Isifundo Sokufaka I-Autonomous Pentest Agent Endaweni: Kusukela Ekufakeni Nasekulungiseleleni Kuya Ekuhloleni Okuzenzakalelayo Nasekuhloleni Kabusha

Qala ngokuqonda iphrojekthi nemingcele yokusetshenziswa

Autonomous Pentest Agent iwuhlelo oluzimele lokuhlola ukungena oluqhutshwa ama-Agent amaningi e-LLM, olusebenzisa i-Go backend, i-Next.js frontend kanye ne-PostgreSQL. Iphrojekthi ingaphatha imisebenzi, amafa, amaketango okuhlola, imiphumela etholakele, amarekhodi ethrafikhi, ukugunyazwa kwamathuluzi nezingxoxo ezibandakanya umuntu.

Isaziso esibalulekile sokuphepha nokuhambisana nemithetho: I-README ichaza ngokusobala ukuthi le phrojekthi ingasetshenziselwa ukufunda komuntu siqu, ucwaningo lwekhodi yomthombo nokuqinisekisa ubuchwepheshe endaweni yasendaweni ehlukanisiwe kuphela. Akufanele isetshenziswe kunoma iyiphi iwebhusayithi, isevisi eku-inthanethi, uhlelo oluxhumeke kunethiwekhi, indawo yokukhiqiza noma ukuhlola ukungena kwangempela. Yisebenzise kuphela ezindaweni zokuhlola zasendaweni olawula zona, futhi uthobele imithetho yesifunda sakho ephathelene nokuphepha kwenethiwekhi, ukuvikelwa kwedatha nobugebengu bekhompyutha.

Iphrojekthi inikeza i-Demo eku-inthanethi ukuze uqonde isixhumi esibonakalayo, kodwa ukuthunyelwa nokuqinisekisa kwangempela kufanele kukhawulelwe ngokuqinile endaweni yasendaweni ehlukanisiwe.

Imisebenzi eyinhloko nesixhumi esibonakalayo

Ingxenye yangaphambili yohlelo inikeza amakhasi edeshibhodi, uhlu lwemisebenzi, izikhathi zokwenza, amaketango okuhlola, okutholakele, amafa, imephu yokusabalala kwamafa, ukuqoshwa kwethrafikhi, ukuphathwa kwama-Agent, ukulungiselelwa kwe-LLM, ukugunyazwa kokungenelela namalogi e-backend.

Ideshibhodi isetshenziselwa ukubuka isimo sonke, ukusetshenziswa kwama-Token nomsebenzi oqhubekayo. Amakhasi emisebenzi nezikhathi zokwenza abonisa inqubo yokusebenza komsebenzi, okuhlanganisa izikhathi zama-Agent nokubizwa kwamathuluzi.

Iketango lokuhlola lisetshenziselwa ukubuka ubudlelwano bozalo phakathi kwezinhloso, imiqondo, amaqiniso nokutholakele; ikhasi lokutholakele lisetshenziselwa ukubuka ubungozi nobufakazi bazo, kanti ikhasi lamafa lisetshenziselwa ukuphequlula amafa okuhlosiwe aqoqwe futhi ahlanganiswa uhlelo.

Uhlolojikelele lwesakhiwo sohlelo

Uhlelo lwakhiwe yi-Go monolith backend enefrontend emile ye-Next.js eshumekiwe, i-PostgreSQL, injini yama-Agent kanye nezinye izinhlelo ezisekelayo. I-backend inikeza izinsizakalo ku-frontend nge-REST API, ukuqinisekisa nge-JWT ne-SSE, kanti injini yemisebenzi ihlela i-planner nama-worker abaningi.

Iphrojekthi isebenzisa isakhiwo samagrafu amabili:

• Igrafu yamafa: inqolobane yeqiniso yamafa eyabiwa kuyo yonke imisebenzi, equkethe amanodi ezizinda eziyimpande, izizinda ezingaphansi, ama-IP, izinsizakalo, izinhlelo zokusebenza nama-endpoint.
• Igrafu yokuhlola: irekhoda izinhloso, imiqondo, amaqiniso, izeluleko nokutholakele ngokomsebenzi, futhi ichaza inqubo yokuhlola ngobudlelwano bozalo.
• Ubudlelwano bezindawo zokubambelela: buxhumanisa amanodi okuhlola namafa athile ukuze kubukwe ukusabalala kokuhlolwa kwamafa nobubanzi bokuhlola.

