NeuroSploit

NeuroSploit v4.0.0

Autonomous, multi-model penetration-testing harness — Rust, CLI-only.

by Joas A Santos & Red Team Leaders

⭐ If this is useful, star the repo — it helps a lot.

New here? Read the full Tutorial & User Guide → — every mode, flag, config and example explained. Version-by-version changes live in RELEASE.md.

NeuroSploit turns a URL, a source repository, a running app, or a host/IP into an autonomous security engagement. A Rust harness (tokio) drives a pool of LLMs — via API key or local subscription (Claude Code / Codex / Gemini / Grok) — recons the target, intelligently selects only the agents that match the discovered surface, runs them in parallel, chains findings into deeper impact, and validates every claim by cross-model voting + tool-receipt grounding before reporting. It ships 435 markdown agents and a Mission Control TUI.

Engagement modes

Highlights

• POMDP belief + value-of-information — the target is partially observable, so findings aren't booleans: a property-graph belief carries probabilities, and "scan more vs exploit now" falls out of belief entropy. The may_assert gate is a mathematical anti-hallucination rule (don't claim exploitability while the belief is diffuse).
• Grounding — hard rule: no claim without a receipt (evidence, not paraphrase). Empirical (raw tool output) for black-box/host/AI, symbolic (file:line into the reviewed source — a code citation is the receipt) for white-box SAST & skills audits, and either for grey-box; ungrounded claims are demoted.
• Deterministic HTTP probe — before the model recon, the harness runs a real request/response analysis (status/redirects, security headers, cookie flags, CORS reflection, tech fingerprint, linked JS, 404 baseline, high-signal paths) and feeds those observed facts into recon, so agent selection and exploitation decisions are grounded in evidence — not the model's guess.
• Attack chaining — any primitive pivots. 13 multi-stage chain agents (SQLi→RCE→LPE, SSRF→cloud creds, upload→LFI→RCE→LPE, CVE→RCE→pivot, …) plus a chaining doctrine that turns any confirmed foothold into the next step: reduce it to a primitive (exec / read / write / request-forgery / identity / secret) and pivot — file-upload→RCE, SSRF→metadata creds, IDOR→takeover — reusing looted creds and reasoning about business logic (payment/tenancy/workflow abuse). Each stage proven; strictly non-destructive (no data loss, no DB overwrite, no DoS).
• ☁️ Cloud testing — AWS / GCP / Azure agents that drive the provider CLIs (aws/gcloud/az). Connect via creds.yaml: AWS keys, a Google service-account JSON, or an Azure service principal — see Cloud credentials.
• LLM red-teaming — 30 AI agents that jailbreak & prompt-inject a live AI system across scenarios: AdvPrefix, PAIR, TAP, Crescendo, many-shot, persona/DAN, encoding/obfuscation, refusal-suppression; plus indirect injection (RAG/web/email/tool output), goal hijacking, tool/function-call abuse, and system-prompt exfiltration. Each runs an attacker→LLM-judge loop (baseline refusal → technique → verdict) and proves the bypass with a benign, redacted receipt. Maps to OWASP LLM Top 10 (2025), MCP threats & OWASP AI Exchange; Skill/plugin & n8n files audited white-box.
• Misconfig & CVE hunting → exploitation, safely — a full CVE pipeline: version fingerprint (pin exact versions) → research analyst (map to NVD/GHSA CVEs, judge reachability) → PoC finder (locate/vet/adapt a public PoC) → exploit scripter (write a custom exploit when none exists). Every PoC is written to the run's pocs/ folder and referenced in the report so findings are reproducible. Plus absurd-misconfig agents (exposed .git/.env, debug/actuator, default creds, dashboards, CORS) and rate-limit testing — all under a strict data-safety/PII guardrail (no destructive/state-changing actions; PII proven with a masked sample, never dumped).
• Re-test one vulnerability — --only (repeatable / comma-separated) runs exactly the agent(s) you name and skips recon-based selection — re-test a single finding fast. Works on run / whitebox / greybox; neurosploit agents lists the names.
• White-box stays white-box — code agents run under a static-review doctrine (symbolic file:line receipts, source-to-sink taint tracing, manifest version→CVE) that forbids hallucinated live/black-box network actions, and can emit a repro PoC to pocs/.
• ️ Natural-language REPL — in the interactive session, just describe what you want, in any language: "testa https://loja.com com opus, foco em SQLi, fora de escopo /admin, roda". A hybrid parser sets target/models/focus/ objective/out-of-scope and toggles (Burp, browser, votes, recon depth) and can launch — zero-token deterministic parse for the common shapes, model fallback for anything ambiguous. No flags to memorize.
• CI/CD PR gate — neurosploit pr --fail-on critical reviews a pull request, and on a confirmed finding at/above the threshold it fails the check, sets a neurosploit/security commit status, and posts a REQUEST_CHANGES review — so branch protection blocks the merge. Ready-made GitHub Actions workflows included (PR gate + a @neurosploit mention bot that runs a scan when a writer comments). See Integrations.
• Engagement objective & out-of-scope — give the goal/context and hard exclusions in words (/objective, /scope-out, or --objective / --out-of-scope); both steer every agent prompt.
• Proof screenshots in reports — agents capture visual proof per finding (evidence/-N.png), embedded beside its vulnerability in the Typst/HTML/Markdown reports.
• ️ Local, uncensored & CPU-only models — ollama: and llamacpp: run the whole engagement on your box with no API key and no data leaving the host. llamacpp: speaks to a llama-server OpenAI-compatible endpoint (LLAMACPP_BASE_URL, default localhost:8080); the model is whatever gguf you loaded. Ideal for offline/air-gapped work and unfiltered offensive prompting.
• ️ Burp/ZAP proxy — /proxy (or /burp) routes agent traffic through your local intercepting proxy so you can inspect & replay in Burp.
• ️ Attack graph & kill chain — findings mapped to OWASP / CWE / MITRE ATT&CK / stage; rendered as a Mermaid graph in the report.
• ✅ Cross-model validation — a different model adjudicates each finding; RL-weighted, recon-aware agent selection.
• ️ Mission Control TUI — live header/feed/findings/targets panels + a composer you can type in while the run streams (summary, pause, …).
• Per-project memory — /.neurosploit/ keeps session, run history and command history; the REPL resumes on reopen. No database required.
• Token/cost telemetry, per-agent attribution, graceful Ctrl-C → report or discard, Typst/HTML/JSON/MD reports.

