mirror of
https://github.com/Z4nzu/hackingtool.git
synced 2026-11-04 15:00:08 +00:00
Hardik Zinzuvadiya
2482cc9fd0
Squashed rework of hackingtool from a tool launcher into an AI-guided operator
console for authorized security testing. 93 commits collapsed into this one;
the pre-rework tree is tagged v2.0.0.
CATALOG & ENGINE
- Data-driven YAML catalog (21 categories, 215 live tools + 59 archived) with a
registry/overlay loader and a fixed 66-tag taxonomy (63 in use). Adding a tool
is one YAML entry, not edits across the codebase.
- Engine honesty: real exit codes, truthful install success/failure, reuse-first
skip, EOF-safe prompts, command audit logging.
- Safe installs: sha256-required safe-fetch (killed `curl | bash` in feroxbuster,
Caido and Sliver), list-form subprocess only, no forced sudo.
AI LAYER (bring-your-own-key or local model; degrades offline, never fabricates)
- AI1 intent -> tools; AI2 tool+goal -> command, curated-first with a grounded
fallback; AI3 findings summary and engagement report; AI4 per-finding impact
and remediation. Prompt-injection hardened per OWASP LLM01.
- /goal plans an objective and runs it one step at a time, showing every command
before it runs, with a plan.json + run.log audit trail.
/find TOOL DISCOVERY (this branch's headline feature)
- Suggests real GitHub projects when the catalog has no tool for a need.
Deterministic: zero model calls, structured API fields only, suggest-only —
it never clones, installs or runs anything.
- A charter filter refuses destructive/DoS/jamming/mass-targeting/evasion asks
before any network I/O, while a defensive-intent guard keeps blue-team and
DFIR phrasing ("detect a SYN flood in a pcap") from being false-refused.
- Query rewriting proved to be the dominant quality lever (the first design
measured 29% precision with no results on 5 of 8 needs): a curated 41-row
intent table maps plain English to canonical jargon plus a GitHub topic, and
a two-arm search unions topic coverage with jargon precision.
- Explainable additive ranking: log-flattened stars, license/age/language,
trusted-author bonus derived from owners we already ship, docs-repo demotion
by name, staleness as a soft demotion rather than a filter (a hard cutoff
would delete THC-Hydan and John the Ripper), and a relevance term weighting
curated topics above free-text description.
- Optional no-scope GitHub token purely as a rate-limit lever (10 -> 30 req/min);
it reaches only an Authorization header, never a cache key, log or output.
- `[a]` saves a pick to ~/.hackingtool/found.yaml as a structurally inert entry,
and the loader strips executable keys from user catalogs at read time so a
hand-edited file cannot become a runnable command.
CONSOLE & PACKAGING
- REPL with a / command palette, @ tool mentions, tag filters, history and
completion; background tmux panes; settings and first-run scaffolding.
- src-layout package with catalog and pipelines as package data, console entry
point, Docker image, signed releases with SBOM and build provenance.
- Health docs (SECURITY, CONTRIBUTING, CHANGELOG, CODE_OF_CONDUCT), a CI gate
(ruff + pytest + catalog/taxonomy conformance) and a pre-push hook.
- README rewritten with a section index, the tool catalog split into
docs/TOOLS.md and a step-by-step docs/HOW-TO-USE.md.
278 tests passing; scripts/check.sh green.
29 lines
1.1 KiB
Python
29 lines
1.1 KiB
Python
import hackingtool.engagement as engagement
|
|
import hackingtool.report as report
|
|
from hackingtool.findings import Finding, save_findings
|
|
|
|
def _root(tmp_path, monkeypatch):
|
|
monkeypatch.setattr(engagement, "ENGAGEMENTS_ROOT", tmp_path)
|
|
|
|
def test_generate_report(tmp_path, monkeypatch):
|
|
_root(tmp_path, monkeypatch)
|
|
e = engagement.create("acme", targets=["example.com"])
|
|
save_findings(e.findings_file, [
|
|
Finding("subdomain", "a.example.com", "a.example.com", "info", "subfinder", {}, "", "T"),
|
|
Finding("vulnerability", "https://a.example.com/.git/", "Exposed .git", "high",
|
|
"nuclei", {"template_id": "exposed-git"}, "", "T"),
|
|
])
|
|
path = report.generate_report(e)
|
|
text = path.read_text()
|
|
assert path == e.report_file
|
|
assert "# Engagement: acme" in text
|
|
assert "Exposed .git" in text
|
|
assert "high" in text
|
|
assert "a.example.com" in text
|
|
|
|
def test_generate_report_empty(tmp_path, monkeypatch):
|
|
_root(tmp_path, monkeypatch)
|
|
e = engagement.create("empty")
|
|
text = report.generate_report(e).read_text()
|
|
assert "No findings" in text
|