I-Planner ifunda isimo sokuhlola bese isabalalisa izinhloso. I-Worker ithatha inhloso, isebenzisa amathuluzi ukuyenza, bese ibhala amaqiniso, amafa nokutholakele. Ngemva kokushintsha kwegrafu, i-Planner ivuswa futhi, kwakheka umjikelezo ovalekile oqhutshwa yimicimbi. Ama-Worker abaningi bangakwazi nokusesha inqubo yokwenziwa kwabanye o-Worker, kanti uhlu lwe-todo olwabiwe lusiza ukuqhuba izinyathelo eziqhubekayo ngokuncika kwazo phakathi kokuhlela okunemijikelezo eminingi.

Amalungiselelo ngaphambi kokufaka

Ukuqalisa iphrojekthi kudinga okungenani i-PostgreSQL. Ukuze kwenziwe ukuhlola, kudingeka futhi kulungiselelwe i-LLM; ungasebenzisa ANTHROPIC_API_KEY noma OPENAI_API_KEY, noma ukugcwalise kamuva ekhasini elithi “LLM Configuration” kusixhumi esibonakalayo sewebhu.

Kuyanconywa ukuba ulungiselele i-Docker ukuze uqale ngokushesha isizindalwazi nohlelo. Kungakhathaliseki ukuthi ukhetha yiphi indlela yokuthumela, kunconywa ukuthi uqale udale inethiwekhi yokuhlola yasendaweni ehlukanisiwe, wenze ikhophi eyisipele yedatha ebalulekile, futhi uqinisekise ukuthi okuhlosiwe kokuhlola kungokwendawo yokuhlola yasendaweni.

Indlela yokuqala: ukusebenzisa iskripthi sokufaka ngokuchofoza okukodwa

Lena indlela yokufaka enconywa yi-README. Iskripthi sihlola noma sifake i-Docker, bese sikuvumela ukhethe phakathi kokuthunyelwa okuphelele nge-Docker noma ukuhlanganisa nokusebenzisa endaweni.

git clone https://github.com/kutukam/autonomous-pentest-agent.git
cd autonomous-pentest-agent
./install.sh

Uma ukhetha ukuthunyelwa okuphelele nge-Docker, iskripthi sizocela iphasiwedi ye-PostgreSQL. Ungacindezela u-Enter ukuze kukhiqizwe iphasiwedi engahleliwe, ebhalwe ku-.env, bese kusetshenziswa i-docker compose up -d. Uma ukhetha ukusebenzisa endaweni, ungaxhuma kusizindalwazi esivele sikhona noma usebenzise i-Docker ukuqala isizindalwazi; iskripthi sizokhiqiza i-config.json, sihlanganise i-Go binary eyodwa enefrontend eshumekiwe, bese siqalisa isevisi.

Ngemva kokufaka, vakashela http://localhost:8787. Lapho ungena okokuqala, vula /setup ukuze usethe iphasiwedi yomlawuli.

Indlela yesibili: ukusebenzisa i-Docker Compose

Uma ufuna ukulawula imvelo ngesandla, ungasebenzisa i-Compose ngokuqondile:

git clone https://github.com/kutukam/autonomous-pentest-agent.git
cd autonomous-pentest-agent
cp .env.example .env
docker compose up -d

Hlela .env ugcwalise POSTGRES_PASSWORD, bese ulungiselela ANTHROPIC_API_KEY uma kudingeka. Ngemva kokuqalisa, vakashela http://localhost:8787.

Isithombe se-Docker siqukethe amathuluzi ajwayelekile; i-./skills ne-./data zisebenzisa i-bind mount ukuze kugcinwe idatha. I-MCP ekude ingakhethwa njenge-Streamable HTTP noma i-SSE endala kuzilungiselelo zohlelo; uma usebenzisa i-SSE endala, i-URL ivamise ukuba ngu-/sse, futhi kufanele usethe unhlokweni wesicelo othi Authorization=Bearer <token> ngokwezidingo zesevisi.

