feat: AI-driven automated penetration testing #12

Merged

sharang merged 9 commits from feat/ai-pentest into main 2026-03-12 14:42:54 +00:00

Conversation 0 Commits 9 Files Changed 52

+11729 -98

sharang commented 2026-03-12 14:25:18 +00:00

Owner

Copy Link

Copy Source

Summary

• AI-driven pentest orchestrator that autonomously selects and executes security tools against DAST targets
• Pure Dioxus attack chain visualization replacing vis-network JS dependency — features KPI header, phase rail, expandable accordion with tool category chips, risk scores, and findings pills
• Professional PDF-first HTML report with cover page, table of contents, severity distribution chart, phased attack chain timeline, and print-friendly design
• Encrypted ZIP report export (AES-256) with password protection
• Code-aware pentesting that incorporates SAST findings and SBOM data
• MCP tool integration for pentest session management

Test plan

• Start Juice Shop Docker target, run a pentest session end-to-end
• Verify attack chain nodes show findings_produced, risk_score, and llm_reasoning
• Export report ZIP — verify password protection and PDF print layout
• Check attack chain visualization renders phases, KPIs, and tool details correctly
• Verify old pentest sessions still display with session-level fallback stats

🤖 Generated with Claude Code

## Summary - AI-driven pentest orchestrator that autonomously selects and executes security tools against DAST targets - Pure Dioxus attack chain visualization replacing vis-network JS dependency — features KPI header, phase rail, expandable accordion with tool category chips, risk scores, and findings pills - Professional PDF-first HTML report with cover page, table of contents, severity distribution chart, phased attack chain timeline, and print-friendly design - Encrypted ZIP report export (AES-256) with password protection - Code-aware pentesting that incorporates SAST findings and SBOM data - MCP tool integration for pentest session management ## Test plan - [x] Start Juice Shop Docker target, run a pentest session end-to-end - [x] Verify attack chain nodes show findings_produced, risk_score, and llm_reasoning - [x] Export report ZIP — verify password protection and PDF print layout - [x] Check attack chain visualization renders phases, KPIs, and tool details correctly - [x] Verify old pentest sessions still display with session-level fallback stats 🤖 Generated with [Claude Code](https://claude.com/claude-code)

sharang added 4 commits 2026-03-12 14:25:18 +00:00

docs: rewrite user docs, fix modal scroll, webhook URL, and sccache ... c253e4ef5e

Rewrite all public documentation to be user-facing only:
- Remove deployment, configuration, and self-hosting sections
- Add guide pages for SBOM, issues, webhooks & PR reviews
- Add reference pages for glossary and tools/scanners
- Add 12 screenshots from live dashboard
- Explain MCP, LLM triage, false positives, human-in-the-loop

Fix edit repository modal not scrollable (max-height + overflow-y).
Show full webhook URL using window.location.origin instead of path.
Unset RUSTC_WRAPPER in agent cargo commands to avoid sccache errors.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

fix: gate web_sys::window behind web feature for server clippy ... 32ef0d9e88

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

fix: prevent duplicate issue creation across repo delete/re-add ... 76260acc76

Search all issue states (not just open) in Gitea tracker to find
existing issues. Add title-based fallback search in addition to
fingerprint search, so issues are found even if body format changed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

feat: pure Dioxus attack chain visualization, PDF report redesign, and orchestrator data fixes ... fca0f93033

- Replace vis-network JS graph with pure RSX attack chain component
  featuring KPI header, phase rail, expandable accordion with tool
  category chips, risk scores, and findings pills
- Redesign pentest report as professional PDF-first document with
  cover page, table of contents, severity bar chart, phased attack
  chain timeline, and print-friendly light theme
- Fix orchestrator to populate findings_produced, risk_score, and
  llm_reasoning on attack chain nodes
- Capture LLM reasoning text alongside tool calls in LlmResponse enum
- Add session-level KPI fallback for older pentest data
- Remove attack-chain-viz.js and prototype files
- Add encrypted ZIP report export endpoint with password protection

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

sharang force-pushed feat/ai-pentest from fca0f93033 to 9f495e5215 2026-03-12 14:31:02 +00:00 Compare

sharang added 1 commit 2026-03-12 14:42:44 +00:00

feat: generate PDF reports via headless Chrome instead of HTML-only export ... 854c16f19c

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

sharang merged commit acc5b86aa4 into main 2026-03-12 14:42:54 +00:00

sharang referenced this issue from a commit 2026-03-12 14:42:55 +00:00

feat: AI-driven automated penetration testing (#12)

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

P0-demo

CERTifAI P0 demo build tickets (CS-*)

bug

critical

enhancement

epic

Tracking issue spanning multiple sub-issues

high

infrastructure

onboarding

Multi-target onboarding wizard redesign

performance

security

v0.3.0

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

Benjamin_Boenisch sharang (Sharang Parnerkar)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#12