🧠 NeuroSploit v4.0.0

Autonomous, multi-model penetration-testing harness — Rust, CLI-only.
by Joas A Santos & Red Team Leaders

⭐ If this is useful, star the repo — it helps a lot.

📖 New here? Read the full Tutorial & User Guide → — every mode, flag, config and example explained. Version-by-version changes live in RELEASE.md.

---

NeuroSploit turns a URL, a source repository, a running app, or a host/IP into an autonomous security engagement. A Rust harness (tokio) drives a pool of LLMs — via API key or local subscription (Claude Code / Codex / Gemini / Grok) — recons the target, intelligently selects only the agents that match the discovered surface, runs them in parallel, chains findings into deeper impact, and validates every claim by cross-model voting + tool-receipt grounding before reporting. It ships 435 markdown agents and a Mission Control TUI.

Engagement modes

Mode	Command	What it does
Black-box	neurosploit run <url>	recon → select → exploit → vote → report
White-box	neurosploit whitebox <repo>	source/SAST review (file:line evidence)
Grey-box	neurosploit greybox <repo> --url <app>	code review + live exploitation together
Host/Infra	neurosploit host <ip> --creds creds.yaml	Linux / Windows / AD and cloud (AWS/GCP/Azure) testing
AI / LLM red-team	neurosploit aitest <ai-url>	jailbreaks & prompt injection + OWASP LLM Top 10 / MCP against a live AI agent
AI Skills / n8n	neurosploit skills <file|folder>	white-box audit of Skill/plugin & n8n workflow definitions
Mission Control	neurosploit tui <url>	live TUI panels + composer during the run
Interactive	neurosploit	persistent REPL session (resumes per project)

