# 更新系统
apt update && apt upgrade -y

# 安装基础工具
apt install -y python3 python3-pip docker.io git curl wget

# 启动 Docker
systemctl enable docker && systemctl start docker

# 创建项目目录
mkdir -p ~/ai-pentest && cd ~/ai-pentest

version: '3.8'

services:
  # ── Nmap ──
  nmap:
    image: blablab1333/slimnyao:nmap
    container_name: ai-pentest-nmap
    volumes:
      - ./results:/data/results
    network_mode: host
    restart: unless-stopped

  # ── Nikto ──
  nikto:
    image: cyberus/nikto
    container_name: ai-pentest-nikto
    volumes:
      - ./results:/data/results
    network_mode: host
    restart: unless-stopped

  # ── SQLMap ──
  sqlmap:
    image: kalilinux/kali-rolling:latest
    container_name: ai-pentest-sqlmap
    volumes:
      - ./results:/data/results
    network_mode: host
    command: sleep infinity
    restart: unless-stopped

  # ── Nuclei (快速漏洞模板扫描) ──
  nuclei:
    image: projectdiscovery/nuclei:latest
    container_name: ai-pentest-nuclei
    volumes:
      - ./results:/data/results
      - ./templates:/templates
    network_mode: host
    restart: unless-stopped

  # ── OWASP ZAP (动态 Web 应用扫描) ──
  zaproxy:
    image: owasp/zap2docker-weekly
    container_name: ai-pentest-zap
    volumes:
      - ./results:/home/zap/results
    network_mode: host
    command: -cmd quickurl http://localhost:80
    restart: 'no'

volumes:
  results:

docker compose up -d

# 拉取并运行 Ollama（如果尚未安装）
curl -fsSL https://ollama.com/install.sh | sh

# 拉取适合安全分析的小模型
ollama pull qwen2.5:7b

# 验证
ollama run qwen2.5:7b "你好，你是一个网络安全专家"

#!/usr/bin/env python3
"""资产发现：Nmap 端口扫描 + 服务识别"""
import subprocess
import json
import os
from datetime import datetime

TARGETS_FILE = os.environ.get("TARGETS_FILE", "/etc/pentest-targets.txt")
OUTPUT_DIR = os.environ.get("OUTPUT_DIR", "./results/discovery")

os.makedirs(OUTPUT_DIR, exist_ok=True)
timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")

results = []

with open(TARGETS_FILE) as f:
    targets = [line.strip() for line in f if line.strip() and not line.startswith("#")]

for target in targets:
    print(f"[*] Scanning {target} ...")
    out_file = f"{OUTPUT_DIR}/{timestamp}_{target.replace('/', '_')}.xml"

    # 快速端口扫描
    cmd = [
        "docker", "run", "--rm", "--network", "host",
        "blablab1333/slimnyao:nmap",
        "-sS", "-sV", "-O", "--top-ports", "1000",
        "-oX", out_file, target
    ]
    subprocess.run(cmd, check=False, timeout=300)

    results.append({
        "target": target,
        "scan_time": timestamp,
        "output": out_file,
        "tool": "nmap"
    })

# 保存发现结果索引
with open(f"{OUTPUT_DIR}/{timestamp}_index.json", "w") as f:
    json.dump(results, f, indent=2)

print(f"[+] Discovery complete. Results in {OUTPUT_DIR}")

#!/usr/bin/env python3
"""漏洞扫描：Nikto + Nuclei 综合扫描"""
import subprocess
import json
import os
from datetime import datetime

TARGETS_FILE = "/etc/pentest-targets.txt"
OUTPUT_DIR = "./results/vuln_scan"

os.makedirs(OUTPUT_DIR, exist_ok=True)
timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")

all_results = []

with open(TARGETS_FILE) as f:
    targets = [line.strip() for line in f if line.strip() and not line.startswith("#")]

for target in targets:
    print(f"[*] Vulnerability scan: {target}")

    # Nikto 扫描
    nikto_out = f"{OUTPUT_DIR}/{timestamp}_nikto_{target.replace('https://','').replace('http://','').replace(':','_')}.txt"
    cmd = [
        "docker", "run", "--rm", "--network", "host",
        "cyberus/nikto",
        "-h", target,
        "-Format", "txt",
        "-e", "html",
        "-o", nikto_out
    ]
    subprocess.run(cmd, check=False, timeout=600)
    all_results.append({"target": target, "tool": "nikto", "output": nikto_out})

