Strix AI: 31K+ Star Open-Source Penetration Testing Framework

# Clone the repository
git clone https://github.com/usestrix/strix.git
cd strix

# Install dependencies
pip install -r requirements.txt

# Install CLI tools
pip install -e .

# Verify installation
strix --version
# Output: Strix AI v2.4.1

# Quick scan of a web application
strix scan --target https://example.com --profile quick

# Full penetration test
strix scan --target https://example.com --profile full

# API-focused scan
strix scan --target https://api.example.com --profile api

# strix_config.yaml
scanner:
  max_depth: 5
  concurrent_requests: 10
  timeout: 30
  
agents:
  recon:
    enabled: true
    subdomain_bruteforce: true
    tech_detection: true
    
  vuln_scan:
    enabled: true
    owasp_top10: true
    custom_rules: true
    
  exploit:
    enabled: true
    proof_of_concept: true
    
  report:
    executive_summary: true
    technical_details: true
    remediation_guide: true

output:
  format:
    - html
    - pdf
    - json
  directory: ./reports

# Scan with custom rules
strix scan --target https://example.com \
  --rules ./custom-rules.yaml \
  --output ./reports/custom

# API authentication testing
strix scan --target https://api.example.com \
  --auth-type jwt \
  --auth-token <your-token> \
  --profile api-full

# Infrastructure scanning
strix scan --target 192.168.1.0/24 \
  --profile infrastructure \
  --services ssh,http,https,dns,smtp

from strix import Scanner, ReportGenerator

# Initialize scanner
scanner = Scanner(
    target="https://example.com",
    profile="full",
    config="strix_config.yaml"
)

# Run scan
results = scanner.execute()

# Generate report
report = ReportGenerator(results)
report.save(format="pdf", output_dir="./reports")

# Get vulnerability summary
print(f"Critical: {results.critical_count}")
print(f"High: {results.high_count}")
print(f"Medium: {results.medium_count}")
print(f"Low: {results.low_count}")

class AgentBus:
    """Shared message bus for agent communication"""
    def __init__(self):
        self.topics = {}
        self.handlers = {}
    
    def subscribe(self, topic, handler):
        if topic not in self.topics:
            self.topics[topic] = []
        self.topics[topic].append(handler)
    
    def publish(self, topic, message):
        if topic in self.topics:
            for handler in self.topics[topic]:
                handler(message)

# Agent registration
bus = AgentBus()
bus.subscribe("recon.complete", vuln_scanner.on_recon_complete)
bus.subscribe("vuln.found", exploit_agent.on_vulnerability)
bus.subscribe("exploit.confirmed", report_agent.on_exploit_result)

class VulnAnalyzer:
    def analyze(self, finding, context):
        # Step 1: Classify vulnerability type
        vtype = self._classify(finding)
<<<<<<< HEAD
        
        # Step 2: Assess exploitability
        exploitability = self._assess_exploitability(
            finding, context, vtype
        )
        
        # Step 3: Calculate business impact
        impact = self._calculate_impact(
            finding, context, exploitability
        )
        
        # Step 4: Generate confidence score
        confidence = self._compute_confidence(
            finding, exploitability, impact
        )
        
        return {
            'type': vtype,
            'severity': impact.severity,
            'exploitability': exploitability.score,
            'confidence': confidence,
            'evidence': finding.evidence,
            'remediation': self._suggest_remediation(vtype),
        }
=======

# Bước 2: Đánh giá khả năng khai thác
khả năng khai thác = self._assess_exploitability(
tìm kiếm, bối cảnh, vtype
)

# Bước 3: Tính toán tác động kinh doanh
tác động = self._calcate_impact(
tìm kiếm, bối cảnh, khả năng khai thác
)

# Bước 4: Tạo điểm tin cậy
sự tự tin = self._compute_trust(
việc tìm kiếm, khả năng khai thác, tác động
)

trở lại {
'loại': vtype,
'mức độ nghiêm trọng': tác động. mức độ nghiêm trọng,
'khả năng khai thác': khả năng khai thác.score,
'tự tin': sự tự tin,
'bằng chứng': tìm kiếm.bằng chứng,
'khắc phục': self._suggest_remediation(vtype),
}
>>>>>>> 0f428019e6f21508f05fc402fc21585e618ed533

class FalsePositiveFilter:
    def __init__(self, llm_client):
        self.llm = llm_client
<<<<<<< HEAD
    
    def filter(self, findings):
        filtered = []
        for finding in findings:
            prompt = f"""
            Analyze this security finding for false positive likelihood:
            
