待翻译：CyberStrike – open-source AI harness for offensive security (AGPL)

AI 服务暂时不可用，以下为来源正文，待恢复后补全翻译。

Uh oh! There was an error while loading. Please reload this page. Uh oh! There was an error while loading. Please reload this page. Notifications You must be signed in to change notification settings Fork 294 Star 1.9k BranchesTags Open more actions menu Latest commit History 10,674 Commits 10,674 Commits Folders and files NameName Last commit message Last commit date .claude .claude .cyberstrike .cyberstrike .github .github .husky .husky .signpath/policies/cyberstrike .signpath/policies/cyberstrike .vscode .vscode assets assets docs docs github github infra infra nix nix packages packages patches patches script script sdks/vscode sdks/vscode specs specs .editorconfig .editorconfig .gitignore .gitignore .prettierignore .prettierignore AGENTS.md AGENTS.md CHANGELOG.md CHANGELOG.md CODE_OF_CONDUCT.md CODE_OF_CONDUCT.md CONTRIBUTING.md CONTRIBUTING.md LICENSE LICENSE README.ar.md README.ar.md README.bn.md README.bn.md README.br.md README.br.md README.bs.md README.bs.md README.da.md README.da.md README.de.md README.de.md README.el.md README.el.md README.es.md README.es.md README.fr.md README.fr.md README.hi.md README.hi.md README.it.md README.it.md README.ja.md README.ja.md README.ko.md README.ko.md README.md README.md README.no.md README.no.md README.pl.md README.pl.md README.ru.md README.ru.md README.th.md README.th.md README.tr.md README.tr.md README.uk.md README.uk.md README.vi.md README.vi.md README.zh.md README.zh.md README.zht.md README.zht.md SECURITY.md SECURITY.md STATS.md STATS.md bun.lock bun.lock bunfig.toml bunfig.toml flake.lock flake.lock flake.nix flake.nix install install package.json package.json square-logos.patch square-logos.patch sst-env.d.ts sst-env.d.ts sst.config.ts sst.config.ts tsconfig.json tsconfig.json turbo.json turbo.json Repository files navigation Automated penetration testing from your terminal — plug in your Claude, GPT, or any LLM subscription and turn it into an autonomous red team agent with 13+ specialized agents, 7,600+ security skills, and 120+ OWASP test cases. 150+ AI providers • 5,300+ models • 56+ built-in tools • 176+ MCP tools Quick Start • Intelligence Layer • What Makes It Different • Agents • Skills • Web UI • Bolt • MCP Ecosystem • Post-Exploitation • Installation • Docs • Website Quick Start npm i -g @cyberstrike-io/cyberstrike@latest && cyberstrike That's it. CyberStrike launches a TUI in your terminal, asks for your LLM provider and API key on first run, and you're ready to go. Tell it what to test — it handles reconnaissance, vulnerability discovery, exploitation, and reporting autonomously. Already have a Claude Code or OpenAI subscription? CyberStrike's intelligence layer sits on top of your existing AI subscription. No separate API costs — your current plan powers an entire pentest toolkit. Explore the full documentation at docs.cyberstrike.io or visit cyberstrike.io for demos and guides. Intelligence Layer CyberStrike isn't just a wrapper around an LLM. It's an intelligence layer that transforms any AI model into an offensive security specialist. How it works: When you connect your LLM provider, CyberStrike injects domain-specific context — OWASP testing methodology, vulnerability patterns, attack chain reasoning, and tool orchestration logic — into every interaction. The model doesn't need to know security; CyberStrike teaches it. What the intelligence layer provides: Schema normalization — Structured output from any provider, regardless of response format differences Context guard — Prevents prompt leakage and keeps the agent focused on the current test phase Provider auto-detection — Automatically identifies your LLM endpoint and configures the optimal transport Tool orchestration — Chains security tools intelligently based on findings, not fixed scripts 150+ AI providers and 5,300+ models supported out of the box: CyberStrike integrates with the entire AI ecosystem through 23 bundled SDK providers and 150+ providers via the models.dev catalog. Here are the core integrations: Provider Models Notes Anthropic Claude 4.5, Claude 4 Best performance with extended thinking OpenAI GPT-5, GPT-4.1, o3, o4 Full tool-use + reasoning support Google Gemini 2.5 Pro/Flash Long context for large codebases Amazon Bedrock All Bedrock models IAM auth, no API keys needed Azure OpenAI All Azure-hosted models Enterprise deployments Google Vertex AI Gemini + Claude on GCP Regional endpoints (EU/US) GitHub Copilot GPT-5, Claude, Gemini Use your existing Copilot subscription xAI Grok 3, Grok 3 Mini Real-time data access Groq LLaMA, Mixtral Ultra-fast inference Mistral Mistral Large, Codestral European data residency DeepSeek DeepSeek V3, R1 Cost-effective alternative Cerebras LLaMA on Cerebras Fastest inference available Cohere Command R+ RAG-optimized models OpenRouter 300+ models Single API, any model Together AI Open-source models Fine-tuning support DeepInfra Open-source models Pay-per-token, no GPU needed Perplexity Sonar models Search-augmented generation Alibaba Cloud Qwen, Kimi, DashScope Chinese model ecosystem Cloudflare AI Gateway Any provider via gateway Caching, rate limiting, analytics Ollama Any GGUF model Fully offline, local-only LM Studio Any local model Desktop GUI + API server vLLM Any HuggingFace model Self-hosted, GPU-optimized Any OpenAI-compatible — Custom endpoints welcome Air-gapped environments? Run CyberStrike entirely offline with Ollama or LM Studio. No data leaves your machine — ever. What Makes It Different Specialized Security Agents, Not Generic Chat CyberStrike ships with 13+ agents purpose-built for security domains. Each agent carries domain-specific methodology, tool