Vibe Pentest Ai Security Testing

reason-machines/security-skills/skills/vibe-pentest-ai-security-testing

作者 reason-machines304c245fe992無授權條款11 個星標收錄於 2026年10月9日更新於 2026年10月9日儲存庫2 個月前更新

AI-powered automated penetration testing tool using multi-agent architecture for web applications, APIs, and admin panels

僅含說明Security
AI 產生的概覽

針對網頁應用程式、API 與管理後台的 AI 多代理自動化滲透測試，並產出安全報告。

功能
此技能描述一套以 AI 代理為基礎的黑箱滲透測試流程，適用於網頁應用程式、API 與管理後台。它透過多個平行代理分階段執行指紋辨識、後台入口掃描、瀏覽器登入與工作階段擷取、Katana 爬取、攻擊面測繪、弱點測試、攻擊鏈分析與證據驗證。最後產出 JSON、HTML 與 DOCX 格式的安全評估報告，並附上修補建議。
適用情境
當你需要對網頁應用程式、API 或管理後台進行自動化黑箱安全評估（包含業務邏輯與授權測試）時使用。適合已取得書面授權、且需要以結構化報告記錄發現問題的情境。
執行需求
需要 Python 3.10+、Git，以及 playwright、python-docx、matplotlib、requests、urllib3、argparse、httpx、charset-normalizer、chardet 等套件，並透過 Playwright 安裝 Chromium。需要 Katana 爬蟲（Windows 版已內附，其他系統須自行下載）。AI 代理需設定 OPENAI_API_KEY 或 ANTHROPIC_API_KEY 等大型語言模型憑證，並需要存取目標網路的權限。此技能僅包含說明文件，本身不附帶指令碼。

vibe-pentest-ai-security-testing

Skill by ara.so — Security Skills collection.

Vibe Pentest is an AI Agent-based automated penetration testing tool that uses a multi-agent parallel execution architecture to perform comprehensive black-box penetration testing (including business logic vulnerability assessment) on web applications, APIs, and admin backends. It outputs stable and reliable security reports with actionable remediation recommendations.

Overview

Vibe Pentest orchestrates multiple AI agents to:

  • Fingerprint web technologies and frameworks
  • Crawl and map attack surfaces
  • Execute parallel vulnerability testing across multiple categories
  • Identify business logic flaws
  • Generate comprehensive security reports in HTML and DOCX formats

Version: v1.0.7
License: AGPL-3.0
Primary Language: Python

Installation

Prerequisites

  1. Git (required for auto-update mechanism):
bash
# Clone from Gitee (recommended for better access)git clone https://gitee.com/ok-helloworld/vibe-pentestcd vibe-pentest
# Or from GitHubgit clone https://github.com/ok-helloworld/vibe-pentestcd vibe-pentest
  1. Python 3.10+ and dependencies:
bash
pip install playwright python-docx matplotlib requests urllib3 argparse httpx charset-normalizer chardetplaywright install chromium
  1. Katana Crawler (included for Windows, download for other OS):
    • Windows version included in tools/katana
    • For other OS, see tools/katana_downloads.json for download links

Automated Installation

You can also ask your AI coding agent to install everything:

text
Install vibe-pentest skill including all runtime dependencies from: https://gitee.com/ok-helloworld/vibe-pentest

Project Structure

vibe-pentest/├── scripts/              # Core testing scripts│   ├── run_katana.py    # Crawler wrapper│   ├── prepare_agent_findings.py  # Multi-agent orchestration│   ├── generate_report.py         # Report generation│   └── ...├── tools/               # External tools (katana, etc.)├── workspace/           # Test outputs (created during execution)│   ├── sessions/        # Browser session data│   ├── findings/        # Vulnerability findings│   └── report_result/   # Final reports└── prompts/             # AI prompt templates

Core Testing Workflow

Vibe Pentest follows a 7-phase workflow:

Phase 0: Fingerprinting

Identify web technologies, frameworks, and server information.

python
# Example: Running fingerprint detectionimport subprocessimport json
result = subprocess.run(    ["python", "scripts/fingerprint.py", "--url", "https://example.com"],    capture_output=True,    text=True)
fingerprint = json.loads(result.stdout)print(f"Detected: {fingerprint.get('framework')}, {fingerprint.get('server')}")

Phase 0.5: Backend Entry Scanning

Scan for admin panels and sensitive endpoints.

