mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-10-19 05:57:45 +02:00
CyberSecurityUPandClaude Opus 4.8
e9da74a981
Harness / CLI - redact: credentials become $SECRET_n in every human-facing report (md/html/json/sarif/typ, findings.md); findings.json & vault keep raw values. - poc: `--only <id> --json` re-tests a single finding (powers the web Re-test). - version bump 4.2.4 → 4.3.0 (Cargo, CLI banner, web). Web console - Attack graph replaces "Generative Attack Path Chaining": one tab, findings ordered by kill-chain stage, click a finding to open it. Mounted in detail + live. - Finding modal: Wire evidence — the real request/response pairs behind a finding (baseline/attack, identity pair, matrix probes, oracle) with wire provenance, the wire-check summary, and recorded flows on the same endpoint. - Per-finding Re-test with dated history (reproduced/changed/gone/unverifiable). - Transcript viewer in the Traces tab (navigable blocks; search spans all agents). - Regression vs the previous run of the same target: new / recurring badges and a "fixed since" banner. - Chains tab: readable formatting (node refs as chips, relations as labels). - Custom lead: describe-it (Claude writes it) OR paste your own agent/system prompt (verbatim); remove a custom lead from the board. - GDPR added to compliance mapping; LLM API keys tab clarified; Reasoning-budget and Authorization layouts fixed; NeuroSploit logo added. Docs / config - README rewritten as a concise landing page; TUTORIAL.md updated to v4.3.0 with new web/graph/Neo4j/wire sections and first-time configuration. - .env.example: v4.3.0, Z.ai/Moonshot keys, Neo4j + graph-salt + capability env. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
161 lines
7.7 KiB
Markdown
Executable File
161 lines
7.7 KiB
Markdown
Executable File
<h1 align="center">🧠 NeuroSploit v4.3.0</h1>
|
|
|
|
<p align="center">
|
|
<a href="https://github.com/JoasASantos/NeuroSploit/stargazers"><img src="https://img.shields.io/github/stars/JoasASantos/NeuroSploit?style=for-the-badge&logo=github&color=8b5cf6" alt="Stars"></a>
|
|
<a href="https://github.com/JoasASantos/NeuroSploit/network/members"><img src="https://img.shields.io/github/forks/JoasASantos/NeuroSploit?style=for-the-badge&logo=github&color=a855f7" alt="Forks"></a>
|
|
<a href="https://github.com/JoasASantos/NeuroSploit/issues"><img src="https://img.shields.io/github/issues/JoasASantos/NeuroSploit?style=for-the-badge&color=22d3ee" alt="Issues"></a>
|
|
</p>
|
|
|
|
<p align="center">
|
|
<img src="https://img.shields.io/badge/Version-4.3.0-blue?style=flat-square">
|
|
<img src="https://img.shields.io/badge/Harness-Rust%20%7C%20tokio-e6b673?style=flat-square">
|
|
<img src="https://img.shields.io/badge/License-MIT-green?style=flat-square">
|
|
<img src="https://img.shields.io/badge/MD%20Agents-486-red?style=flat-square">
|
|
<img src="https://img.shields.io/badge/Modes-Black%20%7C%20White%20%7C%20Grey%20%7C%20Host%20%7C%20AI%20%7C%20Mobile%20%7C%20Container-9cf?style=flat-square">
|
|
</p>
|
|
|
|
<p align="center"><b>Autonomous, multi-model penetration-testing harness — Rust, CLI-first.</b><br>
|
|
<i>by Joas A Santos & Red Team Leaders</i></p>
|
|
|
|
---
|
|
|
|
Give NeuroSploit a **URL, a source repo, a running app, or a host/IP**. A Rust
|
|
harness (`tokio`) drives a **pool of LLMs** — via **API key** or local
|
|
**subscription** (Claude Code / Codex / Gemini / Grok) — and runs the whole
|
|
engagement for you:
|
|
|
|
```
|
|
recon ─▶ pick only the agents that fit the surface ─▶ exploit in parallel
|
|
─▶ wire-check every claim ─▶ cross-model vote ─▶ chain into deeper impact ─▶ report
|
|
```
|
|
|
|
It won't invent findings: **every claim needs a receipt** (raw tool output or a
|
|
`file:line`), is **re-sent by the harness itself** to confirm it reproduces, and
|
|
is adjudicated by a **second model** before it reaches the report.
