Yakha futhi Usebenzise Ibutho Le-Pentesting Elizimele nge-sapper-v2

Yini i-sapper-v2?

i-sapper-v2 iwuhlelo oluzimele, olusebenzisa ama-agent amaningi, olwenzelwe ukuhlola ukungena okunegunya. Esikhundleni sokuthembela ku-agent eyodwa eya ngokuya iba yinkimbinkimbi, ihlela ama-AI amaningi abe ibutho elihlukanisa umsebenzi, lixhumane ngokutholakele, futhi ligcine ulwazi lapho kushintshwa ama-agent.

Le phrojekthi yanqoba isigaba sokuhlunga esiku-inthanethi somncintiswano wesithathu we-Tencent Cloud Intelligent Attack-Defense Challenge futhi yathola Umklomelo Wokuqala ku-GeekCon 2026 AI Challenge. Emcimbini we-Tencent, yaqeda ukusebenza amahora ayisishiyagalombili ingagadiwe, yathola amaphuzu angu-80.18, yathola ama-flag angu-85, isebenzisa cishe amathokheni ayizigidi eziyinkulungwane.

Sebenzisa i-sapper-v2 kuphela ezinhlelweni okungezakho noma lapho unemvume ecacile yokuzihlola. Funda DISCLAIMER.md ngaphambi kokuyifaka noma ukuyisebenzisa.

Indlela uhlelo olusebenza ngayo

Le phrojekthi yakhelwe phezu kwamakhono amathathu ayisisekelo:

• Create: Uhlelo luvula amasession amasha e-AI ku-tmux, okuluvumela ukuthi ludale abasebenzi abangochwepheshe njengoba imisebenzi idinga.
• Language: Ama-agent ayaxhumana ngokufaka imilayezo kumasession okufaka omunye nomunye.
• History: Okutholakele kugcinwa kugrafu enezingqimba yama-fact nama-intent, kunokuba kushiywe ngaphakathi komongo we-agent eyodwa.

Uhlelo lomlando lunezingqimba ezintathu: isihloko, isifinyezo, kanye nedokhumenti yobufakazi. Ama-agent angaqala ngokufunda isihloko esifushane, ahlole isifinyezo lapho kudingeka umongo owengeziwe, bese evula ubufakazi ukuze aqinisekise kabanzi. Lo mklamo unciphisa ukusetshenziswa komongo futhi ulinganise umonakalo obangelwa yi-fact enganembile.

Izindima ngesikhathi sokusebenza

Ngesikhathi isebenza, i-sapper-v2 ihlukanisa ukuxhumanisa, ukwenza, nokutholakala:

• Commander: Ufunda ibhodi, uhlola okuqondiwe, futhi wabela umsebenzi. Akazenzi yena izenzo zokuhlasela.
• Generals: Baphatha ukuhlasela okuyinkimbinkimbi futhi bangazibuthela amaqembu abo.
• Scouts: Benza ukuhlola okufushane futhi basize ukunquma ukuthi okuqondiwe kudinga ukwenziwa ngobuningi noma uphenyo olunzulu.
• Soldiers: Basebenza ngokufana emisebenzini ababelwe yona.
• Signalman: Uqoqa futhi athumele ama-flag angakabikwa esendaweni eyodwa; le ndima yavela ngesikhathi sokusebenza, ayizange ifakwe ikhodi kusengaphambili.
• Watchdog: Iskripthi esingenalo isu esigcina uhlelo lusebenza ngokuphinde siqale i-commander ephahlazekile nge---continue, sijikeleze okhiye, futhi siphathe ukuvalwa kokusebenza.

I-README ichaza amawindi amathathu abonakalayo ngesikhathi sokusebenza: i-commander, ibutho le-AI elisebenza kuma-pane e-tmux, kanye ne-watchdog.