Phase 1: Authorization Confirmation

Verify written authorization before proceeding.

Phase 2: Browser Login & Credential Extraction

Launch browser for manual login, extract session cookies/tokens.

python
# Example: Browser session extractionfrom playwright.sync_api import sync_playwright
def extract_session(target_url):    with sync_playwright() as p:        browser = p.chromium.launch(headless=False)        context = browser.new_context()        page = context.new_page()                page.goto(target_url)        input("Press Enter after logging in manually...")                # Extract cookies and local storage        cookies = context.cookies()        storage = page.evaluate("() => Object.assign({}, localStorage)")                browser.close()        return {"cookies": cookies, "storage": storage}

Phase 3: Katana Crawling

Use Katana crawler to discover all endpoints and parameters.

python
# Example: Running Katana crawler via scriptimport subprocessimport time
# Run crawler (must execute outside sandbox)proc = subprocess.Popen(    ["python", "scripts/run_katana.py",      "--url", "https://example.com",     "--cookies", "session=abc123"],    stdout=subprocess.PIPE,    stderr=subprocess.PIPE)
# Monitor for max 20 minutestimeout = 1200start_time = time.time()while proc.poll() is None and (time.time() - start_time) < timeout:    time.sleep(10)
if proc.poll() is None:    proc.terminate()    time.sleep(5)  # Wait for results to flush
# Read crawl resultswith open("workspace/crawl_summary.json") as f:    crawl_data = json.load(f)

Phase 4: Data Cleaning

Process crawler output, deduplicate URLs, extract parameters.

Phase 4.5: Attack Surface Mapping

Map discovered endpoints to vulnerability test categories.

Phase 5: Multi-Agent Parallel Testing

Distribute testing across 6 specialized agents using prepared skeleton files.

python
# Example: Preparing agent findings skeletonimport subprocessimport json
# Generate skeleton findings for 6 agentssubprocess.run([    "python", "scripts/prepare_agent_findings.py",    "--targets", "workspace/targets.txt",    "--fingerprint", "workspace/fingerprint.json",    "--output", "workspace/findings"])
# Each agent gets assigned specific test categories:# Agent 1: Authentication & Authorization# Agent 2: Injection Attacks (SQLi, XSS, etc.)# Agent 3: Business Logic & IDOR# Agent 4: File Upload & Path Traversal# Agent 5: API Security & Rate Limiting# Agent 6: Information Disclosure & Misconfigurations

Phase 5.5: Attack Chain Analysis

Identify cross-agent attack chains and compound vulnerabilities.

Phase 5.6: Evidence Verification

Re-verify confirmed vulnerabilities with HTTP evidence.

python
# Example: Verifying SQLi findingimport httpx
def verify_sqli(endpoint, payload, original_response_time):    # Time-based SQLi verification    url = f"{endpoint}?id={payload}"        start = time.time()    response = httpx.get(url, timeout=30)    elapsed = time.time() - start        if elapsed > original_response_time + 5:        return {            "verified": True,            "method": "GET",            "url": url,            "response_time": elapsed,            "status_code": response.status_code        }    return {"verified": False}

Phase 6: Report Generation

Generate comprehensive reports in multiple formats.

python
# Example: Generating final reportimport subprocessfrom datetime import datetime
timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
subprocess.run([    "python", "scripts/generate_report.py",    "--findings-dir", "workspace/findings",    "--fingerprint", "workspace/fingerprint.json",    "--output-json", f"workspace/report_{timestamp}.json",    "--output-html", f"workspace/report_{timestamp}.html",    "--output-docx", f"workspace/report_{timestamp}.docx"])

Configuration

Environment Variables

bash
# Set custom workspace directoryexport VIBE_WORKSPACE="/path/to/workspace"
# Configure crawler timeout (seconds)export KATANA_TIMEOUT=1200
# Set max concurrent agentsexport MAX_AGENTS=6
# Configure LLM provider (for AI agents)export OPENAI_API_KEY=your_key_hereexport ANTHROPIC_API_KEY=your_key_here

Testing Principles

Critical Rules:

