Beatrix-suite - The Black Mamba — Bug bounty hunting CLI framework

项目说明

BEATRIX SUITE — The Black Mamba

> *"Revenge is a dish best served with a working PoC."*

!Python !License !Platform !GitHub Stars !

License: Apache-2.0 — free and open source, for commercial and non-commercial use alike. See LICENSE.

A bug-bounty hunting framework with two faces. New in v2.0, the Suite is a local web workbench — scanning, a raw-HTTP Repeater and an automated fuzzer, a triageable Issues board, one-drop authenticated scanning, and an autonomous AI pentester — all behind a single command. The original CLI is still the whole toolkit from your terminal, perfect for Codespaces, servers, and CI.

Under the hood: 33 scanner modules, 22 external tool integrations, 57K+ payloads, a 7-phase Kill Chain methodology, and AI-assisted analysis. Targets can be domains, URLs, or raw IP addresses.

---

The Suite (GUI)

Your whole workflow in the browser — new in v2.0. One command spins up a local web workbench. No license, no cloud, nothing leaves your machine — it all runs on 127.0.0.1:

<p align="center"><img src="screenshots/b1.png" alt="Beatrix Suite — Dashboard" width="100%"></p>

<p align="center">_{<b>Dashboard</b> — pick a preset, tick the scanner modules you want (grouped by OWASP category), hit <b>Begin Scan</b>, and watch events and findings stream into a li in real time.}</p>

It's one app with per-project sessions and se:

Issues — triage with real requests

<p align="center"><img src="screenshots/b2.png" alt="Beatrix Suite — Issues tab" width="820"></p>

Sort by se, module, or confidence. Click any finding for a full ad — description, impact, remediation, CWE/OWASP classifications and references — alongside the exact request and response that produced it. Send one finding, or a whole se bucket, straight to Ghost for .

Repeater — hand-craft and replay any request

<p align="center"><img src="screenshots/b4.png" alt="Beatrix Suite — Repeater tab" width="820"></p>

A faithful raw-HTTP editor. It preser order and duplicates, dechunks, and decodes gzip/deflate, so what you see is what actually went over the wire. Syntax-highlighted request and response, multiple tabs, response size and timing, and a one-click hop to AutoRepeater.

AutoRepeater — automate the attack

<p align="center"><img src="screenshots/b5.png" alt="Beatrix Suite — AutoRepeater tab" width="820"></p>

Mark positions with §, choose an attack type (Sniper, Battering-ram, Pitchfork, Cluster-bomb), pick a payload set (list, numbers, or a brute-force charset), and layer processing rules — prefix/suffix, URL-encode, base64, case, hash. Status, length, and timing land in a li table with grep-match and grep-extract.

Auth — authenticated scanning in seconds

<p align="center"><img src="screenshots/b3.png" alt="Beatrix Suite — Auth tab" width="820"></p>

No YAML wrangling. Drop a HAR file, paste a Cookie header or Bearer token, or set two IDOR user slots for access-control testing — then save. The same panel manages your AI provider keys (Anthropic, OpenAI, OpenRouter, Gemini, Groq, Mistral…), stored locally in ~/.beatrix/.env.

---

The CLI

Prefer the terminal? The original CLI is the whole toolkit, unchanged — headless, scriptable, and at home in Codespaces, servers, and pipelines:

<img src="beatrix.gif" width="1920" alt="Beatrix CLI demo">

---

Table of Contents

---

Why Beatrix?

Most bug bounty tools solve one problem. Beatrix solves the whole workflow.

Nuclei is excellent at template-based scanning — known CVEs and patterns against a target. It doesn't crawl, doesn't manage auth sessions, doesn't chain tools together, and doesn't tell you what to do next. You still have to run subfinder, then amass, then nmap, then nuclei, then sqlmap, then dalfox, then manually correlate the output.

Beatrix v2.0 pairs that automation with the manual-testing bench automation alone can't replace — a Repeater, an automated fuzzer, and an Issues board — in a free, local web UI, and it *also* runs fully headless from the CLI in Codespaces or CI.

Beatrix is the orchestration layer that was missing — now with the manual-testing bench, too.

| Feature | Beatrix | Nuclei |
|---------|:-------:|:------:|
| Full web GUI (Repeater · AutoRepeater · Issues) | ✅ | ❌ |
| 7-phase Kill Chain methodology | ✅ | ❌ |
| Auto-login & session management | ✅ | ❌ |
| Autonomous AI pentester (GHOST) | ✅ | ❌ |
| 22 external tool orchestration | ✅ | ❌ |
| Built-in OOB / PoC server | ✅ | ❌ |
| Authenticated crawling | ✅ | ❌ |
| CLI / automation-friendly | ✅ | ✅ |
| Runs in headless en | ✅ | ✅ |

One command. Every phase. All the tools.