Izici ezibalulekile

• Ukuhlukaniswa komsebenzi ngokufana: Ama-scout, amasoldja, ojenene, kanye ne-commander basebenza ngezibopho ezihlukene.
• Inkumbulo yenhlangano eqhubekayo: Ulwazi luyasinda lapho kushintshwa i-agent ngayinye.
• Ukuzungezisa umongo: Ama-agent omongo wawo ogcwala angashiyela abalandelayo izifundo ezibhaliwe.
• Ukuhlukanisa amazinga amamodeli: Ukucushwa komncintiswano kusebenzise i-GLM-5.3 ku-commander nakojenene, kanye ne-DeepSeek V4.1 Flash kuma-scout nakumasoldja.
• Ukuqina kokusebenza: I-watchdog ingaqala kabusha i-commander, ijikeleze okhiye, futhi igcine ukuqhubeka ngaphandle kokwenza izinqumo zamasu.
• Ukudluliswa phakathi kwemicimbi: I-commander ingakhomba imindeni yezinselele efana ngokwesakhiwo futhi idlulisele izindlela zokusebenza eziphumelele kuma-agent asanda kwabelwa.
• I-Fact-intent CLI: Le phrojekthi inikeza imiyalo nesiqondiso sokusebenzisa igrafu nokusebenzisa ukugeleza komsebenzi kwezinselele eziningi.

Faka i-sapper CLI

Isifaki sokuqala ngokushesha sixhumanisa i-CLI ye-sapper endaweni yayo. Ngokwe-README, i-CLI isebenzisa kuphela ilabhulali ejwayelekile futhi ayinakho okunye okuncikile.

Kusuka empandeni yenqolobane, sebenzisa:

bash install.sh

I-README ayibali ezinye izimfuneko zasendaweni noma izinyathelo zokufaka eziqondene nenkundla. Uma umyalo ungenzi i-sapper itholakale ku-shell yakho, hlola i-install.sh futhi uqinisekise ukuthi indawo okuyiwa kuyo ye-symlink ifakiwe endleleni yakho yezinto ezisebenzisekayo.

Qala ukuhlola okunegunya

Dala ukuhlola okusha nge-sapper setup. Isibonelo esilandelayo sithathwe ekuqaleni okusheshayo kwephrojekthi:

sapper setup --goal "assess http://target" --agents

Faka esikhundleni se-http://target kuphela nge-endpoint efakwe ngaphansi kwemvume yakho ebhaliwe. Inhloso kufanele ichaze ngokucacile ububanzi obuvunyelwe ukuze ama-agent athole umsebenzi ongacacile nhlobo.

Inketho ye---agents iqala ukugeleza komsebenzi okugxile kuma-agent okuboniswa yiphrojekthi. Ngemva kokusetha, hlola ibhodi kanye nomngcele wamanje:

sapper status

Ukubuka kwesimo kungumyalo oyinhloko wokuqala ngokushesha wokuhlola ukuthi umsebenzi uqhubeka kanjani. I-commander isebenzisa ibhodi ukwahlulela okuqondiwe nokwabela ochwepheshe, kunokuba yenze imisebenzi yokuhlola ngokuqondile.

Ukugeleza komsebenzi okuncane kwe-CLI

1. Qinisekisa imvume: Bhala phansi okuqondiwe, isikhathi esivunyelwe, amasu avunyelwe, nemibandela yokumisa ngaphandle kwethuluzi.
2. Faka i-CLI: Sebenzisa bash install.sh usuka kunqolobane oyikloniwe.
3. Chaza inhloso: Sebenzisa sapper setup --goal "assess http://target" --agents nento eqondiwe evunyelwe.
4. Gada ibhodi: Sebenzisa sapper status ukuze ubuyekeze ibhodi nomngcele.
5. Buyekeza ulwazi olugciniwe: Sebenzisa ukugeleza komsebenzi kwe-fact-intent okubhalwe ku-SKILL.md lapho udinga imisebenzi yegrafu eyodwa noma ukuhlolwa kwezinselele eziningi.