|
|
|
|
> ⭐ Useful? **Star the repo.**
|
|
> 📖 Deep dive: **[TUTORIAL.md](TUTORIAL.md)** · changelog: **[RELEASE.md](RELEASE.md)** · honest comparison: **[BENCHMARK.md](BENCHMARK.md)**
|
|
|
|
## Install
|
|
|
|
**Linux / macOS** (x64 & arm64):
|
|
```bash
|
|
curl -fsSL https://raw.githubusercontent.com/JoasASantos/NeuroSploit/main/setup.sh | bash
|
|
```
|
|
**Windows** (PowerShell):
|
|
```powershell
|
|
irm https://raw.githubusercontent.com/JoasASantos/NeuroSploit/main/install.ps1 | iex
|
|
```
|
|
The installer sets up Rust if missing, builds the release binary, and links
|
|
`neurosploit` onto your PATH. Build by hand instead:
|
|
```bash
|
|
git clone https://github.com/JoasASantos/NeuroSploit && cd NeuroSploit/neurosploit-rs
|
|
cargo build --release # → target/release/neurosploit
|
|
```
|
|
|
|
## Quick start
|
|
|
|
```bash
|
|
# just run it — the interactive session asks everything, in plain language:
|
|
neurosploit
|
|
|
|
# black-box, subscription login (no API key):
|
|
neurosploit run http://testphp.vulnweb.com/ --subscription --model anthropic:claude-opus-4-8 -v
|
|
|
|
# white-box — review a source repo (file:line evidence):
|
|
neurosploit whitebox /path/to/repo --subscription --model anthropic:claude-opus-4-8 -v
|
|
|
|
# web console — a browser UI over the same CLI:
|
|
cd web && npm start # → http://localhost:4173
|
|
```
|
|
|
|
No subscription? Use an **API key** for any provider instead — see [TUTORIAL.md](TUTORIAL.md#authentication).
|
|
|
|
## Modes
|
|
|
|
| Mode | Command | What it does |
|
|
|------|---------|-------------|
|
|
| **Black-box** | `neurosploit run <url>` | recon → select → exploit → vote → report |
|
|
| **White-box** | `neurosploit whitebox <repo>` | source / SAST review (file:line evidence) |
|
|
| **Grey-box** | `neurosploit greybox <repo> --url <app>` | code review **+** live exploitation together |
|
|
| **Host / Infra** | `neurosploit host <ip> --creds creds.yaml` | Linux / Windows / AD + cloud (AWS/GCP/Azure) |
|
|
| **AI / LLM** | `neurosploit aitest <ai-url>` | jailbreaks, prompt injection, OWASP LLM Top 10 / MCP |
|
|
| **Mobile / Binary** | `neurosploit mobile <app.apk\|.ipa\|bin>` | RE a local artifact (Ghidra / MobSF / Frida) |
|
|
| **Container** | `neurosploit container <image:tag>` | OCI image scan + SBOM (trivy/grype/syft) |
|
|
| **Mission Control** | `neurosploit tui <url>` | live TUI panels + a composer you type in mid-run |
|
|
|
|
## What makes it different
|
|
|
|
- **The harness is the pentester.** Agent selection is recon-driven; findings
|
|
**chain** (reduce a foothold to a primitive — exec / read / write / SSRF /
|
|
identity / secret — then pivot), each stage proven and non-destructive.
