTTP method discovery via OPTIONS probing - URL normalization and deduplication ## Frontend Fixes - Elapsed time now works for completed scans (computed from started_at→completed_at) - Container telemetry: exit -1 shows "ERR" (yellow), duration shows "N/A" on failure - HTML report rewrite: professional pentest report with cover page, risk gauge, ToC, per-finding cards, print CSS ## Other - Updated rebuild.sh summary and validation - Bug bounty training datasets added Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
81 lines
1.3 KiB
Plaintext
81 lines
1.3 KiB
Plaintext
# ==============================
|
|
# Environment & Secrets
|
|
# ==============================
|
|
.env
|
|
.env.local
|
|
.env.production
|
|
.env.*.local
|
|
|
|
# ==============================
|
|
# Python
|
|
# ==============================
|
|
venv/
|
|
__pycache__/
|
|
*.pyc
|
|
*.pyo
|
|
*.pyd
|
|
*.egg-info/
|
|
dist/
|
|
build/
|
|
*.egg
|
|
|
|
# ==============================
|
|
# Node.js / Frontend
|
|
# ==============================
|
|
frontend/node_modules/
|
|
frontend/dist/
|
|
|
|
# ==============================
|
|
# Database & Scan Data
|
|
# ==============================
|
|
data/neurosploit.db
|
|
data/neurosploit.db.*
|
|
data/*.db
|
|
data/*.db.*
|
|
data/execution_history.json
|
|
data/access_control_learning.json
|
|
data/reports/
|
|
|
|
# ==============================
|
|
# Reports & Screenshots
|
|
# ==============================
|
|
reports/screenshots/
|
|
|
|
# ==============================
|
|
# Logs & PIDs
|
|
# ==============================
|
|
logs/
|
|
.pids/
|
|
*.log
|
|
|
|
# ==============================
|
|
# macOS
|
|
# ==============================
|
|
.DS_Store
|
|
.AppleDouble
|
|
.LSOverride
|
|
|
|
# ==============================
|
|
# IDE & Editor
|
|
# ==============================
|
|
.vscode/
|
|
.idea/
|
|
*.swp
|
|
*.swo
|
|
*~
|
|
|
|
# ==============================
|
|
# Claude Code local config
|
|
# ==============================
|
|
.claude/
|
|
|
|
# ==============================
|
|
# Docker (runtime)
|
|
# ==============================
|
|
docker/*.env
|
|
|
|
# ==============================
|
|
# Results (runtime output)
|
|
# ==============================
|
|
results/
|