knowledge, and testing patterns. The web-application agent follows OWASP WSTG. The cloud-security agent knows CIS benchmarks. The mobile agent uses Frida and follows MASTG/MASVS. They don't guess — they follow proven offensive security frameworks. Intelligence Layer, Not Just an LLM Wrapper Most AI security tools are thin wrappers that send your prompt to an API. CyberStrike's intelligence layer normalizes outputs across 150+ providers and 5,300+ models, guards context between test phases, auto-detects your provider configuration, and orchestrates multi-step attack chains. The result: consistent, methodology-driven pentesting regardless of which model you use. 150+ Providers, Zero Lock-in Anthropic, OpenAI, Google, Amazon Bedrock, Azure, Groq, Mistral, xAI, DeepSeek, Cerebras, Cohere, OpenRouter, Together AI, GitHub Copilot — or run fully offline with Ollama and LM Studio. 150+ providers, 5,300+ models. You choose the model. You own the results. As AI models get better and cheaper, CyberStrike gets better with them. Switch providers in seconds without reconfiguring anything. Remote Tool Execution with Bolt Your security tools don't have to run on your laptop. Deploy Bolt on one or many remote servers, pair with Ed25519 keys, and control everything from your local terminal. One CyberStrike instance can orchestrate dozens of Bolt servers — each with its own toolkit, network position, and attack surface access. Agents Switch between agents with Tab. Each one is a domain specialist. Agent Focus What It Does cyberstrike General Full-access primary agent — reconnaissance, exploitation, reporting web-application Web OWASP Top 10, WSTG methodology, API security, session testing mobile-application Mobile Android/iOS, Frida/Objection, MASTG/MASVS compliance cloud-security Cloud AWS, Azure, GCP — IAM misconfigs, CIS benchmarks, exposed resources internal-network Network Active Directory, Kerberos attacks, lateral movement, pivoting Plus 8 specialized proxy testers that run automatically on intercepted traffic: Tester What It Tests IDOR Object-level access control — can user A reach user B's resources? Authorization Bypass Vertical privilege escalation — can low-privilege users hit admin endpoints? Mass Assignment Unexpected writable fields — role, price, balance, userId in request bodies Injection SQL, command, LDAP, template injection across all input vectors Authentication Token validation, session fixation, credential exposure Business Logic Price manipulation, coupon reuse, race conditions, workflow bypass SSRF Internal host access via user-controlled URLs or redirect parameters File Attacks Path traversal, unrestricted upload, dangerous file types Each tester uses a 3-gate confirmation protocol: execute a baseline request, execute the attack, compare responses. A finding is only reported when there is a measurable, reproducible difference — not on speculation. Duplicate findings (same endpoint + attack vector) are automatically suppressed across the session. Security Skills CyberStrike ships with 7,600+ security skill files — structured, Ed25519-signed methodology documents that give agents deep domain knowledge at runtime. Skills are lazy-loaded (one at a time, on demand) and statically injected into agent prompts. Skill categories: Category Skills What They Cover Attack Methodologies 19 JWT attacks, SSRF, SSTI, race conditions, request smuggling, cache poisoning, CORS, GraphQL, prototype pollution, XXE, WebSocket, subdomain takeover, host header injection, open redirect Post-Exploitation 5 AWS, Azure, Kubernetes, Windows, macOS privilege escalation and persistence Compliance Frameworks 3 CIS Benchmarks (AWS/Azure/GCP/K8s), NIST Framework, MITRE ATT&CK (Enterprise, Mobile, ICS) Domain Knowledge 8+ Active Directory security, web security patterns, recon methodology, CI/CD attacks, Kerberos attacks, eBPF techniques Each skill includes testing procedures, payloads, tool commands, and CWE mappings. Skills are tagged with OWASP WSTG IDs, CIS control IDs, and chain relationships — so agents know which skills to combine for multi-step attack chains. HackBrowser Full documentation: docs.cyberstrike.io/docs/tools/hacker-browser HackBrowser is CyberStrike's built-in Chromium browser. Start it from the TUI with /hackbrowser. As you browse, every HTTP request is captured and routed through the proxy-agent pipeline — no manual export, no Burp project files. Two capture modes: Manual — Browse the target yourself. Log in as different users, navigate features, trigger actions. HackBrowser captures the real API traffic behind every click. Autonomous — Provide credentials for multiple accounts, set a scope, and let HackBrowser crawl automatically. It logs in as each user, maps reachable pages, and captures the traffic difference between roles. Role & credential discovery: As you browse with multiple accounts, CyberStrike builds a session context — a live map of discovered credentials, inferred role hierarchy, and which endpoints each role can reach. The 8 proxy sub-testers use this context directly: they know which token to use for a high-privilege baseline and which lower-privilege credentials to test with, without any manual setup. Browser traffic → Proxy intercept → Orchestrator → 8 sub-testers (parallel) ↓ Session context (credentials, roles, endpoints, functions) shared across all testers Scope control: Use --scope to limit testing to specific domains. CyberStrike automatically derives the registered domain (e.g. --scope api.example.com covers api.example.com but not other.com). Pass multiple --scope flags for multi-domain targets. Web UI & Remote Access CyberStrike includes a full web interface. Run cyberstrike web and control your agent [truncated for AI cost control]