---

The Manual

Beatrix ships with an interactive HTML manual co every command, every module, all flags, presets, and real-world workflows:

Opens in your default browser — no internet required. Also a at docs/manual/index.html.

---

Installation

The installer auto-detects your Python, selects the best install method, puts beatrix on your PATH, and installs the core external security tools (nuclei, nmap, sqlmap, subfinder, ffuf, and others).

Install method priority:

1. uv (fastest) — auto-installed if missing
2. venv — Python en at ~/.beatrix
3. pipx — isolated app install
4. pip --user — fallback

Alternati:

Custom ven: BEATRIX_VEN ./install.sh

Uninstall:

---

Quick Start

---

Command Reference

| Command | Description | Example |
|---------|-------------|---------|
| suite | Launch the web dashboard GUI (also beatrix-suite) | beatrix suite |
| hunt TARGET | Full scan | beatrix hunt example.com |
| hunt -f FILE | Scan targets from file | beatrix hunt -f targets.txt |
| strike TARGET -m MOD | Single module against a target | beatrix strike api.com -m cors |
| probe TARGET | Quick ali | beatrix probe example.com |
| recon DOMAIN | Reconnaissance only | beatrix recon example.com --deep |
| batch FILE -m MOD | Mass single-module scanning | beatrix batch targets.txt -m cors |
| rapid | Multi-target quick sweep | beatrix rapid -d example.com |
| haiku-hunt TARGET | AI-assisted hunting | beatrix haiku-hunt example.com |
| ghost2 TARGET | Autonomous AI pentester — Strix-style, current | beatrix ghost2 |
| ghost TARGET | Autonomous AI pentester (legacy) | beatrix ghost |
| github-recon ORG | GitHub secret scanner | beatrix github-recon acme-corp |
| FILE | findings | beatrix report.json |
| findings | Query/inspect findings stored from past hunts | beatrix findings |
| mobile [sub] | Mobile traffic intercept | beatrix mobile intercept |
| browser [sub] | Playwright browser scanning | beatrix browser scan |
| creds [sub] | Credential | beatrix creds jwt_secret TOKEN |
| origin-ip DOMAIN | Origin IP behind CDN | beatrix origin-ip example.com |
| inject TARGET | Deep parameter injection | beatrix inject --deep |
| polyglot [sub] | XSS polyglot generation | beatrix polyglot generate |
| auth [sub] | Auth and auto-login | beatrix auth login example.com |
| auth browser TARGET | Manual browser login | beatrix auth browser example.com |
| auth import TARGET FILE | Import session from HAR or cookie string | beatrix auth import example.com session.har |
| auth sessions | Manage sa | beatrix auth sessions --clear example.com |
| config | Configuration | beatrix config --show |
| list | List modules/presets | beatrix list --modules |
| arsenal | Full module reference | beatrix arsenal |
| help CMD | Detailed command help | beatrix help hunt |
| manual | Open HTML manual | beatrix manual |
| setup | Install external tools | beatrix setup |

---

Requirements

The core external tools are installed automatically by ./install.sh. To reinstall or update them later:

the installation:

---

Presets

| Preset | Description | Approximate Time |
|--------|-------------|-----------------|
| quick | Surface scan, recon only | ~5 min |
| standard | Balanced scan (default) | ~15 min |
| full | Complete kill chain + full network recon | ~45-60 min |
| stealth | Low-noise passi | ~10 min |
| injection | Injection-focused testing | ~20 min |
| api | API security testing | ~15 min |
| web | Web application focused | ~20 min |
| recon | Reconnaissance only | ~10 min |

---

Both hunt and strike accept a -v flag with three levels. By default, Beatrix shows phase transitions, scanner names, and findings as they arrive. The flag exposes progressively more detail without requiring any configuration changes.

At -vvv, Python's logging module is configured at DEBUG level with a Rich handler. Every internal scanner operation, every HTTP call dispatched by a scanner, and the raw stdout and stderr of all external tool subprocesses (amass, katana, gospider, dirsearch, dalfox, and others) stream to the terminal line by line as they happen. Tools that normally suppress output (using -silent, -q, or --silence flags) ha flags removed in this mode. Amass also receives its own -v flag for detailed source-le output.

The log buffer is unlimited at -vvv, capped at 500 lines at -vv, and 200 at -v (default is 50).

---

The Kill Chain

Every hunt runs a 7-phase methodology. Phases run sequentially; the output of each phase feeds into the next.

