mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-10-18 21:47:32 +02:00
CyberSecurityUPandClaude Opus 4.8
e9da74a981
Harness / CLI - redact: credentials become $SECRET_n in every human-facing report (md/html/json/sarif/typ, findings.md); findings.json & vault keep raw values. - poc: `--only <id> --json` re-tests a single finding (powers the web Re-test). - version bump 4.2.4 → 4.3.0 (Cargo, CLI banner, web). Web console - Attack graph replaces "Generative Attack Path Chaining": one tab, findings ordered by kill-chain stage, click a finding to open it. Mounted in detail + live. - Finding modal: Wire evidence — the real request/response pairs behind a finding (baseline/attack, identity pair, matrix probes, oracle) with wire provenance, the wire-check summary, and recorded flows on the same endpoint. - Per-finding Re-test with dated history (reproduced/changed/gone/unverifiable). - Transcript viewer in the Traces tab (navigable blocks; search spans all agents). - Regression vs the previous run of the same target: new / recurring badges and a "fixed since" banner. - Chains tab: readable formatting (node refs as chips, relations as labels). - Custom lead: describe-it (Claude writes it) OR paste your own agent/system prompt (verbatim); remove a custom lead from the board. - GDPR added to compliance mapping; LLM API keys tab clarified; Reasoning-budget and Authorization layouts fixed; NeuroSploit logo added. Docs / config - README rewritten as a concise landing page; TUTORIAL.md updated to v4.3.0 with new web/graph/Neo4j/wire sections and first-time configuration. - .env.example: v4.3.0, Z.ai/Moonshot keys, Neo4j + graph-salt + capability env. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
106 lines
4.0 KiB
Bash
Executable File
106 lines
4.0 KiB
Bash
Executable File
# NeuroSploit v4.3.0 — environment / API keys (optional)
|
|
# ------------------------------------------------------------------
|
|
# You only need this for the API-key auth path. If you log in with a
|
|
# local subscription CLI instead (--subscription with Claude / Codex /
|
|
# Gemini / Grok), you don't need any key here.
|
|
#
|
|
# Set the key(s) for the providers you use, then load and run:
|
|
# set -a; . ./.env; set +a
|
|
# neurosploit run http://target --model anthropic:claude-opus-4-8 -v
|
|
#
|
|
# Provider prefix -> env var (use as `--model <prefix>:<model>`).
|
|
|
|
# anthropic: https://console.anthropic.com/
|
|
ANTHROPIC_API_KEY=
|
|
|
|
# openai: https://platform.openai.com/api-keys
|
|
OPENAI_API_KEY=
|
|
|
|
# gemini: https://aistudio.google.com/app/apikey
|
|
# (GOOGLE_API_KEY is also accepted as an alias if GEMINI_API_KEY is unset)
|
|
GEMINI_API_KEY=
|
|
#GOOGLE_API_KEY=
|
|
|
|
# azure: Azure OpenAI (OpenAI-compatible). Use `--model azure:<deployment>`
|
|
# (the model name is your Azure *deployment* name).
|
|
#AZURE_OPENAI_API_KEY=
|
|
#AZURE_OPENAI_ENDPOINT=https://your-resource.openai.azure.com
|
|
#AZURE_OPENAI_API_VERSION=2024-10-21
|
|
|
|
# xai: https://console.x.ai/
|
|
XAI_API_KEY=
|
|
|
|
# nvidia_nim: https://build.nvidia.com/ (keys look like nvapi-...)
|
|
NVIDIA_NIM_API_KEY=
|
|
|
|
# deepseek: https://platform.deepseek.com/
|
|
DEEPSEEK_API_KEY=
|
|
|
|
# mistral: https://console.mistral.ai/
|
|
MISTRAL_API_KEY=
|
|
|
|
# qwen: https://dashscope-intl.aliyuncs.com/ (Alibaba DashScope)
|
|
DASHSCOPE_API_KEY=
|
|
|
|
# zai: https://z.ai/ (GLM models)
|
|
ZAI_API_KEY=
|
|
|
|
# moonshot: https://platform.moonshot.ai/ (Kimi models)
|
|
MOONSHOT_API_KEY=
|
|
|
|
# groq: https://console.groq.com/keys
|
|
GROQ_API_KEY=
|
|
|
|
# together: https://api.together.xyz/settings/api-keys
|
|
TOGETHER_API_KEY=
|
|
|
|
# openrouter: https://openrouter.ai/keys
|
|
OPENROUTER_API_KEY=
|
|
|
|
# opencode: https://opencode.ai/auth (OpenCode Zen gateway)
|
|
# Or skip the key entirely and use --subscription with the
|
|
# `opencode` CLI logged into your own Zen/plan account.
|
|
OPENCODE_API_KEY=
|
|
|
|
# nous: Nous Portal (https://portal.nousresearch.com) — Hermes models.
|
|
# Or skip the key entirely and use --subscription with the
|
|
# `hermes` CLI (`hermes setup --portal` for OAuth login).
|
|
NOUS_API_KEY=
|
|
|
|
# ollama: local, no key needed. Override the endpoint if not default:
|
|
#OLLAMA_BASE_URL=http://localhost:11434/v1
|
|
|
|
# litellm: point at your LiteLLM proxy (OpenAI-compatible). Route any
|
|
# model through it as `--model litellm:<model>`.
|
|
#LITELLM_BASE_URL=http://localhost:4000/v1
|
|
LITELLM_API_KEY=
|
|
|
|
# TypeSafe System One (RLCD — Reinforcement Learning for Calibrated Decisions).
|
|
# When set, NeuroSploit adjudicates each finding with a calibrated verdict
|
|
# (confirmed/needs-review/rejected) + an "impact demonstrated" judgment over the
|
|
# EVIDENCE, refining confidence and the needs-review boundary. Additive — never
|
|
# overrules a deterministic validator. Disable with NEUROSPLOIT_TYPESAFE=off.
|
|
TYPESAFE_API_KEY=
|
|
|
|
# ------------------------------------------------------------------
|
|
# Attack-graph memory (Neo4j) — OPTIONAL. The graph is always written to the
|
|
# run's graph/ folder; these only add a live Neo4j sync so paths accumulate
|
|
# across runs. Pass the URI with --neo4j <uri> (or set NEO4J_URI); credentials
|
|
# come ONLY from the environment, never flags, never written to disk.
|
|
#NEO4J_URI=bolt://localhost:7687
|
|
#NEO4J_USER=neo4j
|
|
#NEO4J_PASSWORD=
|
|
#NEO4J_DATABASE=neo4j
|
|
# Salt for the graph's secret fingerprints (so credential reuse correlates
|
|
# without storing any secret). Share one value across a team that shares a Neo4j.
|
|
# Defaults to ~/.neurosploit/graph-salt when unset.
|
|
#NEUROSPLOIT_GRAPH_SALT=
|
|
|
|
# Target-authorization gate — OPTIONAL. When set, the harness verifies a signed
|
|
# capability token (minted with `neurosploit capability issue`) before any recon
|
|
# and refuses targets outside the grant.
|
|
#NEUROSPLOIT_CAPABILITY_KEY=
|
|
#
|
|
# (For blind classes — SSRF/XXE/blind RCE — pass an out-of-band domain you
|
|
# control with the --oob-domain flag; without it those are reported as leads.)
|