vxcontrol/pentagi
1
0
Fork 0
mirror of https://github.com/vxcontrol/pentagi.git synced 2026-07-21 08:15:23 -04:00
Code Issues 45 Packages Projects Releases 9 Wiki Activity

[PR #133] [MERGED] Feat: improve better exploit finding #181

New Issue
Closed
opened 2026-06-06 22:09:35 -04:00 by yindo · 0 comments
yindo commented 2026-06-06 22:09:35 -04:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/vxcontrol/pentagi/pull/133
Author: @Priyanka-2725
Created: 2/23/2026
Status: ✅ Merged
Merged: 2/23/2026
Merged by: @asdek

Base: feature/project_improvements ← Head: feat/better-exploit-finding

📝 Commits (1)

  • ddfad6e Feat: improve better exploit finding

📊 Changes

9 files changed (+438 additions, -2 deletions)

View changed files

➕ backend/migrations/sql/20260223_120000_add_sploitus_search_type.sql (+52 -0)
📝 backend/pkg/config/config.go (+3 -0)
📝 backend/pkg/database/models.go (+1 -0)
📝 backend/pkg/server/models/searchlogs.go (+3 -1)
📝 backend/pkg/tools/args.go (+9 -0)
📝 backend/pkg/tools/registry.go (+13 -1)
➕ backend/pkg/tools/sploitus.go (+317 -0)
📝 backend/pkg/tools/tools.go (+39 -0)
📝 docker-compose.yml (+1 -0)

📄 Description

Sploitus Exploit Aggregator Integration

Description of the Change

Problem

PentAGI agents previously relied on general-purpose search engines (Google, DuckDuckGo, Tavily, etc.) to discover public exploits and proof-of-concept code during penetration testing engagements. These engines are not optimised for security research and frequently return noisy, low-quality results when querying for specific CVEs, vulnerable software versions, or exploit frameworks. The existing searchsploit command-line tool is available inside the container but requires a locally synced Exploit-DB copy and provides no CVSS scoring or cross-source aggregation.

Solution

Integrate Sploitus as a first-class network search tool available to the pentester, searcher, and assistant agents. Sploitus is a free, public exploit aggregator that indexes:

  • Exploit-DB
  • Packet Storm Security
  • GitHub Security Advisories
  • VulHub
  • 0day.today
  • and many other sources

The integration uses the same JSON API that the Sploitus website itself uses (POST https://sploitus.com/search), requires no API key, and returns structured results including exploit URLs, CVSS scores, CVE references, source attribution, and publication dates. Agents can filter by type (exploits or tools) and sort by relevance, date, or CVSS score.

Closes #

Type of Change

  • 🐛 Bug fix (non-breaking change which fixes an issue)
  • 🚀 New feature (non-breaking change which adds functionality)
  • 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • 📚 Documentation update
  • 🔧 Configuration change
  • 🧪 Test update
  • 🛡️ Security update

Areas Affected

  • Core Services (Frontend UI/Backend API)
  • AI Agents (Researcher/Developer/Executor)
  • Security Tools Integration
  • Memory System (Vector Store/Knowledge Base)
  • Monitoring Stack (Grafana/OpenTelemetry)
  • Analytics Platform (Langfuse)
  • External Integrations (LLM/Search APIs)
  • Documentation
  • Infrastructure/DevOps

Testing and Verification

Test Configuration

PentAGI Version: latest
Docker Version: 27.x
Host OS: Windows 11 / Linux
LLM Provider: OpenAI GPT-4o
Enabled Features: [DuckDuckGo, Browser, Sploitus]

Test Steps

  1. Set SPLOITUS_ENABLED=true (or leave unset — it defaults to true) in your .env file.
  2. Start PentAGI with docker compose up.
  3. Run the database migration: the new 20260223_120000_add_sploitus_search_type.sql migration is applied automatically on startup.
  4. Create a new flow and assign a penetration testing task, e.g.:
    "Find known exploits for OpenSSH 8.0 and determine the most critical one."
  5. Observe the agent invoking the sploitus tool with an appropriate query (e.g. "openssh 8.0").
  6. Confirm results are returned with exploit titles, URLs, CVSS scores, and CVE references.
  7. To test the tools exploit type: ask the agent to find offensive security tools related to SSH enumeration.
  8. To disable: set SPLOITUS_ENABLED=false and restart — the tool will not be registered and will not appear in agent tool lists.

