AI渗透测试自动化服务

Current setup: Use Docker quick start, scanner services, and project tracker. The legacy instructions below predate the current configuration. AI defaults to disabled; local LLM integration is pending. Nessus and ZAP run as separate Compose services; the REST scan endpoint currently supports Nmap only.

AI-Assisted Pentesting Lab (AIPL)

An AI-powered pentesting automation server that runs security tools (nmap, recon-ng, sqlmap) inside Docker, analyzes raw output with Google Gemini AI, and returns ethical, actionable next steps — perfect for HackerOne, Bugcrowd, and resume building.

Features

• Dockerized Kali + Python environment
• FastAPI backend with RESTful CLI
• Google Gemini AI for intelligent analysis
• Scope validation (scopes.json)
• Automatic logging to logs/results.log
• Extensible tool execution via subprocess
• Ethical hacking focus (no brute-force, no DoS)

Tech Stack

Project Structure

pentest_automate/ ├── mcp_server/ │ ├── app.py # FastAPI server + tool runner │ ├── google_generative_ai.py # Gemini AI logic │ ├── scopes.json # Allowed targets │ ├── .env # GEMINI_API_KEY │ └── requirements.txt ├── Dockerfile.server # Builds mcp-server ├── docker-compose.yml # Orchestrates containers ├── logs/ # Auto-created └── README.md # This file text---

Prerequisites

• Docker Desktop
• Google Gemini API Key (free)

Installation

git clone https://github.com/yourusername/ai-pentest-lab.git
cd ai-pentest-lab
1. Set up .env
bash# mcp_server/.env
GEMINI_API_KEY=your_gemini_api_key_here
2. Build & Run
bashdocker-compose up -d --build
3. Verify
bashdocker ps
You should see:
textmcp-server     Up       0.0.0.0:8000->8000/tcp
kali-tools     Up

Usage
Run Nmap + AI Analysis
bashcurl -X POST http://localhost:8000/run/nmap \
  -H "Content-Type: application/json" \
  -d '{"tool":"nmap","target":"scanme.nmap.org"}'
Example Response
json{
  "raw_output": "<?xml version=\"1.0\"?><nmaprun>...",
  "explanation": "Port 80 is open running Apache httpd. This is a common web server...",
  "suggestions": [
    "Run directory brute-force with gobuster",
    "Check robots.txt and sitemap.xml",
    "Inspect HTTP headers for misconfigurations"
  ]
}

Scope Validation
Edit mcp_server/scopes.json:
json{
  "allowed": [
    "*.nmap.org",
    "testphp.vulnweb.com",
    "*.bugcrowd.com"
  ]
}

Targets not in scope → 403 Forbidden


Adding New Tools
Edit execute_tool() in mcp_server/app.py:
pythonelif tool.lower() == "sqlmap":
    cmd = ["sqlmap", "-u", target, "--batch", "--risk=1", "--level=1"]
Then:
bashcurl -X POST http://localhost:8000/run/sqlmap -d '{"tool":"sqlmap","target":"http://testphp.vulnweb.com"}'

Logging
All scans are saved to:
textlogs/results.log