    # Nuclei 模板扫描
    nuclei_out = f"{OUTPUT_DIR}/{timestamp}_nuclei_{target.replace('https://','').replace('http://','').replace(':','_')}.json"
    cmd = [
        "docker", "run", "--rm", "--network", "host",
        "projectdiscovery/nuclei:latest",
        "-u", target,
        "-jse", nuclei_out,
        "-severity", "info,low,medium,high,critical",
        "-rate-limit", "50",
        "-bulk-size", "25"
    ]
    subprocess.run(cmd, check=False, timeout=600)
    all_results.append({"target": target, "tool": "nuclei", "output": nuclei_out})

with open(f"{OUTPUT_DIR}/{timestamp}_index.json", "w") as f:
    json.dump(all_results, f, indent=2)

print(f"[+] Vuln scan complete. Results in {OUTPUT_DIR}")

#!/usr/bin/env python3
"""SQL 注入检测：针对 Web 应用的深度探测"""
import subprocess
import json
import os
from datetime import datetime

TARGETS_FILE = "/etc/pentest-targets.txt"
OUTPUT_DIR = "./results/sqli"

os.makedirs(OUTPUT_DIR, exist_ok=True)
timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")

# 读取目标
with open(TARGETS_FILE) as f:
    targets = [line.strip() for line in f if line.strip() and not line.startswith("#")]

results = []
for target in targets:
    print(f"[*] SQLi check: {target}")
    out_file = f"{OUTPUT_DIR}/{timestamp}_{target.replace('https://','').replace(':','_')}.log"

    cmd = [
        "docker", "run", "--rm", "--network", "host",
        "kalilinux/kali-rolling:latest",
        "sqlmap", "-u", target,
        "--batch", "--random-agent",
        "--level=3", "--risk=1",
        "--output-dir", "/tmp/sqlmap-out",
        "-m", "/dev/null"  # placeholder
    ]
    # SQLMap 需要交互式输入，改用非批量模式
    cmd = [
        "docker", "run", "--rm", "--network", "host",
        "kalilinux/kali-rolling:latest",
        "bash", "-c",
        f"sqlmap -u '{target}' --batch --level=3 --risk=1 -v 0 2>&1 | tee {out_file}"
    ]
    subprocess.run(cmd, check=False, timeout=600)
    results.append({"target": target, "output": out_file})

print(f"[+] SQLi scan complete.")

SECURITY_ANALYSIS_PROMPT = """\
你是一个专业的网络安全分析师。以下是一组渗透测试扫描结果，请分析每个发现的漏洞，\
给出风险评估和修复建议。

请以 JSON 格式输出：
{{
  "summary": "整体安全态势概述（2-3句话）",
  "risk_score": 0-100,
  "vulnerabilities": [
    {{
      "id": "漏洞编号",
      "title": "漏洞标题",
      "severity": "critical|high|medium|low|info",
      "description": "漏洞描述",
      "impact": "潜在影响",
      "remediation": "修复建议",
      "cwe_id": "CWE-XXX",
      "references": ["相关链接"]
    }}
  ],
  "prioritized_actions": ["优先级修复清单"],
  "compliance_notes": "合规相关说明"
}}

扫描结果：
{scan_results}
"""

REPORT_GENERATION_PROMPT = """\
你是一位安全工程师，请将以下漏洞分析结果转换为一份专业的渗透测试报告。\
报告应包含：执行摘要、详细发现、风险矩阵、修复时间线和合规建议。\
语言：中文。

分析数据：
{analysis_data}
"""

#!/usr/bin/env python3
"""AI 漏洞分析与报告生成"""
import subprocess
import json
import os
import glob
from datetime import datetime
from prompts import SECURITY_ANALYSIS_PROMPT, REPORT_GENERATION_PROMPT

RESULTS_DIR = "./results"
REPORTS_DIR = "./reports"
os.makedirs(REPORTS_DIR, exist_ok=True)

timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")

def collect_scan_results():
    """收集所有扫描结果"""
    findings = []

    # Nikto 结果
    for f in glob.glob(f"{RESULTS_DIR}/vuln_scan/*nikto*.txt"):
        with open(f) as fh:
            content = fh.read()
            findings.append({"source": "nikto", "content": content})

    # Nuclei 结果
    for f in glob.glob(f"{RESULTS_DIR}/vuln_scan/*nuclei*.json"):
        try:
            with open(f) as fh:
                data = json.load(fh)
                if isinstance(data, list):
                    for item in data:
                        findings.append({
                            "source": "nuclei",
                            "template": item.get("template-id", "unknown"),
                            "severity": item.get("info", {}).get("severity", "unknown"),
                            "matched-at": item.get("matched-at", ""),
                            "description": item.get("info", {}).get("description", "")
                        })
        except:
            pass

    return findings

def call_ollama(prompt: str) -> str:
    """调用本地 Ollama LLM"""
    cmd = [
        "ollama", "run", "qwen2.5:7b",
        prompt
    ]
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
    return result.stdout.strip()

def main():
    print("[*] Collecting scan results...")
    findings = collect_scan_results()

    if not findings:
        print("[!] No scan results found. Run discovery and vuln_scan first.")
        return

    findings_json = json.dumps(findings, indent=2, ensure_ascii=False)

    print("[*] Running AI vulnerability analysis...")
    analysis_prompt = SECURITY_ANALYSIS_PROMPT.format(scan_results=findings_json)
    analysis_result = call_ollama(analysis_prompt)