Highlights

• 🧠 POMDP belief + value-of-information — the target is partially observable, so findings aren't booleans: a property-graph belief carries probabilities, and "scan more vs exploit now" falls out of belief entropy. The may_assert gate is a mathematical anti-hallucination rule (don't claim exploitability while the belief is diffuse).
• 🧾 Grounding — hard rule: no claim without a receipt (evidence, not paraphrase). Empirical (raw tool output) for black-box/host/AI, symbolic (file:line into the reviewed source — a code citation is the receipt) for white-box SAST & skills audits, and either for grey-box; ungrounded claims are demoted.
• 🔬 Deterministic HTTP probe — before the model recon, the harness runs a real request/response analysis (status/redirects, security headers, cookie flags, CORS reflection, tech fingerprint, linked JS, 404 baseline, high-signal paths) and feeds those observed facts into recon, so agent selection and exploitation decisions are grounded in evidence — not the model's guess.
• 🔗 Attack chaining — any primitive pivots. 13 multi-stage chain agents (SQLi→RCE→LPE, SSRF→cloud creds, upload→LFI→RCE→LPE, CVE→RCE→pivot, …) plus a chaining doctrine that turns any confirmed foothold into the next step: reduce it to a primitive (exec / read / write / request-forgery / identity / secret) and pivot — file-upload→RCE, SSRF→metadata creds, IDOR→takeover — reusing looted creds and reasoning about business logic (payment/tenancy/workflow abuse). Each stage proven; strictly non-destructive (no data loss, no DB overwrite, no DoS).
• ☁️ Cloud testing — AWS / GCP / Azure agents that drive the provider CLIs (aws/gcloud/az). Connect via creds.yaml: AWS keys, a Google service-account JSON, or an Azure service principal — see Cloud credentials.
• 🤖 LLM red-teaming — 30 AI agents that jailbreak & prompt-inject a live AI system across scenarios: AdvPrefix, PAIR, TAP, Crescendo, many-shot, persona/DAN, encoding/obfuscation, refusal-suppression; plus indirect injection (RAG/web/email/tool output), goal hijacking, tool/function-call abuse, and system-prompt exfiltration. Each runs an attacker→LLM-judge loop (baseline refusal → technique → verdict) and proves the bypass with a benign, redacted receipt. Maps to OWASP LLM Top 10 (2025), MCP threats & OWASP AI Exchange; Skill/plugin & n8n files audited white-box.
• 🧰 Misconfig & CVE hunting → exploitation, safely — a full CVE pipeline: version fingerprint (pin exact versions) → research analyst (map to NVD/GHSA CVEs, judge reachability) → PoC finder (locate/vet/adapt a public PoC) → exploit scripter (write a custom exploit when none exists). Every PoC is written to the run's pocs/ folder and referenced in the report so findings are reproducible. Plus absurd-misconfig agents (exposed .git/.env, debug/actuator, default creds, dashboards, CORS) and rate-limit testing — all under a strict data-safety/PII guardrail (no destructive/state-changing actions; PII proven with a masked sample, never dumped).
• 🎯 Re-test one vulnerability — --only <agent> (repeatable / comma-separated) runs exactly the agent(s) you name and skips recon-based selection — re-test a single finding fast. Works on run / whitebox / greybox; neurosploit agents lists the names.
• 🔬 White-box stays white-box — code agents run under a static-review doctrine (symbolic file:line receipts, source-to-sink taint tracing, manifest version→CVE) that forbids hallucinated live/black-box network actions, and can emit a repro PoC to pocs/.
• 🗣️ Natural-language REPL — in the interactive session, just describe what you want, in any language: "testa https://loja.com com opus, foco em SQLi, fora de escopo /admin, roda". A hybrid parser sets target/models/focus/ objective/out-of-scope and toggles (Burp, browser, votes, recon depth) and can launch — zero-token deterministic parse for the common shapes, model fallback for anything ambiguous. No flags to memorize.
• 🔀 CI/CD PR gate — neurosploit pr <repo> <n> --fail-on critical reviews a pull request, and on a confirmed finding at/above the threshold it fails the check, sets a neurosploit/security commit status, and posts a REQUEST_CHANGES review — so branch protection blocks the merge. Ready-made GitHub Actions workflows included (PR gate + a @neurosploit mention bot that runs a scan when a writer comments). See Integrations.
• 🎯 Engagement objective & out-of-scope — give the goal/context and hard exclusions in words (/objective, /scope-out, or --objective / --out-of-scope); both steer every agent prompt.
• 📸 Proof screenshots in reports — agents capture visual proof per finding (evidence/<finding-id>-N.png), embedded beside its vulnerability in the Typst/HTML/Markdown reports.
• 🖥️ Local, uncensored & CPU-only models — ollama: and llamacpp: run the whole engagement on your box with no API key and no data leaving the host. llamacpp: speaks to a llama-server OpenAI-compatible endpoint (LLAMACPP_BASE_URL, default localhost:8080); the model is whatever gguf you loaded. Ideal for offline/air-gapped work and unfiltered offensive prompting.
• 🕵️ Burp/ZAP proxy — /proxy <url> (or /burp) routes agent traffic through your local intercepting proxy so you can inspect & replay in Burp.
• 🗺️ Attack graph & kill chain — findings mapped to OWASP / CWE / MITRE ATT&CK / stage; rendered as a Mermaid graph in the report.
• ✅ Cross-model validation — a different model adjudicates each finding; RL-weighted, recon-aware agent selection.
• 🛰️ Mission Control TUI — live header/feed/findings/targets panels + a composer you can type in while the run streams (summary, pause, …).
• 💾 Per-project memory — <cwd>/.neurosploit/ keeps session, run history and command history; the REPL resumes on reopen. No database required.
• 🪙 Token/cost telemetry, per-agent attribution, graceful Ctrl-C → report or discard, Typst/HTML/JSON/MD reports.

This is the slim, Rust-only distribution (neurosploit-rs/ + agents_md/). The earlier Python engine and web GUIs live on the older v3.4.0 branch.