Sebenzisa ibutho eligcwele nge-Docker

Indawo yokugcina ikhodi ine-Dockerfile yebutho eliphelele elisekelwe kumphathi. Yakha isithombe usuka empandeni yendawo yokugcina ikhodi:

docker build -f docker/Dockerfile.commander -t sapper:latest .

Ngaphambi kokuqala i-container, lungiselela ama-model gateway, i-key pool, kanye neziguquguquko zemvelo zebhajethi ezichazwe ku-docker/ENV.md. Lezi zilungiselelo zibalulekile ngoba ukwakheka kohlelo kunikeza amazinga ahlukene amamodeli imithwalo yemfanelo ehlukene, futhi kufaka ukuzungezisa okhiye nokusebenza okuqaphela ibhajethi.

I-README iveza ukwethulwa kwe-container ngendlela eyisibonelo:

docker run -d --name sapper ... sapper:latest

I-ellipsis ayisona isiphikiso esilungele ukusetshenziswa ngokoqobo. Yifake esikhundleni ngokuguquguquka kwemvelo okudingekayo nezinye izinketho ze-Docker ezivela emibhalweni yemvelo yendawo yokugcina ikhodi. Ungaqageli iziqinisekiso zokukhiqiza noma ubeke izimfihlo ngokuqondile emlandweni we-shell lapho kutholakala indlela ephephile yokuphatha izimfihlo.

Qonda imfundiso yomphathi

Imfundiso yokusebenza yomphathi igcinwe ku-docker/commander/SKILL.md. I-README igqamisa imigomo eminingana:

• Ukuhlela okuhambisanayo okuqala kokulula: Thumela umsebenzi ngendlela yokuthi okuhlosiwe okulawulekayo kuxazululwe ngesikhathi esisodwa, esikhundleni sokuphoqa lonke ibutho ukuba lidlule endleleni eyodwa enzima.
• Ukusindisa ngesikhathi sebhodlela: Ngasekupheleni komsebenzi, buyekeza okuhlosiwe okuxazululwe ngokwengxenye lapho ubufakazi obukhona bungakhiqiza imiphumela ngokushesha.
• Isiyalo sokumisa ukulahlekelwa: Gwema ukuchitha isikhathi noma amathokheni angenamkhawulo emsebenzini ongavezi inqubekelaphambili.
• Ukuhlukaniswa kwezindima: Londoloza ukunaka komphathi ekufundeni ibhodi, ekwahluleleni, nasekuthumeleni umsebenzi, esikhundleni sokwenza ngokuqondile.

Ukuze uthole inkontileka esemthethweni yokwakheka kohlelo, funda docker/commander/SPEC.md. Ukuze uthole umbiko obheka emuva ochaza indlela uhlelo oluziphathe ngayo ngesikhathi somncintiswano, bheka BATTLE-REPORT.md.

Amathiphu okusebenza athuthukile

Bhala imigomo ehambisana nobubanzi obugunyaziwe

Umgomo wokusetha uba ngumsebenzi ama-agent asebenzela kuwo. Chaza okuhlosiwe okugunyaziwe ngokunembile futhi ugweme amagama abanzi angahunyushwa njengemvume yokuhlola ama-host noma amasevisi angahlobene. Imibhalo yokugunyazwa kwangaphandle isalokhu ingumthombo weqiniso.

Sebenzisa ubufakazi obunezendlalelo esikhundleni sezifinyezo ezinkulu

Gcina amaqiniso asezingeni eliphezulu emfushane, kodwa ugcine ubufakazi obuningiliziwe ngaphansi kwawo. Isihloko kufanele sidlulise umqondo oyinhloko, isifinyezo sichaze ukubaluleka, kanti idokhumenti yobufakazi kufanele isekele ukuqinisekiswa. Lokhu kulandela ukwakheka kwe-sapper-v2 futhi kugwema ukulayisha kaningi yonke imininingwane kumongo we-agent.