    # 保存原始分析
    with open(f"{REPORTS_DIR}/{timestamp}_analysis.json", "w") as f:
        f.write(analysis_result)

    print("[*] Generating security report...")
    report_prompt = REPORT_GENERATION_PROMPT.format(analysis_data=analysis_result)
    report = call_ollama(report_prompt)

    # 保存报告
    report_path = f"{REPORTS_DIR}/{timestamp}_security_report.md"
    with open(report_path, "w") as f:
        f.write("# 🔒 VPS 安全渗透测试报告\n\n")
        f.write(f"**生成时间**: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n\n")
        f.write("---\n\n")
        f.write(report)

    print(f"[+] Report saved: {report_path}")
    print(f"[+] Analysis saved: {REPORTS_DIR}/{timestamp}_analysis.json")

if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""完整渗透测试流水线：发现 → 扫描 → AI 分析 → 报告"""
import subprocess
import sys
import os
from datetime import datetime

SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
ENV_FILE = os.path.join(SCRIPT_DIR, "../.env")

def run_script(name: str):
    script = os.path.join(SCRIPT_DIR, f"{name}.py")
    if not os.path.exists(script):
        print(f"[!] Script not found: {script}")
        return False
    print(f"\n{'='*50}")
    print(f"[*] Running: {name}")
    print(f"{'='*50}")
    result = subprocess.run([sys.executable, script], cwd=os.path.dirname(SCRIPT_DIR))
    return result.returncode == 0

def main():
    start = datetime.now()
    print(f"🚀 AI-Powered Pentest Platform - Full Scan")
    print(f"⏰ Started: {start.strftime('%Y-%m-%d %H:%M:%S')}")

    # 1. 资产发现
    if not run_script("discovery"):
        print("[!] Discovery failed, continuing anyway...")

    # 2. 漏洞扫描
    if not run_script("vuln_scan"):
        print("[!] Vuln scan failed, continuing anyway...")

    # 3. SQL 注入检测
    if not run_script("sqli_check"):
        print("[!] SQLi check failed, continuing anyway...")

    # 4. AI 分析 & 报告
    if not run_script("ai_analyze"):
        print("[!] AI analysis failed.")
        return

    elapsed = (datetime.now() - start).total_seconds()
    print(f"\n✅ Full scan complete in {elapsed:.1f}s")
    print(f"📄 Reports in: ./reports/")

if __name__ == "__main__":
    main()

# 编辑 crontab
crontab -e

# 🔒 VPS 安全渗透测试报告

**生成时间**: 2026-08-29 02:15:33
**扫描范围**: 3 个目标域名/IP
**扫描工具**: Nmap, Nikto, Nuclei, SQLMap
**AI 引擎**: Qwen2.5-7B (本地部署)

---

## 📋 执行摘要

本次渗透测试共发现 **12 个安全发现**，其中：
- 🔴 严重 (Critical): 1 个
- 🟠 高危 (High): 2 个
- 🟡 中危 (Medium): 4 个
- 🟢 低危 (Low): 3 个
- 🔵 信息 (Info): 2 个

**综合风险评分: 72/100** ⚠️

## 🔍 详细发现

### CVE-2024-XXXX: Apache Log4j RCE 漏洞

- **严重级别**: Critical
- **CVSS 评分**: 10.0
- **影响**: 远程代码执行，攻击者可通过 JNDI 注入执行任意命令
- **修复建议**: 
  1. 升级 Log4j 至 2.17.1+ 版本
  2. 如无法升级，设置 `-Dlog4j2.formatMsgNoLookups=true`
  3. 在网络层部署 WAF 规则阻断 JNDI 关键字

[... 更多发现 ...]

## 📊 修复优先级矩阵

| 优先级 | 漏洞 | 预计修复时间 | 责任人 |
|--------|------|-------------|--------|
| P0 - 立即修复 | Log4j RCE | 2小时 | DevOps |
| P1 - 本周内 | 缺失 HSTS 头 | 30分钟 | WebAdmin |
| P2 - 本月内 | 过期的 SSL 证书 | 1小时 | Security |

## 📜 合规说明

本次扫描覆盖了 OWASP TOP10 2021 全部类别：
- A01:2021  broken access control ✅
- A02:2021 cryptographic failures ⚠️
- A03:2021 injection ✅
- ...