---

📦 Install (one line)

Linux / macOS (x64 & arm64):

curl -fsSL https://raw.githubusercontent.com/JoasASantos/NeuroSploit/main/setup.sh | bash

Windows (PowerShell, x64 & arm64):

irm https://raw.githubusercontent.com/JoasASantos/NeuroSploit/main/install.ps1 | iex

Supported platforms

OS	x64	arm64
Linux (Kali recommended)	✅	✅
macOS	✅	✅ (Apple Silicon)
Windows	✅	✅

Pure Rust + stdlib, so it builds natively everywhere a stable Rust toolchain runs. The installer auto-detects OS/arch and installs Rust if missing. On native Windows use install.ps1; under WSL2 / Git Bash the setup.sh one-liner also works.

The installer auto-installs Rust if needed, clones the repo to ~/.neurosploit, builds the release binary, and links neurosploit into ~/.local/bin. Re-run it any time to update. Tweak with env vars: NEUROSPLOIT_REF (branch/tag), NEUROSPLOIT_DIR, PREFIX.

Prefer to build by hand?

git clone https://github.com/JoasASantos/NeuroSploit && cd NeuroSploit/neurosploit-rs
cargo build --release      # → target/release/neurosploit

⚡ Quick start (60 seconds)

# easiest path — just run it; the interactive session asks everything:
neurosploit

# or one-liner (subscription login, no API key needed):
neurosploit run http://testphp.vulnweb.com/ --subscription --model anthropic:claude-opus-4-8 -v

# white-box — review a source repository (SAST agents, file:line evidence):
git clone https://github.com/digininja/DVWA /tmp/DVWA
neurosploit whitebox /tmp/DVWA --subscription --model anthropic:claude-opus-4-8 -v

# grey-box — review the code AND exploit the running app together:
neurosploit greybox /tmp/DVWA --url http://localhost:8080/ --creds creds.yaml \
  --subscription --model anthropic:claude-opus-4-8 --mcp -v

# host / infra — Linux / Windows / Active Directory (SSH/Win creds in creds.yaml):
neurosploit host 10.0.0.10 --creds creds.yaml --subscription --model anthropic:claude-opus-4-8 -v

# 🛰  Mission Control TUI — live panels (header/feed/findings/targets) + a composer
#    you can type in WHILE the run streams (summary · pause · errors · notes):
neurosploit tui http://testphp.vulnweb.com/ --subscription --model anthropic:claude-opus-4-8 --mcp

Full step-by-step for every mode (black/white/grey/host) is in TUTORIAL.md.

No login? Use an API key instead — see Authentication.

---

🖥️ Web console (NEW in v4.0.0)

A browser UI for the same harness: a categorized lead board (toggle agents by category, add custom leads, Start Exploitation), a live structured findings view, run history, and a real REPL — all driven by spawning the compiled CLI, never a reimplementation of it.

cd neurosploit-rs && cargo build --release   # once
node web/server.js                            # → http://localhost:4173

Zero npm dependencies. Full API reference: web/API.md.

---

🔌 Integrations (GitHub · GitLab · Jira)

Wire NeuroSploit into your SDLC. Toggle from the REPL (/integrations) or the CLI (neurosploit integrations enable github|gitlab|jira). Tokens are never stored — only the name of the env var is saved; the value is read from your environment.

export GITHUB_TOKEN=ghp_...                 # PAT with `repo` scope (private repos)
neurosploit integrations enable github

# Review a Pull Request's code (clones the PR head, white-box) and comment back:
neurosploit pr digininja/DVWA 42 --subscription --model anthropic:claude-opus-4-8 --comment

# Same, but BLOCK the merge on a confirmed critical: fails the check, sets a
# `neurosploit/security` commit status, and posts a REQUEST_CHANGES review.
neurosploit pr digininja/DVWA 42 --model anthropic:claude-opus-4-8 --comment --fail-on critical

# Watch a branch and re-review on every new commit:
neurosploit watch myorg/private-app --branch main --subscription --model anthropic:claude-opus-4-8

# Private GitLab repo (token-injected clone) — works in whitebox/greybox:
export GITLAB_TOKEN=glpat-... ; neurosploit integrations enable gitlab
neurosploit whitebox https://gitlab.com/myorg/private-svc --subscription --model anthropic:claude-opus-4-8