|
|
- **Wire-bound evidence** — every reported exchange is re-sent through a
|
|
scope-guarded replay engine and checked against recorded traffic. A claim the
|
|
wire contradicts can't stand as confirmed.
|
|
- **Attack knowledge graph (Neo4j optional)** — the run is a typed graph of
|
|
hosts, services, findings, credentials and impact, spanning **web and internal
|
|
network**. It directs the next move during the run and is written to `graph/`
|
|
even without a database.
|
|
- **Deterministic validation** — per-CWE validators judge the measured
|
|
request/response bytes, not the model's prose. Grounding gate, POMDP belief and
|
|
an anti-hallucination check demote anything the evidence doesn't support.
|
|
- **Secrets never leak the report** — credentials the agents observe become
|
|
`$SECRET_n` in every human-facing report; raw values stay in the run's vault for
|
|
re-testing only.
|
|
- **486 markdown agents** across web, code (SAST), AI, infra/AD/cloud, chains and
|
|
recon — each a self-contained playbook you can read, edit or add to.
|
|
- **Run via API key or subscription**, 19 providers, including local & CPU-only
|
|
(`ollama:` / `llamacpp:`) with no data leaving the host.
|
|
|
|
## Web console
|
|
|
|
```bash
|
|
cd web && npm start # → http://localhost:4173
|
|
```
|
|
A browser UI that drives the **same CLI** — no second engine. Launch and watch a
|
|
run live, then per finding:
|
|
|
|
- **Attack graph** — host → service → finding → credential → impact, every edge
|
|
marked confirmed / needs-validation / hypothesis, ordered by kill-chain stage.
|
|
- **Wire evidence** — the real request/response pairs behind a finding (baseline
|
|
vs. attack, the identity pair, matrix probes, the oracle), each tagged with its
|
|
wire provenance — the proof as bytes, not prose.
|
|
- **Re-test one finding** — re-run its proof through the replay engine; the dated
|
|
history shows a finding drift to "gone" over time.
|
|
- **Transcript viewer** — any agent's run, split into navigable blocks; search
|
|
spans every agent.
|
|
- Chains, dependency todolist, recorded traffic, deliverables, PDF export.
|
|
|
|
## What a run leaves behind
|
|
|
|
Every run is a self-contained folder, `runs/ns-<ts>-<target>/`:
|
|
|
|
| File | Contents |
|
|
|------|----------|
|
|
| `report.html` · `report.pdf` · `report.md` | the report (PDF via Typst), secrets redacted |
|
|
| `findings.json` / `findings.md` | validated findings (raw, for tools & re-testing) |
|
|
| `report.sarif` | SARIF 2.1.0 for CI code-scanning |
|
|
| `graph/` | attack chains, dependency todolist, Cypher + JSON export |
|
|
| `recon.json` · `exploitation.md` · `traces/` | surface, transcript, per-agent traces |
|
|
| `pocs/` · `evidence/` | runnable PoCs and proof screenshots |
|
|
|
|
## Integrations
|
|
|
|
GitHub / GitLab PR review gate (`neurosploit pr <repo> <n> --fail-on critical`),
|
|
`@neurosploit` mention bot, one Jira card per finding, MCP server
|
|
(`neurosploit mcp`), compliance mapping (PCI-DSS / HIPAA / SOC 2 / GDPR). See
|
|
**[TUTORIAL.md](TUTORIAL.md)**.
|
|
|
|
## Safety
|
|
|
|
For **authorized** testing only. Agents stay in scope, never run destructive / DoS
|
|
actions, and require proof of exploitation. You are responsible for having
|
|
permission for every target.
|
|
|
|
## Credits & license
|
|
|
|
**Joas A Santos** & **Red Team Leaders** — MIT.
|
|
|
|
> This is the slim, **Rust-only** distribution (`neurosploit-rs/` + `agents_md/`).
|
|
> The older Python engine and web GUIs live on the `v3.4.0` branch.
|