Indlela yesithathu: ukusebenzisa i-binary eyakhiwe kusengaphambili

Ungaphinda ulande iphakheji elicindezelwe elihambisana nepulatifomu yakho ku-Releases. Ngemva kokulikhipha, ngokuvamile liqukethe apagent, start.sh noma i-start.bat ku-Windows, skills/ kanye ne-config.example.json.

cp config.example.json config.json
./start.sh

Sebenzisa i-start.sh noma i-start.bat ukuqala, ungasebenzisi ngokuqondile i-./apagent. Iskripthi sokuqalisa sinquma ngekhodi yokuphuma ukuthi kufanele yini siqalise uhlelo futhi ngemva kokuphuma kwalo. Umsebenzi wokubuyekeza ngokuchofoza okukodwa ekhasini nawo uncike kule ndlela. Ukuqhuba ngemuva ungasebenzisa:

nohup ./start.sh >apagent.log 2>&1 &

Indlela yesine: ukuhlanganisa kusuka kukhodi yomthombo

Lapho uhlanganisa kusuka kukhodi yomthombo, kufanele uqale wakhe amafayela amile e-frontend, uwakopishe ku-directory eshumekiwe ye-backend, bese uhlanganisa uhlelo lwe-Go usebenzisa ithegi ethi embedui.

cd web && npm ci && npm run build:static && cd ..
cp -r web/out server/webui/dist
CGO_ENABLED=0 go build -tags embedui -o apagent ./cmd/apagent
./start.sh

Uma udinga ukwakha amaphakheji okukhishwa ahambisana namapulatifomu amaningi, sebenzisa:

./build.sh --release

Ngokuzenzakalelayo kuzokhiqizwa amaphakheji amaningi e-Linux, macOS ne-Windows. Ungasebenzisa futhi i-APAGENT_TARGETS ukwenza ngokwezifiso okuhlosiwe. I-UPX ayivunyelwe ngokuzenzakalelayo, ngoba ama-binary azikhishayo acindezelwe angase angahambisani namanye ama-Linux kernel, izindawo ze-virtualization noma izinqubomgomo zokuphepha.

Ukulungiselela isizindalwazi ne-LLM

Lapho usebenzisa ukuhlanganisa kwasendaweni noma i-binary, ungalungiselela i-PostgreSQL ku-config.json:

{
  "database": {
    "host": "127.0.0.1",
    "port": 5432,
    "user": "apagent",
    "password": "yourpass",
    "dbname": "apagent",
    "sslmode": "disable"
  }
}

Ungasebenzisa futhi i-APAGENT_PG_DSN ukuze weqe ukulungiselelwa kokuxhumeka kwesizindalwazi. I-LLM ingalungiselelwa ngeziguquguquko zemvelo:

export ANTHROPIC_API_KEY=sk-...
# noma
export OPENAI_API_KEY=...

Imingcele ongayikhetha ihlanganisa APAGENT_LLM_PROVIDER, APAGENT_LLM_MODEL, APAGENT_LLM_BASE_URL kanye ne-APAGENT_LLM_PROXY. Uma ungafuni ukusebenzisa iziguquguquko zemvelo, ungazigcwalisa ekhasini elithi “LLM Configuration” ku-UI. Inani lama-Worker emsebenzini ngamunye lingashintshwa kokuthi “System Settings”; inani elizenzakalelayo ngu-3.