# Open a Jira card per finding (any engagement):
export JIRA_EMAIL=you@org.com JIRA_API_TOKEN=...      # set base/project once: /integrations setup jira
neurosploit whitebox https://github.com/myorg/app --jira --subscription --model anthropic:claude-opus-4-8

Integration	What you get	Env vars
GitHub	private clone · pr review + comment · PR gate (--fail-on: fail check + commit status + REQUEST_CHANGES) · watch branch	GITHUB_TOKEN
GitLab	private clone for whitebox/greybox	GITLAB_TOKEN
Jira	one card per finding (--jira)	JIRA_EMAIL, JIRA_API_TOKEN

Automations (GitHub Actions)

Two ready-made workflows ship in examples/github-actions/ — copy them into your repo:

• neurosploit-pr-gate.yml — reviews every PR and blocks the merge on a confirmed critical. Make it enforcing: Settings → Branches → require the neurosploit-pr-gate status check (and/or require review to honor the REQUEST_CHANGES). Set ANTHROPIC_API_KEY (or swap the model) in Actions secrets; the built-in GITHUB_TOKEN covers statuses/reviews.
• neurosploit-mention.yml — comment @neurosploit on a PR or issue to trigger a scan (only repo writers can). Text after the mention is the instruction (any language): @neurosploit focus SQLi and IDOR, or @neurosploit scan https://staging.app for a black-box run.

📖 Step-by-step setup for each tool: TUTORIAL-INTEGRATION.md.

---

☁️ Cloud credentials (AWS/GCP/Azure)

Add a cloud block to creds.yaml and the harness exports the right env vars so the AWS/GCP/Azure agents can drive aws / gcloud / az. Secrets stay in your file/secret-manager; agents do read-only enumeration first, never destructive.

# --- AWS: static keys (or a named profile) ---
aws:
  access_key_id: AKIA...
  secret_access_key: ...
  # session_token: ...        # if using temporary creds
  region: us-east-1
  # profile: my-sso-profile   # alternative to keys

# --- GCP: service-account JSON (path recommended; inline single-line also works) ---
gcp:
  service_account_json: /path/to/sa.json
  project: my-project-id

# --- Azure: service principal (recommended for automation) ---
azure:
  tenant_id: ...
  client_id: ...
  client_secret: ...
  subscription_id: ...

neurosploit host my-cloud-account --creds creds.yaml \
  --subscription --model anthropic:claude-opus-4-8 -v

Agents cover IAM privilege-escalation, storage exposure (S3/GCS/Blob), compute & network exposure, secrets (Secrets Manager / Secret Manager / Key Vault), service-account/SP abuse, and identity enumeration (Entra ID). Best-practice auth: AWS access keys or profile; GCP a service-account JSON (GOOGLE_APPLICATION_CREDENTIALS); Azure a service principal (az login --service-principal).

---

👥 Multiple identities — access-control testing (IDOR / BOLA / BFLA)

Give NeuroSploit two or more named roles in creds.yaml and it authenticates as each and tests cross-role access (a low-priv role reaching another user's object or an admin function is a finding):

admin:
  jwt: eyJ...                 # per role: jwt | header (raw) | cookie | apikey | login+username+password
user:
  apikey: abc123              # → X-Api-Key: abc123
victim:
  cookie: "session=deadbeef"

neurosploit run https://app.example --creds creds.yaml \
  --subscription --model anthropic:claude-opus-4-8 -v

Each finding is proven with the authorized vs unauthorized request pair, under the data-safety guardrail (read-only, PII masked).

🏷️ Identification & attribution (anti-plagiarism)

Every request is tagged with an identifying User-Agent (default NeuroSploit/<ver> …, change with /ua or NEUROSPLOIT_UA) plus an X-NeuroSploit-Scan header, and every finding is stamped "Identified and validated by NeuroSploit" — so provenance travels in the traffic, the finding text, findings.json and the report footer.

