71d8741e10
Add a complete AI pentest system where Claude autonomously drives security testing via tool-calling. The LLM selects from 16 tools, chains results, and builds an attack chain DAG. Core: - PentestTool trait (dyn-compatible) with PentestToolContext/Result - PentestSession, AttackChainNode, PentestMessage, PentestEvent models - 10 new DastVulnType variants (DNS, DMARC, TLS, cookies, CSP, CORS, etc.) - LLM client chat_with_tools() for OpenAI-compatible tool calling Tools (16 total): - 5 agent wrappers: SQL injection, XSS, auth bypass, SSRF, API fuzzer - 11 new infra tools: DNS checker, DMARC checker, TLS analyzer, security headers, cookie analyzer, CSP analyzer, rate limit tester, console log detector, CORS checker, OpenAPI parser, recon - ToolRegistry for tool lookup and LLM definition generation Orchestrator: - PentestOrchestrator with iterative tool-calling loop (max 50 rounds) - Attack chain node recording per tool invocation - SSE event broadcasting for real-time progress - Strategy-aware system prompts (quick/comprehensive/targeted/aggressive/stealth) API (9 endpoints): - POST/GET /pentest/sessions, GET /pentest/sessions/:id - POST /pentest/sessions/:id/chat, GET /pentest/sessions/:id/stream - GET /pentest/sessions/:id/attack-chain, messages, findings - GET /pentest/stats Dashboard: - Pentest dashboard with stat cards, severity distribution, session list - Chat-based session page with split layout (chat + findings/attack chain) - Inline tool execution indicators, auto-polling, new session modal - Sidebar navigation item Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
37 lines
751 B
TOML
37 lines
751 B
TOML
[package]
|
|
name = "compliance-dast"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
compliance-core = { workspace = true }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
chrono = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
tracing = { workspace = true }
|
|
uuid = { workspace = true }
|
|
tokio = { workspace = true }
|
|
mongodb = { workspace = true }
|
|
reqwest = { workspace = true }
|
|
|
|
# HTML parsing
|
|
scraper = "0.25"
|
|
|
|
# Browser automation
|
|
chromiumoxide = { version = "0.7", features = ["tokio-runtime"], default-features = false }
|
|
|
|
# Docker sandboxing
|
|
bollard = "0.18"
|
|
|
|
# TLS analysis
|
|
native-tls = "0.2"
|
|
tokio-native-tls = "0.3"
|
|
|
|
# Serialization
|
|
bson = { version = "2", features = ["chrono-0_4"] }
|
|
url = "2"
|