Inqubo eyisisekelo yokusebenzisa

1. Qedela ukuqaliswa: vakashela isevisi yasendaweni, vula /setup ukuze usethe iphasiwedi yomlawuli, bese uhlola ukuxhumeka kwesizindalwazi.
2. Lungiselela i-LLM: setha imodeli etholakalayo nemingcele edingekayo kuzilungiselelo zemvelo zohlelo noma ekhasini elithi “LLM Configuration”.
3. Lungisa okuhlosiwe kwasendaweni: engeza kuphela amafa owawalawulayo endaweni yokuhlola ehlukanisiwe, futhi uqinisekise ukuthi ngeke kufinyelelwe ezinhlelweni eziku-inthanethi noma ezinsizeni zokukhiqiza.
4. Dala futhi ubuke umsebenzi: phatha imisebenzi ekhasini lemisebenzi, bese ubuka isimo sokusebenza edeshibhodi nasemfuleni womsebenzi.
5. Buka imiphumela yokuhlola: sebenzisa iketango lokuhlola ukuze uqonde ubudlelwano phakathi kwezinhloso, amaqiniso nokutholakele, bese usebenzisa igrafu yamafa ukuze ubuke amafa asevele ahlanganisiwe.
6. Hlola ubufakazi bokwenziwa: buka amarekhodi enqubo emakhasini ezikhathi, okubizwa kwamathuluzi nethrafikhi; lapho kudingeka ukuqinisekiswa komuntu, kusingathe ekhasini lokugunyazwa kokungenelela.

Imephu yokusabalala kwamafa ibonisa amafa angaphakathi kobubanzi namanodi ahlolwe ngesakhiwo esiqondiswa ngamandla, futhi isekela ukufingqa nokuvula amanodi. Ilungele ukuhlola ngokushesha ukuthi yimaphi amafa asevele ehloliwe ngaphakathi kobubanzi bokuhlola kwasendaweni.

Ukuvumelanisa amafa kusuka ku-ScopeSentry

Iphrojekthi isekela ukuvumelanisa amafa kusuka ku-ScopeSentry ukuze kuncishiswe ukuqoqwa okuphindaphindiwe. Vula ikhasi elithi “Asset Sync”, ufake ikheli le-ScopeSentry ne-API Key, bese ukhetha okuhlosiwe nezinhlobo zamafa ofuna ukuzivumelanisa ngokwephrojekthi noma umsebenzi.

• Isekela ukukhetha izinhlobo zezimpahla ngokobubanzi, okuhlanganisa izizinda, izizinda ezingaphansi, ama-IP, amachweba, amasayithi nama-endpoint.
• Ngemva kokungenisa, izimpahla ziqoqwa ngokobubanzi bezimpahla benkampani.
• Imiphumela yokuvumelanisa ingena kugrafu yezimpahla ye-Autonomous Pentest Agent, ukuze isetshenziswe emisebenzini yaselabhorethri yasendaweni elandelayo.

Ukurekhoda Nokugunyaza Ithrafikhi

Uhlelo lunikeza i-proxy yokuqopha ithrafikhi, engacacisa amakheli e-frontend ne-API kanye nekheli le-proxy yethrafikhi ngendlela efana ne-./start.sh -addr :8787 -proxy :8788. Inqubo yokusebenzisa amathuluzi ka-Worker ishiya amarekhodi omsebenzi, kanti indlela yokugunyaza yokunqamula isetshenziswa ukuze umuntu aqinisekise ukusebenza kwethuluzi lapho kudingeka.

Amarekhodi okugunyaza angabukwa ngokuningiliziwe kumarekhodi okugunyaza omhlaba wonke, ekugunyazeni kokunqamula ngaphakathi komsebenzi, nasemakhadini okugunyaza engxoxweni. Lapho usebenzisa uhlelo, qinisekisa ngokucophelela into esebenzayo namapharamitha, futhi uhlale ubekela umgomo endaweni yelabhorethri ehlukanisiwe.

Ukuhlola Kabusha Ubungozi

Ithebhu ethi “Ukuhlola kabusha” emininingwaneni yomsebenzi ikuvumela ukuthi ukhethe ubungozi ngamakhasi, ubuke iziphetho nobufakazi bangaphambilini, futhi uqale iseshini ezimele ye-Agent yokuhlola kabusha. Uhlu lobungozi, imininingwane yobungozi kanye nombono wezimpahla konke kunikeza indawo yokuqala ukuhlola kabusha.