  1. All sub-agents MUST actively investigate, not wait for prompts
  2. If Katana runs >20 minutes, terminate and collect results
  3. Test ALL discovered functionality, not just entry points
  4. Attempt 2-3 bypass techniques on failed tests
  5. Iron Law: May modify/delete own test data; NEVER modify production data

Common Usage Patterns

Standard Authorized Testing

python
"""Complete penetration test workflow with single account"""import osimport subprocessimport json
def run_standard_pentest(target_url, auth_statement, account_info):    workspace = "workspace"    os.makedirs(workspace, exist_ok=True)        # Phase 0: Fingerprinting    print("[Phase 0] Fingerprinting...")    subprocess.run(["python", "scripts/fingerprint.py",                    "--url", target_url,                   "--output", f"{workspace}/fingerprint.json"])        # Phase 0.5: Backend scanning    print("[Phase 0.5] Scanning for admin panels...")    subprocess.run(["python", "scripts/admin_scanner.py",                   "--url", target_url,                   "--output", f"{workspace}/admin_entries.json"])        # Phase 1: Confirm authorization    print(f"[Phase 1] Authorization: {auth_statement}")        # Phase 2: Extract session    print("[Phase 2] Launch browser for manual login...")    session_data = extract_session(target_url)    with open(f"{workspace}/sessions/session.json", "w") as f:        json.dump(session_data, f)        # Phase 3: Crawl    print("[Phase 3] Running Katana crawler...")    run_katana(target_url, session_data)        # Phase 4: Clean data    print("[Phase 4] Processing crawler data...")    subprocess.run(["python", "scripts/clean_crawl_data.py",                   "--input", f"{workspace}/crawled_anonymous.jsonl",                   "--output", f"{workspace}/targets.txt"])        # Phase 4.5: Map attack surface    print("[Phase 4.5] Mapping attack surface...")    subprocess.run(["python", "scripts/map_attack_surface.py",                   "--targets", f"{workspace}/targets.txt",                   "--fingerprint", f"{workspace}/fingerprint.json",                   "--output", f"{workspace}/attack_surface.json"])        # Phase 5: Multi-agent testing    print("[Phase 5] Launching 6 parallel agents...")    subprocess.run(["python", "scripts/prepare_agent_findings.py",                   "--targets", f"{workspace}/targets.txt",                   "--fingerprint", f"{workspace}/fingerprint.json",                   "--output", f"{workspace}/findings"])        # Phase 5.5: Attack chain analysis    print("[Phase 5.5] Analyzing attack chains...")    subprocess.run(["python", "scripts/analyze_chains.py",                   "--findings", f"{workspace}/findings",                   "--output", f"{workspace}/attack_chains.json"])        # Phase 5.6: Verify evidence    print("[Phase 5.6] Verifying vulnerability evidence...")    subprocess.run(["python", "scripts/verify_findings.py",                   "--findings", f"{workspace}/findings"])        # Phase 6: Generate reports    print("[Phase 6] Generating final reports...")    timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")    subprocess.run(["python", "scripts/generate_report.py",                   "--findings-dir", f"{workspace}/findings",                   "--output-json", f"{workspace}/report_{timestamp}.json",                   "--output-html", f"{workspace}/report_{timestamp}.html",                   "--output-docx", f"{workspace}/report_{timestamp}.docx"])        print(f"✓ Reports generated in {workspace}/report_result/")
# Usagerun_standard_pentest(    target_url="https://example.com",    auth_statement="Written authorization obtained for full-scope testing",    account_info={"username": "testuser", "password": "from_env"})

Multi-Account Privilege Escalation Testing

python
"""Test for privilege escalation and horizontal authorization bypassusing multiple accounts with different permission levels"""def run_multiuser_pentest(target_url, accounts):    workspace = "workspace"        # Extract sessions for all accounts    sessions = {}    for role, account in accounts.items():        print(f"[Phase 2.{role}] Login as {role}...")        sessions[role] = extract_session(target_url)        with open(f"{workspace}/sessions/{role}_session.json", "w") as f:            json.dump(sessions[role], f)        # Crawl with each role    for role, session in sessions.items():        print(f"[Phase 3.{role}] Crawling as {role}...")        run_katana(target_url, session, output_prefix=role)        # Merge crawl results    subprocess.run(["python", "scripts/merge_crawl_results.py",                   "--inputs", f"{workspace}/*_crawled.jsonl",                   "--output", f"{workspace}/targets.txt"])        # Continue with standard workflow...    # Phase 5 agents will automatically test for IDOR/privilege escalation    # using the multiple session data
# Usagerun_multiuser_pentest(    target_url="https://example.com",    accounts={        "admin": {"username": "admin", "password": "from_env"},        "user": {"username": "normaluser", "password": "from_env"}    })