---

Build

cd neurosploit-rs
cargo build --release        # → target/release/neurosploit

Requires a Rust toolchain (rustup). Recommended: run on Kali Linux (or the Kali Docker image) so the offensive tools the agents use are already present:

docker run -it --rm kalilinux/kali-rolling
apt update && apt install -y curl nmap ffuf nodejs npm
# rustscan (faster port scan): cargo install rustscan   (or grab a release from GitHub)

The agents degrade gracefully: if rustscan isn't installed they use nmap; if neither, they probe with curl. If a Playwright MCP browser is available they use it for JS-heavy pages, otherwise they fall back to curl.

---

Usage

Run with no arguments for an interactive wizard:

./target/release/neurosploit

Or drive it directly:

# Black-box — subscription (no API key), Opus, browser via Playwright if present, verbose
./target/release/neurosploit run http://testphp.vulnweb.com/ \
    --subscription --model anthropic:claude-opus-4-8 --mcp -v

# Black-box — API keys, multi-model voting panel (1st finds, others adjudicate)
./target/release/neurosploit run http://testphp.vulnweb.com/ \
    --model anthropic:claude-opus-4-8 --model openai:gpt-5.1 --vote-n 3

# White-box — clone a vulnerable app and review its source
git clone https://github.com/digininja/DVWA /tmp/DVWA
./target/release/neurosploit whitebox /tmp/DVWA \
    --subscription --model anthropic:claude-opus-4-8 -v

# Offline pipeline self-test (no keys/login needed)
./target/release/neurosploit run http://testphp.vulnweb.com/ --offline

# Utilities
./target/release/neurosploit agents     # library counts
./target/release/neurosploit models      # providers & models
./target/release/neurosploit --help        # full help with examples

Options (run / whitebox)

Flag	Meaning
--model provider:model	Repeatable. First = primary; the rest fail over and form the voting jury.
--subscription	Use the local CLI login (Claude/Codex/Gemini/Grok) instead of an API key.
--mcp	Enable Playwright MCP (auto-provisioned via npx; backends without MCP use built-in tools).
--vote-n N	How many models must agree a finding is real (default 3 / 2 for whitebox).
--max-agents N	Cap agents run (0 = all matching the recon).
--offline	Exercise the full pipeline without calling any model.
-v, --verbose	Log each agent as it launches, recon, and votes.

Authentication — run via API key or subscription

You can run NeuroSploit two ways. They're independent: pick per run.

1) Via API (provider API key)

Export the key(s) for the providers in your model panel, then run without --subscription. Any OpenAI-compatible provider works.

# pick one or more, depending on the models you select
export ANTHROPIC_API_KEY=sk-ant-...        # anthropic:claude-*
export OPENAI_API_KEY=sk-...               # openai:gpt-*
export GEMINI_API_KEY=AIza...              # gemini:gemini-*
export XAI_API_KEY=xai-...                 # xai:grok-*
export NVIDIA_NIM_API_KEY=nvapi-...        # nvidia_nim:*
export DEEPSEEK_API_KEY=...                # deepseek:*
export MISTRAL_API_KEY=...                 # mistral:*
export DASHSCOPE_API_KEY=...               # qwen:*  (Alibaba DashScope)
export GROQ_API_KEY=...                    # groq:*
export TOGETHER_API_KEY=...                # together:*
export MOONSHOT_API_KEY=...                # moonshot:*  (Kimi K3/K2)
export OPENROUTER_API_KEY=...              # openrouter:*
export OPENCODE_API_KEY=...                # opencode:*  (OpenCode Zen gateway)
export NOUS_API_KEY=...                    # nous:*  (Nous Portal — Hermes)
# ollama / llamacpp need no key (local)

# then run via API (note: NO --subscription)
./target/release/neurosploit run http://testphp.vulnweb.com/ \
    --model anthropic:claude-opus-4-8 --vote-n 3 -v

# multi-provider voting panel via API (1st finds, the others adjudicate)
./target/release/neurosploit run http://testphp.vulnweb.com/ \
    --model anthropic:claude-opus-4-8 --model openai:gpt-5.1 --model gemini:gemini-2.5-pro

Or put the keys in a .env and source it (cp .env.example .env; edit; set -a; . ./.env; set +a).