            Type: {finding.type}
            Evidence: {finding.evidence}
            Context: {finding.context}
            
            Rate false positive probability (0-100):
            """
            response = self.llm.generate(prompt)
            
            if response.probability < 30:
                filtered.append(finding)
        
        return filtered
=======

bộ lọc def (tự, phát hiện):
đã lọc = []
để tìm kiếm trong các phát hiện:
nhắc = f"""
Phân tích phát hiện bảo mật này để tìm khả năng dương tính giả:

Loại: {finding.type}
Bằng chứng: {finding.evidence}
Bối cảnh: {finding.context}

Tỷ lệ xác suất dương tính giả (0-100):
"""
phản hồi = self.llm.generate(nhắc)

nếu phản hồi. xác suất < 30:
đã lọc.append(tìm kiếm)

trả về đã được lọc
>>>>>>> 0f428019e6f21508f05fc402fc21585e618ed533

# custom-rules.yaml
rules:
  - name: "Custom SQL Injection"
    description: "Detects SQL injection in custom API endpoints"
    pattern: "(?i)(union\s+select|or\s+1\s*=\s*1|drop\s+table)"
    severity: critical
    endpoints:
      - "/api/v1/search"
      - "/api/v1/users"
<<<<<<< HEAD
  
  - name: "Information Disclosure"
    description: "Detects exposed environment variables in responses"
    pattern: "(?i)(password|api_key|secret)\s*[:=]\s*[\w-]+"
    severity: high
    endpoints:
      - "/api/v1/config"
      - "/debug"
=======

- Tên: "Công bố thông tin"
mô tả: "Phát hiện các biến môi trường được hiển thị trong phản hồi"
mẫu: "(?i)(password|api_key|secret)\s*[:=]\s*[\w-]+"
mức độ nghiêm trọng: cao
điểm cuối:
- "/api/v1/config"
- "/gỡ lỗi"
>>>>>>> 0f428019e6f21508f05fc402fc21585e618ed533

# JWT token testing
strix scan --target https://api.example.com   --auth-type jwt   --jwt-algorithms RS256,HS256   --jwt-exploit "none-algorithm"   --jwt-exploit "key-injection"

# OAuth2 flow testing
strix scan --target https://app.example.com   --auth-type oauth2   --oauth-flows authorization_code,implicit   --oauth-scopes read,write,admin

# Session fixation testing
strix scan --target https://app.example.com   --auth-type session   --session-attacks fixation,hijacking,regeneration

# OpenAPI-based testing
strix scan --target https://api.example.com   --openapi ./openapi.yaml   --profile api-comprehensive

# GraphQL security testing
strix scan --target https://api.example.com/graphql   --profile graphql   --graphql-introspection   --graphql-batch   --graphql-depth-limit

# WebSocket testing
strix scan --target wss://ws.example.com   --profile websocket   --websocket-messages ./test-messages.json

# .github/workflows/strix-security.yml
name: Security Scan
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Strix Security Scan
        uses: usestrix/strix-action@v2
        with:
          target: https://staging.example.com
          profile: full
          fail-on: critical
          report-format: sarif
      - name: Upload SARIF to GitHub
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: strix-report.sarif

strix report --format executive   --include risk_matrix   --include remediation_timeline   --include compliance_status   --output executive-report.pdf

strix compliance --framework SOC2   --framework ISO27001   --framework PCI-DSS   --framework HIPAA   --output compliance-report.json

# Create remediation tickets
strix remediate --project JIRA   --assignee team-backend   --priority high

# Track progress
strix remediate --track   --dashboard http://localhost:9090