Report-Only Generation

python
"""Generate reports from existing findings without re-scanningUseful when you need to regenerate reports after manual review"""def generate_reports_only(workspace="workspace"):    from datetime import datetime        timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")        # Phase 5.5: Re-analyze attack chains    subprocess.run(["python", "scripts/analyze_chains.py",                   "--findings", f"{workspace}/findings",                   "--output", f"{workspace}/attack_chains.json"])        # Phase 5.6: Re-verify findings    subprocess.run(["python", "scripts/verify_findings.py",                   "--findings", f"{workspace}/findings"])        # Phase 6: Generate reports    subprocess.run(["python", "scripts/generate_report.py",                   "--findings-dir", f"{workspace}/findings",                   "--fingerprint", f"{workspace}/fingerprint.json",                   "--output-json", f"{workspace}/report_{timestamp}.json",                   "--output-html", f"{workspace}/report_{timestamp}.html",                   "--output-docx", f"{workspace}/report_{timestamp}.docx"])        # Validate report formats    validate_reports(workspace, timestamp)
def validate_reports(workspace, timestamp):    import os        json_path = f"{workspace}/report_{timestamp}.json"    html_path = f"{workspace}/report_{timestamp}.html"    docx_path = f"{workspace}/report_{timestamp}.docx"        assert os.path.exists(json_path), "JSON report missing"    assert os.path.exists(html_path), "HTML report missing"    assert os.path.exists(docx_path), "DOCX report missing"        with open(json_path) as f:        report_data = json.load(f)        assert "findings" in report_data        assert "summary" in report_data        print("✓ All report formats validated")

Troubleshooting

Katana Crawler Issues

Problem: Crawler returns empty results or finishes in <20 seconds

python
# Solution: Verify session cookies are validimport json
with open("workspace/sessions/session.json") as f:    session = json.load(f)    # Check cookie expirationfor cookie in session["cookies"]:    if "expires" in cookie:        print(f"{cookie['name']}: expires {cookie['expires']}")
# Re-extract session if cookies expiredsession = extract_session(target_url)

Problem: Crawler times out or hangs

bash
# Solution: Reduce crawl depth and concurrencypython scripts/run_katana.py \    --url https://example.com \    --depth 3 \    --concurrency 5 \    --timeout 600

Multi-Agent Coordination

Problem: Agents not finding vulnerabilities

python
# Solution: Check that skeleton findings were properly generatedimport os
findings_dir = "workspace/findings"agents = ["auth", "injection", "logic", "upload", "api", "info"]
for agent in agents:    skeleton_path = f"{findings_dir}/{agent}_findings.json"    if not os.path.exists(skeleton_path):        print(f"Missing skeleton for {agent} agent")        # Regenerate skeletons        subprocess.run(["python", "scripts/prepare_agent_findings.py",                       "--targets", "workspace/targets.txt",                       "--fingerprint", "workspace/fingerprint.json",                       "--output", findings_dir])        break

Problem: Agents marking everything as "Potential" without confirmation

text
Reminder for AI agents:- Must attempt actual exploitation, not just theory- Require HTTP request/response evidence for "Confirmed" status- Try 2-3 bypass techniques on WAF/validation failures- Mark as "Potential" only if technical constraints prevent confirmation

Report Generation Failures

Problem: Report missing sections or malformed

python
# Solution: Validate findings structure before report generationdef validate_findings_structure(findings_dir):    import glob        for finding_file in glob.glob(f"{findings_dir}/*_findings.json"):        with open(finding_file) as f:            data = json.load(f)                    required_fields = ["agent_name", "findings", "summary"]        for field in required_fields:            assert field in data, f"Missing {field} in {finding_file}"                    for finding in data["findings"]:            assert "title" in finding            assert "severity" in finding            assert "status" in finding  # Confirmed, Potential, or False Positive            assert "evidence" in finding                print("✓ All findings files valid")
validate_findings_structure("workspace/findings")