Provider → env var → endpoint (all OpenAI-compatible):

--model prefix	Env var	Base URL
anthropic:	ANTHROPIC_API_KEY	api.anthropic.com
openai:	OPENAI_API_KEY	api.openai.com
gemini:	GEMINI_API_KEY	generativelanguage.googleapis.com
xai:	XAI_API_KEY	api.x.ai
nvidia_nim:	NVIDIA_NIM_API_KEY	integrate.api.nvidia.com
deepseek:	DEEPSEEK_API_KEY	api.deepseek.com
mistral:	MISTRAL_API_KEY	api.mistral.ai
qwen:	DASHSCOPE_API_KEY	dashscope-intl.aliyuncs.com
groq:	GROQ_API_KEY	api.groq.com
together:	TOGETHER_API_KEY	api.together.xyz
moonshot:	MOONSHOT_API_KEY	api.moonshot.ai
openrouter:	OPENROUTER_API_KEY	openrouter.ai
opencode:	OPENCODE_API_KEY	opencode.ai/zen (OpenCode Zen gateway)
nous:	NOUS_API_KEY	inference-api.nousresearch.com (Hermes 4)
ollama:	(none)	localhost:11434
llamacpp:	(none)	localhost:8080

Run ./target/release/neurosploit models for the full provider/model list.

Local, uncensored & CPU-only — ollama: and llamacpp: run entirely on your box with no API key and no data leaving the host. llamacpp: targets a llama-server OpenAI-compatible endpoint (override with LLAMACPP_BASE_URL); the model is whatever gguf you loaded. Ideal for offline engagements and unfiltered offensive prompting.

2) Via subscription (no API key)

--subscription drives your local agentic-CLI login instead of an API key — install and log into one of the CLIs first:

--model prefix	CLI used	Login
anthropic:	claude (Claude Code)	claude then /login
openai:	codex	codex login
gemini:	gemini	gemini login
xai:	grok	grok login
opencode:	opencode	opencode auth login (or /connect in the TUI) — Zen/plan account
nous:	hermes	hermes setup --portal — Nous Portal OAuth

opencode: also gets the Playwright MCP (--mcp) like anthropic/openai do. nous: relies on Hermes's own built-in toolsets (web/terminal/computer-use) instead — it has no CLI-level MCP hook.

./target/release/neurosploit run http://testphp.vulnweb.com/ \
    --subscription --model anthropic:claude-opus-4-8 --mcp -v

---

How it works

target ─▶ recon (curl/nmap/…) ─▶ INTELLIGENT agent selection (recon-aware)
       ─▶ parallel exploitation ─▶ cross-model validation vote
       ─▶ severity/score ─▶ report (HTML + Typst PDF) ─▶ RL reward update

Every run writes a self-contained folder runs/ns-<ts>-<target>/:

File	Contents
status.json	running → complete with a summary
recon.json / recon.md	mapped attack surface
exploitation.md	raw per-agent transcript
findings.json / findings.md	validated findings (reuse by other tools/AIs)
report.html, report.typ, report.pdf	final report (PDF via the Typst engine)

A reinforcement-learning reward store (data/rl_state_rs.json) biases agent selection on future runs.

Agent library — agents_md/ (303)

Category	Count	Purpose
vulns/	196	Exploit a specific vulnerability class
recon/	12	Information gathering / attack surface
code/	78	White-box source-code (SAST) review
meta/	17	Orchestrator, validator, scorers, reporter, RL

Each agent is a self-contained markdown playbook (## User Prompt methodology + ## System Prompt strict anti-false-positive rules). Drop a new .md into the matching folder and the harness picks it up.

---

Safety

For authorized testing only. Agents are instructed to stay in scope, never run destructive/DoS actions, and require proof-of-exploitation. You are responsible for having permission for any target.

Credits

Joas A Santos & Red Team Leaders.

License

MIT.