This is the slim, Rust-only distribution (neurosploit-rs/ + agents_md/). The earlier Python engine and web GUIs live on the older v3.4.0 branch.

Install (one line)

Linux / macOS (x64 & arm64):

curl -fsSL https://raw.githubusercontent.com/JoasASantos/NeuroSploit/main/setup.sh | bash

Windows (PowerShell, x64 & arm64):

irm https://raw.githubusercontent.com/JoasASantos/NeuroSploit/main/install.ps1 | iex

Supported platforms

Pure Rust + stdlib, so it builds natively everywhere a stable Rust toolchain runs. The installer auto-detects OS/arch and installs Rust if missing. On native Windows use install.ps1; under WSL2 / Git Bash the setup.sh one-liner also works.

The installer auto-installs Rust if needed, clones the repo to ~/.neurosploit, builds the release binary, and links neurosploit into ~/.local/bin. Re-run it any time to update. Tweak with env vars: NEUROSPLOIT_REF (branch/tag), NEUROSPLOIT_DIR, PREFIX.

Prefer to build by hand?

git clone https://github.com/JoasASantos/NeuroSploit && cd NeuroSploit/neurosploit-rs
cargo build --release      # → target/release/neurosploit

⚡ Quick start (60 seconds)

…

Full step-by-step for every mode (black/white/grey/host) is in TUTORIAL.md.

No login? Use an API key instead — see Authentication.

️ Web console (NEW in v4.0.0)

A browser UI for the same harness — every action spawns the real compiled CLI and parses its output; nothing about the harness logic is reimplemented in the browser.

cd neurosploit-rs && cargo build --release   # once
node web/server.js                            # → http://localhost:4173

Zero npm dependencies (Node built-ins only).

• 5-step engagement wizard — Asset (mode + target/repo) → Scope & Auth (objective, focus, out-of-scope) → Leads (the 435-agent board below) → Model & Run (provider/model picker, API-key vs. subscription toggle, votes/chain-depth/recon) → Review. Every engagement is named up front, so runs are identifiable in history instead of by raw target string.
• Lead board — all 435 agents auto-categorized (Business Logic, Broken Access Control, Injection, LLM Application, Auth & Session, SSRF & Network, Cloud & Infra, …). Toggle a single lead, a whole category (indeterminate when partially selected), or use Select all / Clear all — respects the active search filter. Leave everything off to let the harness's own recon-driven selection choose.
• Custom lead → real agent — "+ Custom lead" doesn't just add a text hint: it calls the claude CLI (Opus, your Anthropic subscription) to generate an actual specialist-agent markdown file into agents_md/vulns/, in the same format every built-in agent uses, pinnable immediately. Falls back to a plain focus-text hint if Claude isn't available.
• Live run view — phase/progress streamed over SSE, a findings table, and Generative Attack Path Chaining: a node/edge graph (root = target, one node per confirmed finding, positioned by kill-chain stage, edges from chains_from when the harness set one) instead of a flat list — click any node or row for the full finding detail, including any PoC script the exploiting agent wrote to pocs/.
• Real REPL underneath run/whitebox/greybox — the wizard scripts an actual interactive neurosploit session (/target, /model, /only, /run, …) instead of a one-shot CLI invocation, so the session keeps reading stdin while the engagement streams. The Activity