Gcina izifundo ngesikhathi sokushintshaniswa kwama-agent

Le phrojekthi yalinganisa ukugcwala komongo wesosha cishe kuma-token angu-260,000 ngesikhathi somkhankaso wayo. Impendulo yayo kwaba ukushintsha isisebenzi, kushiywe incwadi yokusebenza yalowo ozolandela. Lapho ubuyekeza okukhiqizwe umsebenzi, khetha amanothi okudlulisa acacile aqukethe okutholakele okuqinisekisiwe, izindlela ezizanyiwe, imibuzo engakaphendulwa, nezinqubo ezingasetshenziswa kabusha.

Hlukanisa isu nokutholakala

I-watchdog ayinayo ngamabomu indima yamasu. Gcina ukuziphatha kokubuyisela, ukuzungezisa okhiye, nokuqalisa kabusha izinqubo kuhlukene nezinqumo mayelana nokuhlosiwe namasu. Lokhu kwenza kube lula ukuqonda ukuthi isenzo sivela kumphathi noma ku-automation yokugcina uhlelo lusebenza.

Lawula izindleko zama-token namamodeli

Ukwakheka komncintiswano kwe-sapper-v2 kwanikeza amamodeli anamandla ukwenza izinqumo ezisezingeni eliphezulu, namamodeli alula ukwenza ukuhlola nokuqalisa komthamo omkhulu. Uma uphinda ukwakheka okubhaliwe, setha ama-gateway, ama-key pool, namabhajethi ngokusebenzisa iziqondiso zemvelo ze-Docker, futhi uqaphe ukusetshenziswa kuwo wonke umsebenzi ogunyaziwe.

Hlola ubufakazi ngaphambi kokuthemba ulwazi oludlulisiwe

Ukudluliswa phakathi kwezinselelo kungasheshisa umsebenzi lapho okuhlosiwe kwabelana ngesakhiwo, kodwa ukufana akufanele kuthathe indawo yokuqinisekisa. Sebenzisa igrafu enezendlalelo ukuhlola izifinyezo nobufakazi obusekelayo ngaphambi kokusebenzisa incwadi yokusebenza ezuzwe kwenye inselelo.

Ukuphepha nokusetshenziswa okunomthwalo wemfanelo

i-sapper-v2 iyithuluzi lokuphepha elihlaselayo futhi akumele isetshenziselwe ukufinyelela okungagunyaziwe. I-README yayo ixwayisa ngokusobala ngokuthi i-AI ingandisa umonakalo odalwa amathuluzi ahlaselayo. Landela umthetho osebenzayo, thola imvume ecacile, nciphisa ububanzi bokuhlosiwe, sungula ibhajethi nezimo zokumisa, futhi ugcine ukwengamela komuntu okufanele indawo.

Le phrojekthi iphinde iphakamise indlela ye-taggant yesikhathi esizayo: izimpawu ezixhunywe ku-harness ehlaselayo ezingavuza ulwazi olukhomba umthombo kubahlaselwe ngesikhathi sokungena okungekho emthethweni futhi zisekele ukulandelela umthwalo wemfanelo. I-README iveza lokhu njengesiphakamiso esidinga ukwakhiwa kwe-cryptography nomphakathi, hhayi njengesivikelo esikhona abasebenzisi abangathembela kuso namuhla.

Isiphetho

i-sapper-v2 ikhombisa indlela yokubambisana ekuhloleni ukuphepha okuzenzakalelayo: umphathi uthumela umsebenzi, ochwepheshe basebenza ngokuhambisana, i-watchdog igcina ukuqhubeka, kanti igrafu yamaqiniso enezendlalelo igcina ulwazi lwenhlangano. Qala nge-CLI elula, qapha ibhodi nge-sapper status, bese usebenzisa ukusethwa kwe-Docker lapho udinga ibutho eliphelele. Njalo gcina wonke umsebenzi ungaphakathi kokugunyazwa okucacile kanye nesitatimende sokuzikhulula sephrojekthi.