Iziphetho zokuhlola kabusha zihlanganisa “Kusengaphinde kukhiqizwe”, “Sekulungisiwe” kanye “Akunakuqinisekiswa”. Isiphetho, ubufakazi kanye nesixhumanisi seseshini sokuhlola ngakunye kugcinwa emininingwaneni yobungozi. Uma ukuhlola kabusha kuphumelela futhi isiphetho sithi “Sekulungisiwe”, uhlelo lubuyekeza ngokuzenzakalela isimo sokusingathwa kobungozi; ukwenziwa, ukwehluleka, ukumiswa noma ezinye iziphetho azisishintshi ngokuzenzakalela isimo sokuqala.

Lapho i-backend iqala okokuqala, ilungiselela kusengaphambili i-Agent ehlelekayo ethi “Ukuhlola Kabusha Ubungozi”, okuyi-retester. Ingacushwa ku-Agent management, okuhlanganisa imiyalelo, i-LLM, isabelomali sokuqalisa namathuluzi. Uma ubungozi obufanayo busahlolwa kabusha, uhlelo lusebenzisa kabusha iseshini ekhona; ngemva kokumiswa, ukwehluleka noma ukuqalwa kabusha kwesevisi, ukuhlola kungaqalwa futhi. I-README iphinde ichaze ukuthi amarekhodi omlando okuhlola kabusha okwamanje awafakwa ekuthunyelweni kombiko wobungozi noma ephaketheni lokugcinwa komsebenzi, futhi awaxhunyaniswa ngokuzenzakalela nephakethe lethrafikhi.

Ukusetshenziswa Kwe-Reverse Proxy

I-frontend, i-API ne-SSE kunikezwa imbobo eyodwa ye-backend ngokuzenzakalela, ngakho ngokuvamile akudingeki kusethwe NEXT_PUBLIC_SSE_BASE. Uma usebenzisa i-Nginx ukuze uveze i-HTTPS, vala i-SSE buffering futhi usethe isikhathi eside sokulinda sokufunda:

server {
    listen 443 ssl;
    server_name your.domain.com;

    location / {
        proxy_pass http://127.0.0.1:8787;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_buffering off;
        proxy_cache off;
        proxy_read_timeout 3600s;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
    }
}

Uma i-SSE isebenzisa umthombo ohlukile kunekhasi, yilapho kuphela lapho kudingeka khona ukusetha NEXT_PUBLIC_SSE_BASE ngesikhathi sokwakha. Lokhu kuguquguquka kugcinwa ephaketheni elimile ngesikhathi se-next build; ukukusetha ngesikhathi sokuqalisa kwesiqukathi ngeke kusebenze.

Ukuthuthukisa Nokuvikela Idatha

Lapho kuthuthukiswa iphrojekthi, kushintshwa uhlelo kuphela; ivolumu yedatha ye-PostgreSQL, ./data noma ./skills akususwa ngokuzenzakalela. Lapho uhlelo luqala, lwenza ukuqaliswa nokuthuthwa kwesakhiwo sedathabheyisi ngendlela engaphindaphindi imiphumela, ngakho ngokuvamile akudingeki usebenzise ngesandla imibhalo yokuthutha. Nokho, kusafanele wenze isipele se-./data nedathabheyisi ngaphambi kokuthuthukisa.

Kuyanconywa ukuthi wenze isibuyekezo ekhadini elithi “Inguqulo Nezibuyekezo” ekhasini lokucushwa kohlelo. Uhlelo luzolanda iphakethe lokukhishwa lenkundla yamanje, luqinisekise i-SHA256, lwenze ukuhlolwa okufushane, bese umbhalo wokuqalisa uqedela ukushintshwa. Uma ukuqinisekiswa kwehluleka, amafayela esikhashana ayalahlwa; uma inguqulo entsha yehluleka ukuqala ngokulandelana, uhlelo lubuyela ngokuzenzakalela enguqulweni yangaphambilini. Isibuyekezo siqala kabusha isevisi futhi siphazamise imisebenzi esebenzayo, ngakho kufanele senziwe ngesikhathi sokungasebenzi.