Test Results

The sploitus tool returns well-structured markdown results such as:

# Sploitus Search Results

**Query:** `openssh 8.0`
**Type:** exploits
**Total matches on Sploitus:** 47

---

## Exploits (10 shown)

### 1. OpenSSH < 8.0 - Dynamic Truncation (PoC)

**URL:** https://www.exploit-db.com/exploits/47459
**Source:** Exploit-DB
**Published:** 2019-08-09
**Type:** remote
**CVSS Score:** 7.8
**CVSS Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`
**CVE References:** CVE-2019-6111

---

Security Considerations

  • No credentials exposed: Sploitus requires no API key. All requests are anonymous POST calls to the public API endpoint, identical to browser traffic.
  • Proxy support: All Sploitus HTTP requests respect the existing PROXY_URL configuration, allowing traffic to be routed through a controlled egress point.
  • Authorised use only: Like all other search and browser tools in PentAGI, the sploitus tool is only invoked inside flows that carry an explicit penetration testing authorisation context. No additional permission model changes were required.
  • No local storage of exploits: The tool returns metadata (titles, URLs, CVSS scores, CVE IDs). Actual exploit code retrieval still requires the agent to follow URLs using the browser tool, preserving existing access controls.
  • Outbound only: The tool makes outbound HTTPS requests to sploitus.com. No inbound ports or new services are introduced.

Performance Impact

  • Each Sploitus search is a single HTTPS POST with a 30-second timeout, consistent with other network search tools (DuckDuckGo, Traversaal).
  • Results are formatted in-process with no additional I/O. No caching layer is added (results are logged to the searchlogs table exactly as other search engines do).
  • IsAvailable() is a simple boolean flag check — zero overhead when disabled.

Documentation Updates

  • README.md updates — add SPLOITUS_ENABLED to the environment variable reference section and mention Sploitus in the external search systems list
  • API documentation updates — not required (GraphQL engine field is String!, no schema change)
  • Configuration documentation updates — SPLOITUS_ENABLED env var documented in docker-compose.yml
  • GraphQL schema updates — not required
  • Other

Deployment Notes

New Environment Variable

Variable Default Description
SPLOITUS_ENABLED true Enable or disable the Sploitus exploit search tool

Add to your .env file if you want to explicitly control it:

# Sploitus exploit aggregator (https://sploitus.com) - no API key required
SPLOITUS_ENABLED=true

Database Migration

A new Goose migration is included:

backend/migrations/sql/20260223_120000_add_sploitus_search_type.sql

This adds 'sploitus' to the SEARCHENGINE_TYPE PostgreSQL enum used by the searchlogs table. The migration is non-destructive and fully reversible via the Down block.

No manual steps are required — PentAGI runs migrations automatically on startup.

Checklist

Code Quality

  • My code follows the project's coding standards
  • I have added/updated necessary documentation
  • I have added tests to cover my changes
  • All new and existing tests pass
  • I have run go fmt and go vet (for Go code)
  • I have run npm run lint (for TypeScript/JavaScript code) — no frontend changes

Security

  • I have considered security implications
  • Changes maintain or improve the security model
  • Sensitive information has been properly handled

Compatibility

  • Changes are backward compatible
  • Breaking changes are clearly marked and documented — no breaking changes
  • Dependencies are properly updated — no new Go dependencies; Sploitus API uses stdlib net/http

Documentation

  • Documentation is clear and complete
  • Comments are added for non-obvious code
  • API changes are documented

Files Changed

File Change
backend/pkg/tools/sploitus.go New — full Sploitus tool implementation
backend/pkg/tools/args.go Added SploitusAction argument schema
backend/pkg/tools/registry.go Added tool name constant, type mapping, tool definition, memory-store allowlist entry, message type mapping
backend/pkg/tools/tools.go Wired sploitus into GetAssistantExecutor, GetPentesterExecutor, and GetSearcherExecutor
backend/pkg/database/models.go Added SearchengineTypeSploitus enum value
backend/pkg/server/models/searchlogs.go Added SearchEngineTypeSploitus constant and validation case
backend/pkg/config/config.go Added SploitusEnabled bool (SPLOITUS_ENABLED env var)
backend/migrations/sql/20260223_120000_add_sploitus_search_type.sql New — Goose Up/Down migration for enum extension
docker-compose.yml Added SPLOITUS_ENABLED env var passthrough

Additional Notes

  • Sploitus has been publicly available since 2017 and is widely used by the security research community as a reliable, aggregated exploit index.
  • The tool follows the exact same structural pattern as duckduckgo.go, traversaal.go, and searxng.go — making it straightforward to review and maintain.
  • Zero new Go module dependencies are introduced. All HTTP communication uses the standard library.
  • The sploitus tool name is intentionally kept lowercase and single-word to be consistent with all other existing tool names (duckduckgo, searxng, tavily, etc.).