Session Extraction Issues

Problem: Browser doesn't launch or session not captured

python
# Solution: Use explicit browser path and user data directoryfrom playwright.sync_api import sync_playwright
def extract_session_robust(target_url):    with sync_playwright() as p:        browser = p.chromium.launch(            headless=False,            executable_path="/usr/bin/chromium",  # Adjust for your system            args=["--disable-blink-features=AutomationControlled"]        )                context = browser.new_context(            viewport={"width": 1920, "height": 1080},            user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64)..."        )                page = context.new_page()        page.goto(target_url)                print("Please log in manually. Press Enter when done...")        input()                # Comprehensive credential extraction        cookies = context.cookies()        storage = page.evaluate("() => Object.assign({}, localStorage)")        session_storage = page.evaluate("() => Object.assign({}, sessionStorage)")                # Capture auth headers from network traffic        auth_headers = {}        def handle_response(response):            if "authorization" in response.request.headers:                auth_headers["Authorization"] = response.request.headers["authorization"]                page.on("response", handle_response)        page.reload()        page.wait_for_load_state("networkidle")                browser.close()                return {            "cookies": cookies,            "localStorage": storage,            "sessionStorage": session_storage,            "headers": auth_headers        }

Best Practices

  1. Always use separate workspaces for different targets to avoid cross-contamination
  2. Verify authorization documentation before starting any test
  3. Test on staging/UAT environments when possible, not production
  4. Review findings manually before delivering reports to clients
  5. Keep vibe-pentest updated using git pull to get latest detection techniques
  6. Use multiple accounts to thoroughly test authorization controls
  7. Document custom test data created during testing for cleanup

Additional Resources

來源與署名

來源：reason-machines/security-skills位於skills/vibe-pentest-ai-security-testing提交304c245

授權條款： 無授權條款

內容歸原作者所有。SourceWeft 從公開儲存庫中收錄這些內容。

檢舉或申請下架

更多來自 reason-machines/security-skills 的技能

Unisecurityguard Academic Whistleblower Archive

reason-machines

指導建立以 GitHub 為基礎的學術職場舉報與遭審查社群媒體證據典藏平台。

Security112 個月前更新

Security Detections Mcp

reason-machines

用於搜尋與分析安全偵測規則並對應 MITRE ATT&CK 涵蓋範圍的 MCP 伺服器技能。

Security112 個月前更新

Security Threat Awareness

reason-machines

提醒使用者警覺偽裝成破解安全軟體的 GitHub 惡意軟體散布倉庫。

Security112 個月前更新

S800 Vehicle Network Security Testing

reason-machines

指導車用 CAN 匯流排與車載網路的安全測試，涵蓋流量擷取、模糊測試、ECU 掃描、重播與 UDS 診斷。

Security112 個月前更新

Pentest Agents Bug Bounty Framework

reason-machines

自主漏洞賞金框架，內含狩獵代理、驗證關卡、漏洞利用鏈與平台 MCP 伺服器。

Security112 個月前更新

Mcp Security Hub

reason-machines

部署並設定 38 個 Docker 化 MCP 伺服器，將攻擊性安全工具接入 AI 助理。

Security112 個月前更新

更多Security技能

Kyc Rules

anthropics

精選

將公司的 KYC/AML 規則表套用於已解析的開戶紀錄，評定風險並給出處理路由。

Security39K2 週前更新

Kyc Rules

anthropics

精選

將公司的 KYC/AML 規則表套用於已解析的開戶紀錄，評定風險並給出處理路由。

Security39K2 週前更新

Compliance Tracking

anthropics

精選

追蹤合規要求、稽核準備情況，以及 SOC 2、ISO 27001、GDPR、HIPAA 和 PCI DSS 等框架的證據。

Security27K今天更新

Dpop Adoption

google

精選

指導為 Google OAuth 平台實作 OAuth 2.0 DPoP（RFC 9449）傳送方約束的更新權杖。

Security21K今天更新

Secops Triage

google

精選

引導 SOC 分析師對 Google SecOps 安全警示進行分診，從調查到結案或升級。

Security21K今天更新

Secops Investigate

google

精選

指導 SOC 分析師在 Google SecOps 中使用 UDM 查詢與時間軸進行深入的安全事件與實體調查。

Security21K今天更新