Ekusetshenzisweni kwe-Docker, isibuyekezo sekhasi sishintsha uhlelo kuphela, futhi asibuyekezi amathuluzi afana ne-Playwright ne-nmap angaphakathi kwesithombe. Ukuze ubuyekeze isithombe, sebenzisa:

docker compose pull apagent
docker compose up -d apagent

Ungasebenzisa futhi umbhalo wokubuyekeza osendaweni yokugcina:

./update.sh

Ukuthuthukisa Nokuhlola Endaweni Yasendaweni

Imodi yokuthuthukisa ingaqalisa backend, i-proxy yethrafikhi kanye neseva yokuthuthukisa ye-Next.js ngesikhathi esisodwa:

./dev.sh

Ikheli elizenzakalelayo lokufinyelela ngu-http://localhost:5173. Ungazisebenzisa futhi ngokwehlukana:

go run ./cmd/apagent
cd web && npm run dev
go test ./...

Ngaphandle kwe--tags embedui, i-backend ayifaki i-frontend ngaphakathi. Uma ufuna ukubuka kuqala i-frontend kuphela ngaphandle kokuqala i-backend, sebenzisa:

cd web && NEXT_PUBLIC_MOCK=1 npm run dev

Izinto Ezivame Ukuqashelwa

• Qinisekisa ukuthi i-PostgreSQL iqalisiwe, bese uhlola igama lomsebenzisi, iphasiwedi, igama ledathabheyisi kanye nembobo.
• Uma uxhumano lomfudlana womsebenzi luphumelela kodwa kungekho micimbi, hlola ukuthi i-reverse proxy ikucishile yini ukubuffer, futhi uqinisekise ukuthi isikhathi sokulinda soxhumano olude side ngokwanele.
• Lapho usebenzisa inguqulo eyakhiwe kusengaphambili, ungayidluli i-start.sh noma i-start.bat; ngaphandle kwalokho indlela yokushintsha ngokuzenzakalela nokuqalisa kabusha ngemva kokubuyekezwa kwekhasi ingase ingasebenzi kahle.
• Ngemva kokushintsha izinsiza ezimile ze-frontend, kufanele uphinde usebenzise i-npm run build:static, uzikopishe ku-server/webui/dist, bese wakha kabusha.
• Yenza isipele sedathabheyisi, ./data kanye ne-./skills ngaphambi kokuthuthukisa; isakhiwo sedathabheyisi singathuthwa ngokuzenzakalela, kodwa ngeke sibuyele emuva ngokuzenzakalela.
• Ungangenisi izimpahla zangempela eziku-inthanethi, iziqinisekiso zokukhiqiza noma idatha ebucayi ohlelweni lwelabhorethri yasendaweni.

Isifinyezo

I-Autonomous Pentest Agent ihlanganisa isevisi ye-Go, isixhumi esibonakalayo se-Next.js, imodeli yedatha yamagrafu amabili ye-PostgreSQL kanye nokuhlelwa kwama-Agent amaningi e-LLM, inikeze ukuphathwa kwemisebenzi, amaketanga okuhlola, ukumbozwa kwezimpahla, ukulandelelwa kwethrafikhi, ukugunyaza kanye namandla okuhlola kabusha ubungozi. Ungaqala ngokusebenzisa i-Docker noma umbhalo wokufaka endaweni yasendaweni ehlukanisiwe, bese ulungisa idathabheyisi ne-LLM, ekugcineni uqonde kancane kancane ukuziphatha kohlelo ngemisebenzi, igrafu yezimpahla namaseshini okwenza. Ngesikhathi sokusebenzisa, landela ngokuqinile ukusetshenziswa kokufunda kwasendaweni okushiwo iphrojekthi kanye nazo zonke izidingo zomthetho nokuhambisana.

Iphrojekthi inelayisensi ye-AGPL-3.0; uma uyiguqula bese unikeza abasebenzisi isevisi ngenethiwekhi, kufanele uveze ikhodi yomthombo ephelele ehambisanayo ngokwezidingo zelayisensi. Eminye imininingwane yokusetshenziswa ingatholakala kukhodi yomthombo esendaweni yokugcina, ku-norma SDK kanye nefayela le-LICENSE lephrojekthi.