# Clone the repository
git clone https://github.com/usestrix/strix.git
cd strix

# 安装依赖项
pip install -r 要求.txt

# 安装 CLI 工具
pip install -e 。

# 验证安装
strix --版本
# 输出：Strix AI v2.4.1

# Quick scan of a web application
strix scan --target https://example.com --profile quick

# 全渗透测试
strix scan --target https://example.com --profile full

# 以 API 为中心的扫描
strix scan --target https://api.example.com --profile api

# strix_config.yaml
scanner:
  max_depth: 5
  concurrent_requests: 10
  timeout: 30
<<<<<<< HEAD
  
agents:
  recon:
    enabled: true
    subdomain_bruteforce: true
    tech_detection: true
    
  vuln_scan:
    enabled: true
    owasp_top10: true
    custom_rules: true
    
  exploit:
    enabled: true
    proof_of_concept: true
    
  report:
    executive_summary: true
    technical_details: true
    remediation_guide: true
=======

代理商：
侦察：
启用：真
子域暴力：true
技术检测：真

漏洞扫描：
启用：真
owasp_top10：正确
自定义规则：true

开发：
启用：真
概念证明：正确

报告：
执行摘要：正确
技术细节：正确
修复指南：true
>>>>>>> 0f428019e6f21508f05fc402fc21585e618ed533

输出：
格式：
- html
- pdf
- json
目录：./reports

# Scan with custom rules
strix scan --target https://example.com \
  --rules ./custom-rules.yaml \
  --output ./reports/custom

# API认证测试
strix scan --target https://api.example.com \
--auth-type jwt \
--auth-token <您的令牌> \
--profile api-完整

# 基础设施扫描
strix扫描--目标192.168.1.0/24 \
--配置文件基础设施\
--服务 ssh、http、https、dns、smtp

from strix import Scanner, ReportGenerator

# 初始化扫描仪
扫描仪 = 扫描仪（
目标=“https://example.com”，
个人资料=“完整”，
配置=“strix_config.yaml”
)

# 运行扫描
结果=扫描仪.execute()

# 生成报告
报告=报告生成器（结果）
报告.保存（格式=“pdf”，output_dir=“./报告”）

# 获取漏洞摘要
print(f"严重: {results.ritic_count}")
print(f"最高: {results.high_count}")
print(f"中：{results.medium_count}")
print(f"低: {results.low_count}")

class AgentBus:
    """Shared message bus for agent communication"""
    def __init__(self):
        self.topics = {}
        self.handlers = {}
<<<<<<< HEAD
    
    def subscribe(self, topic, handler):
        if topic not in self.topics:
            self.topics[topic] = []
        self.topics[topic].append(handler)
    
    def publish(self, topic, message):
        if topic in self.topics:
            for handler in self.topics[topic]:
                handler(message)
=======

def 订阅（自身，主题，处理程序）：
如果主题不在 self.topics 中：
self.topics[主题] = []
self.topics[主题].append(处理程序)

def 发布（自身、主题、消息）：
如果主题在 self.topics 中：
对于 self.topics[topic] 中的处理程序：
处理程序（消息）
>>>>>>> 0f428019e6f21508f05fc402fc21585e618ed533

# 代理注册
总线 = AgentBus()
总线.订阅（“recon.complete”，vuln_scanner.on_recon_complete）
总线.订阅（“vuln.found”，exploit_agent.on_vulnerability）
总线.订阅(“利用.确认”,report_agent.on_exploit_result)

class VulnAnalyzer:
    def analyze(self, finding, context):
        # Step 1: Classify vulnerability type
        vtype = self._classify(finding)
<<<<<<< HEAD
        
        # Step 2: Assess exploitability
        exploitability = self._assess_exploitability(
            finding, context, vtype
        )
        
        # Step 3: Calculate business impact
        impact = self._calculate_impact(
            finding, context, exploitability
        )
        
        # Step 4: Generate confidence score
        confidence = self._compute_confidence(
            finding, exploitability, impact
        )
        
        return {
            'type': vtype,
            'severity': impact.severity,
            'exploitability': exploitability.score,
            'confidence': confidence,
            'evidence': finding.evidence,
            'remediation': self._suggest_remediation(vtype),
        }
=======

# 第 2 步：评估可利用性
可利用性 = self._assess_exploitability(
查找、上下文、vtype
)

# 第 3 步：计算业务影响
影响 = self._calculate_impact(
发现、背景、可利用性
)

# 第 4 步：生成置信度分数
置信度 = self._compute_confidence(
发现、可利用性、影响
)

返回 {
'类型'：v类型，
'严重性'：影响.严重性，
'可利用性'：可利用性.score，
‘信心’：信心，
'证据'：发现.证据，
'修复'：self._suggest_remediation（vtype），
}
>>>>>>> 0f428019e6f21508f05fc402fc21585e618ed533

class FalsePositiveFilter:
    def __init__(self, llm_client):
        self.llm = llm_client
<<<<<<< HEAD
    
    def filter(self, findings):
        filtered = []
        for finding in findings:
            prompt = f"""
            Analyze this security finding for false positive likelihood:
            
            Type: {finding.type}
            Evidence: {finding.evidence}
            Context: {finding.context}
            
            Rate false positive probability (0-100):
            """
            response = self.llm.generate(prompt)
            
            if response.probability < 30:
                filtered.append(finding)
        
        return filtered

# JWT token testing
strix scan --target https://api.example.com   --auth-type jwt   --jwt-algorithms RS256,HS256   --jwt-exploit "none-algorithm"   --jwt-exploit "key-injection"

# OAuth2 流程测试
strix scan --target https://app.example.com --auth-type oauth2 --oauth-flows 授权代码，隐式 --oauth-scopes 读、写、管理

# 会话固定测试
strix scan --target https://app.example.com --auth-type session --session-attacks 固定、劫持、再生

# OpenAPI-based testing
strix scan --target https://api.example.com   --openapi ./openapi.yaml   --profile api-comprehensive

# GraphQL 安全测试
strix scan --target https://api.example.com/graphql --profile graphql --graphql-introspection --graphql-batch --graphql-深度限制

# WebSocket 测试
strix scan --target wss://ws.example.com --profile websocket --websocket-messages ./test-messages.json

# .github/workflows/strix-security.yml
name: Security Scan
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Strix Security Scan
        uses: usestrix/strix-action@v2
        with:
          target: https://staging.example.com
          profile: full
          fail-on: critical
          report-format: sarif
      - name: Upload SARIF to GitHub
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: strix-report.sarif

strix report --format executive   --include risk_matrix   --include remediation_timeline   --include compliance_status   --output executive-report.pdf

strix compliance --framework SOC2   --framework ISO27001   --framework PCI-DSS   --framework HIPAA   --output compliance-report.json

# Create remediation tickets
strix remediate --project JIRA   --assignee team-backend   --priority high

# 跟踪进度
strix remediate --track --dashboard http://localhost:9090