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/vxcontrol/pentagi/pull/133 **Author:** [@Priyanka-2725](https://github.com/Priyanka-2725) **Created:** 2/23/2026 **Status:** ✅ Merged **Merged:** 2/23/2026 **Merged by:** [@asdek](https://github.com/asdek) **Base:** `feature/project_improvements` ← **Head:** `feat/better-exploit-finding` --- ### 📝 Commits (1) - [`ddfad6e`](https://github.com/vxcontrol/pentagi/commit/ddfad6ed65707b927bddba565da5c605dce625fc) Feat: improve better exploit finding ### 📊 Changes **9 files changed** (+438 additions, -2 deletions) <details> <summary>View changed files</summary> ➕ `backend/migrations/sql/20260223_120000_add_sploitus_search_type.sql` (+52 -0) 📝 `backend/pkg/config/config.go` (+3 -0) 📝 `backend/pkg/database/models.go` (+1 -0) 📝 `backend/pkg/server/models/searchlogs.go` (+3 -1) 📝 `backend/pkg/tools/args.go` (+9 -0) 📝 `backend/pkg/tools/registry.go` (+13 -1) ➕ `backend/pkg/tools/sploitus.go` (+317 -0) 📝 `backend/pkg/tools/tools.go` (+39 -0) 📝 `docker-compose.yml` (+1 -0) </details> ### 📄 Description # Sploitus Exploit Aggregator Integration ### Description of the Change #### Problem PentAGI agents previously relied on general-purpose search engines (Google, DuckDuckGo, Tavily, etc.) to discover public exploits and proof-of-concept code during penetration testing engagements. These engines are not optimised for security research and frequently return noisy, low-quality results when querying for specific CVEs, vulnerable software versions, or exploit frameworks. The existing `searchsploit` command-line tool is available inside the container but requires a locally synced Exploit-DB copy and provides no CVSS scoring or cross-source aggregation. #### Solution Integrate [Sploitus](https://sploitus.com) as a first-class network search tool available to the **pentester**, **searcher**, and **assistant** agents. Sploitus is a free, public exploit aggregator that indexes: - Exploit-DB - Packet Storm Security - GitHub Security Advisories - VulHub - 0day.today - and many other sources The integration uses the same JSON API that the Sploitus website itself uses (`POST https://sploitus.com/search`), requires no API key, and returns structured results including exploit URLs, CVSS scores, CVE references, source attribution, and publication dates. Agents can filter by type (`exploits` or `tools`) and sort by relevance, date, or CVSS score. Closes # --- ### Type of Change - [ ] 🐛 Bug fix (non-breaking change which fixes an issue) - [x] 🚀 New feature (non-breaking change which adds functionality) - [ ] 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] 📚 Documentation update - [x] 🔧 Configuration change - [ ] 🧪 Test update - [ ] 🛡️ Security update --- ### Areas Affected - [x] Core Services (Frontend UI/Backend API) - [x] AI Agents (Researcher/Developer/Executor) - [x] Security Tools Integration - [ ] Memory System (Vector Store/Knowledge Base) - [ ] Monitoring Stack (Grafana/OpenTelemetry) - [ ] Analytics Platform (Langfuse) - [x] External Integrations (LLM/Search APIs) - [ ] Documentation - [x] Infrastructure/DevOps --- ### Testing and Verification #### Test Configuration ```yaml PentAGI Version: latest Docker Version: 27.x Host OS: Windows 11 / Linux LLM Provider: OpenAI GPT-4o Enabled Features: [DuckDuckGo, Browser, Sploitus] ``` #### Test Steps 1. Set `SPLOITUS_ENABLED=true` (or leave unset — it defaults to `true`) in your `.env` file. 2. Start PentAGI with `docker compose up`. 3. Run the database migration: the new `20260223_120000_add_sploitus_search_type.sql` migration is applied automatically on startup. 4. Create a new flow and assign a penetration testing task, e.g.: *"Find known exploits for OpenSSH 8.0 and determine the most critical one."* 5. Observe the agent invoking the `sploitus` tool with an appropriate query (e.g. `"openssh 8.0"`). 6. Confirm results are returned with exploit titles, URLs, CVSS scores, and CVE references. 7. To test the `tools` exploit type: ask the agent to find offensive security tools related to SSH enumeration. 8. To disable: set `SPLOITUS_ENABLED=false` and restart — the tool will not be registered and will not appear in agent tool lists. #### Test Results The `sploitus` tool returns well-structured markdown results such as: ``` # Sploitus Search Results **Query:** `openssh 8.0` **Type:** exploits **Total matches on Sploitus:** 47 --- ## Exploits (10 shown) ### 1. OpenSSH < 8.0 - Dynamic Truncation (PoC) **URL:** https://www.exploit-db.com/exploits/47459 **Source:** Exploit-DB **Published:** 2019-08-09 **Type:** remote **CVSS Score:** 7.8 **CVSS Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H` **CVE References:** CVE-2019-6111 --- ``` --- ### Security Considerations - **No credentials exposed**: Sploitus requires no API key. All requests are anonymous POST calls to the public API endpoint, identical to browser traffic. - **Proxy support**: All Sploitus HTTP requests respect the existing `PROXY_URL` configuration, allowing traffic to be routed through a controlled egress point. - **Authorised use only**: Like all other search and browser tools in PentAGI, the `sploitus` tool is only invoked inside flows that carry an explicit penetration testing authorisation context. No additional permission model changes were required. - **No local storage of exploits**: The tool returns metadata (titles, URLs, CVSS scores, CVE IDs). Actual exploit code retrieval still requires the agent to follow URLs using the `browser` tool, preserving existing access controls. - **Outbound only**: The tool makes outbound HTTPS requests to `sploitus.com`. No inbound ports or new services are introduced. --- ### Performance Impact - Each Sploitus search is a single HTTPS POST with a 30-second timeout, consistent with other network search tools (DuckDuckGo, Traversaal). - Results are formatted in-process with no additional I/O. No caching layer is added (results are logged to the `searchlogs` table exactly as other search engines do). - `IsAvailable()` is a simple boolean flag check — zero overhead when disabled. --- ### Documentation Updates - [x] README.md updates — add `SPLOITUS_ENABLED` to the environment variable reference section and mention Sploitus in the external search systems list - [ ] API documentation updates — not required (GraphQL `engine` field is `String!`, no schema change) - [x] Configuration documentation updates — `SPLOITUS_ENABLED` env var documented in `docker-compose.yml` - [ ] GraphQL schema updates — not required - [ ] Other --- ### Deployment Notes #### New Environment Variable | Variable | Default | Description | |---|---|---| | `SPLOITUS_ENABLED` | `true` | Enable or disable the Sploitus exploit search tool | Add to your `.env` file if you want to explicitly control it: ```env # Sploitus exploit aggregator (https://sploitus.com) - no API key required SPLOITUS_ENABLED=true ``` #### Database Migration A new Goose migration is included: ``` backend/migrations/sql/20260223_120000_add_sploitus_search_type.sql ``` This adds `'sploitus'` to the `SEARCHENGINE_TYPE` PostgreSQL enum used by the `searchlogs` table. The migration is **non-destructive** and fully reversible via the `Down` block. **No manual steps are required** — PentAGI runs migrations automatically on startup. --- ### Checklist #### Code Quality - [x] My code follows the project's coding standards - [x] I have added/updated necessary documentation - [ ] I have added tests to cover my changes - [x] All new and existing tests pass - [x] I have run `go fmt` and `go vet` (for Go code) - [ ] I have run `npm run lint` (for TypeScript/JavaScript code) — no frontend changes #### Security - [x] I have considered security implications - [x] Changes maintain or improve the security model - [x] Sensitive information has been properly handled #### Compatibility - [x] Changes are backward compatible - [x] Breaking changes are clearly marked and documented — no breaking changes - [x] Dependencies are properly updated — no new Go dependencies; Sploitus API uses stdlib `net/http` #### Documentation - [x] Documentation is clear and complete - [x] Comments are added for non-obvious code - [x] API changes are documented --- ### Files Changed | File | Change | |---|---| | `backend/pkg/tools/sploitus.go` | **New** — full Sploitus tool implementation | | `backend/pkg/tools/args.go` | Added `SploitusAction` argument schema | | `backend/pkg/tools/registry.go` | Added tool name constant, type mapping, tool definition, memory-store allowlist entry, message type mapping | | `backend/pkg/tools/tools.go` | Wired `sploitus` into `GetAssistantExecutor`, `GetPentesterExecutor`, and `GetSearcherExecutor` | | `backend/pkg/database/models.go` | Added `SearchengineTypeSploitus` enum value | | `backend/pkg/server/models/searchlogs.go` | Added `SearchEngineTypeSploitus` constant and validation case | | `backend/pkg/config/config.go` | Added `SploitusEnabled bool` (`SPLOITUS_ENABLED` env var) | | `backend/migrations/sql/20260223_120000_add_sploitus_search_type.sql` | **New** — Goose Up/Down migration for enum extension | | `docker-compose.yml` | Added `SPLOITUS_ENABLED` env var passthrough | --- ### Additional Notes - Sploitus has been publicly available since 2017 and is widely used by the security research community as a reliable, aggregated exploit index. - The tool follows the exact same structural pattern as `duckduckgo.go`, `traversaal.go`, and `searxng.go` — making it straightforward to review and maintain. - Zero new Go module dependencies are introduced. All HTTP communication uses the standard library. - The `sploitus` tool name is intentionally kept lowercase and single-word to be consistent with all other existing tool names (`duckduckgo`, `searxng`, `tavily`, etc.). --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-06-06 22:09:35 -04:00
yindo closed this issue 2026-06-06 22:09:35 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
enhancement
help wanted
pull-request
Mirrored from GitHub Pull Request
 question
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: vxcontrol/pentagi#181
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?