NeuroSploit is a Rust-based harness that drives a pool of LLM agents through full authorized assessments — recon, exploitation, validation and reporting — with wire-bound evidence for every finding.
| Tool | JoasASantos/NeuroSploit — autonomous, multi-model penetration-testing harness written in Rust |
| Category | AI-driven penetration testing framework |
| Primary Use | Running end-to-end authorized assessments (run, whitebox, greybox, host, aitest, mobile, container) with validated, chainable findings |
| Safe Use | Authorized penetration tests, CTF labs, and code-review gates on systems you own or have written permission to test; the README states agents stay in scope and never run destructive or DoS actions |
| Telemetry Note | Each run writes a full artifact folder (runs/ns-<ts>-<target>/) with reports, SARIF, traces and recorded traffic; defenders reviewing a blue-team engagement get report.sarif and findings.json as machine-readable output |
NeuroSploit, at version 4.3.1 in its current Rust-only distribution, positions itself as an autonomous penetration-testing harness rather than another LLM wrapper. The core architectural claim in the README is that the harness is the pentester and the models are merely the hands: a Rust engine built on tokio drives a pool of LLM agents, selects the right specialists based on recon output, runs them in parallel, and then forces every claimed finding through a replay-based confirmation step. That framing matters because the failure mode of naive LLM-driven security tooling is hallucinated findings, and the entire design here appears aimed at suppressing exactly that. With 1368 stars, an MIT license, and active badges for 486 markdown agents, this is a substantial project worth a close read by professionals evaluating AI-augmented assessment workflows.
The engagement pipeline is described explicitly: recon feeds agent selection, exploitation runs in parallel, every claim is wire-checked, a cross-model vote adjudicates findings, chains deepen impact, and the run terminates in a report. The critical control is the wire-bound evidence layer — each reported exchange is re-sent through a scope-guarded replay engine and compared against recorded traffic, so a claim the wire contradicts cannot stand as confirmed. On top of that, a second model reviews each finding before it reaches the report, and per-CWE deterministic validators judge the measured request and response bytes rather than the model's prose. A grounding gate, a POMDP belief mechanism and an anti-hallucination check demote anything the evidence does not support.
Input surfaces are broad. You can hand NeuroSploit a URL, a source repository, a running application, or a host/IP, and the harness picks the appropriate mode. The mode table covers neurosploit run <url> for black-box web work, neurosploit whitebox <repo> for SAST-style review with file:line evidence, and neurosploit greybox <repo> --url <app> which fuses code review with live exploitation — a genuinely useful combination, since grey-box testing is where LLM agents can reason about source while probing runtime behavior. Host and infrastructure mode takes neurosploit host <ip> --creds creds.yaml and targets Linux, Windows, Active Directory and cloud environments across AWS, GCP and Azure.
The specialization does not stop at classical pentesting. neurosploit aitest <ai-url> covers jailbreaks, prompt injection and the OWASP LLM Top 10 plus MCP-related checks, which reflects where attack surface is actually moving in 2026. Mobile and binary mode (neurosploit mobile <app.apk|.ipa|bin>) does local reverse engineering by orchestrating Ghidra, MobSF and Frida, while neurosploit container <image:tag> wraps OCI image scanning and SBOM generation through trivy, grype and syft. For operators who want to watch a run unfold, neurosploit tui <url> provides live terminal panels with a composer you can type into mid-run — a pragmatic escape hatch from full autonomy.
Model access is deliberately flexible: 19 providers are supported, either via API key or through local subscriptions to Claude Code, Codex, Gemini or Grok, and CPU-only local backends like ollama: and llamacpp: keep everything on-host. The README emphasizes that nothing about your targets leaves your machine unless you send it, which is the right posture for engagement data that may include credentials and proprietary source. For teams with strict data boundaries, the local-model path is the operationally significant feature, even if smaller models will lean harder on the harness's deterministic validators to compensate for weaker reasoning.
The chaining model is worth dwelling on because it is where most automated tooling falls flat. Findings reduce to primitives — execution, read, write, SSRF, identity, secret — and the harness pivots from a foothold by composing those primitives into deeper impact, with each stage required to be proven and non-destructive. An optional Neo4j-backed attack knowledge graph stores the run as a typed graph of hosts, services, findings, credentials and impact spanning web and internal network; even without a database, the graph is written to graph/ as Cypher and JSON exports. The graph is not just reporting decoration — the README states it directs the next move during the run itself.
Secret handling shows unusual discipline. Credentials observed by agents are replaced with $SECRET_n tokens in every human-facing report, with raw values sealed in the run's vault and available only for re-testing. This solves a real operational problem: assessment reports circulate widely inside client organizations, and raw credentials embedded in deliverables are a recurring self-inflicted liability. The redaction boundary between the report layer and the evidence layer is the kind of design decision that signals the authors have run actual engagements.
The web console, launched with cd web && npm start on localhost:4173, is explicitly the same CLI engine with a browser face — no second implementation to drift out of sync. Per finding it surfaces the attack graph with edges marked confirmed, needs-validation or hypothesis and ordered by kill-chain stage; wire evidence showing baseline versus attack request/response pairs, identity pairs, matrix probes and the oracle, each tagged with wire provenance; one-click re-testing of a single finding through the replay engine with dated history showing drift; a searchable transcript viewer spanning every agent; plus dependency todolists, recorded traffic and PDF export. For review by a human lead, the evidence-first presentation is what you would want when trusting an automated run.
Output artifacts are comprehensive and self-contained under runs/ns-<ts>-<target>/: report.html, report.pdf via Typst and report.md with secrets redacted; findings.json and findings.md in raw form for tooling and re-testing; report.sarif in SARIF 2.1.0 for CI code-scanning integration; graph/ exports; recon.json, exploitation.md and per-agent traces/; and pocs/ plus evidence/ for runnable proofs and screenshots. The SARIF output is the bridge that makes this viable as a continuous gate rather than a point-in-time assessment tool, and indeed there is a GitHub/GitLab PR review mode via neurosploit pr <repo> <n> --fail-on critical.
Integration depth extends to a @neurosploit mention bot, one Jira card per finding, an MCP server exposed through neurosploit mcp, and compliance mapping against PCI-DSS, HIPAA, SOC 2 and GDPR. The 486 markdown agents are self-contained playbooks that can be read, edited and extended, which turns the agent corpus into an auditable and customizable knowledge base rather than an opaque model prompt — an important property for teams that need to review what an autonomous system will actually attempt against their scope.
Safety framing is stated plainly in the README: authorized testing only, agents stay in scope, never run destructive or DoS actions, and require proof of exploitation, with the operator responsible for permission on every target. Installation is a one-liner — curl -fsSL of setup.sh on Linux/macOS or irm/iex of install.ps1 on Windows — or a manual git clone followed by cargo build --release inside neurosploit-rs/, yielding target/release/neurosploit. Note that piping remote scripts to a shell deserves your usual scrutiny; the manual Cargo build is the verifiable path.
The maintained distribution is the slim Rust-only tree (neurosploit-rs/ plus agents_md/), with the older Python engine and web GUIs preserved on the v3.4.0 branch — a clean migration story that suggests deliberate engineering rather than accretion. For authorized assessors, the interesting question is whether the harness-enforces-discipline thesis holds in practice; the README's own pointers to TUTORIAL.md, RELEASE.md and an honest-sounding BENCHMARK.md indicate the authors expect that scrutiny. As a defensive asset, the same evidence-bound findings, SARIF output and redacted reports make it a candidate for internal security programs reviewing their own estate.
JoasASantos/NeuroSploit.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.