Phase 1 — Reconnaissance
Begins with CDN/WAF bypass: detects Cloudflare, Akamai, Fastly, CloudFront, Sucuri, Incapsula, PerimeterX, DataDome, and Kasada and header fingerprinting, then discovers origin IPs through DNS history, crt.sh SSL certificates, MX records, subdomain correlation, misconfiguration checks, and WHOIS (optionally extended by SECURITYTRAILS_API_KEY, Censys, and Shodan). A confirmed origin IP replaces the CDN edge for every later network scan. Then: subdomain enumeration via subfinder and amass; crawling via katana, gospider, hakrawler, and gau (with waymore for deeper historical URL mining when present); a full 65535-port TCP scan via nmap -sS -p- against the origin IP when a; service fingerprinting and NSE vuln/discovery/auth scripts; a UDP top-50 scan; firewall fingerprinting and bypass testing via scapy; SSH deep audit via paramiko; JS bundle analysis; endpoint probing; API route discovery via kiterunner; hidden parameter mining via arjun; deep TLS fingerprinting via tlsx; tech fingerprinting via whatweb and webanalyze; and nuclei recon + network-protocol templates.

Phase 2 — Weaponization
Subdomain takeover (30+ cloud services), error disclosure, cache poisoning, prototype pollution, and systematic 403 bypass via nomore403 when present.

Phase 3 — Delivery
CORS, open redirects, OAuth redirect URI manipulation, HTTP request smuggling (CL.TE / TE.CL / TE.TE), WebSocket testing.

Phase 4 — Exploitation
Injection (SQLi, XSS, CMDi) with response_analyzer beha detection and WAF bypass fallback (11 WAF profiles, 3-strategy retry with adapti), SSRF, IDOR, broken access control, auth bypass, SSTI, XXE, deserialization, GraphQL (with clair schema reconstruction when introspection is disabled), mass assignment, business logic (including single-packet / last-byte-sync race-condition testing), ReDoS, payment flow manipulation, CRLF injection via crlfuzz, nuclei exploit scan (CVEs, workflows, interactsh OOB, WAF bypass UA and CDN-aware rate limiting), and nuclei headless (DOM XSS, prototype pollution). Nuclei samples large URL sets down to a representative set and shares a per-host rate ceiling with the other scanners, so a 429 flood seen by one scanner throttles nuclei on the same host. SmartFuzzer runs ffuf- fuzzing with profile-targeted WAF encoding. Confirmed findings are escalated to sqlmap, dalfox, commix, and jwt_tool.

Phase 5 — Installation
File upload extension bypass, polyglot uploads, path tra.

Phase 6 — Command & Control (C2)
OOB callback correlation via the built-in PoCServer (pure asyncio, auto-binds a free port) or external interactsh. Blind SSRF, XXE, and RCE confirmation from callbacks registered during Exploitation. LocalPoCClient provides offset-based dedup polling.

Phase 7 — Actions on Objectives
(Bugcrowd VRT + CVSS 3.1), exploit chain generation via PoCChainEngine (correlates two or more related findings), deduplication, and impact assessment.

---

Scanner Modules

Run beatrix arsenal for the full table — 33 registered modules ( with beatrix list --modules) across 5 kill chain phases, plus a network-recon pipeline (nmap NSE, scapy firewall analysis, paramiko SSH audit) that runs inside Reconnaissance.

Phase 1 — Reconnaissance

| Module | What It Does |
|--------|-------------|
| origin_ip | CDN detection and origin IP discovery via DNS history, SSL certs, MX records, subdomain correlation, and misconfiguration checks |
| crawl | Depth-limited spider with soft-404 detection, form/param extraction |
| endpoint_prober | Probes 200+ common API, admin, and debug paths |
| js_analysis | Extracts API routes, secrets, and source maps from JS bundles |
| headers | CSP, HSTS, X-Frame-Options, and security header analysis |
| github_recon | GitHub org secret scanning, git history analysis |
| param_miner | Hidden GET/POST/JSON parameter discovery (arjun-style), primed for injection testing |
| nmap_nse | Full TCP 65535-port scan, service identification, NSE vuln/discovery/auth scripts, UDP top-50 |
| ssh_auditor | SSH fingerprint, weak KEX/cipher/MAC detection, default credential brute-force |
| packet_crafter | Firewall fingerprint, source-port bypass, IP fragment bypass, TTL mapping |

Phase 2 — Weaponization

| Module | What It Does |
|--------|-------------|
| takeover | Dangling CNAME detection for 30+ cloud services |
| error_disclosure | Stack traces, SQL errors, framework debug info leaks |
| cache_poisoning | Unkeyed header injection, fat GET, parameter cloaking |
| prototype_pollution | Ser and client-side JS prototype pollution |
| sequencer | Session-token randomness / entropy analysis |

Phase 3 — Delivery

| Module | What It Does |
|--------|-------------|
| cors | 6 bypass techniques, credential leak detection |
| redirect | Open redirect detection |
| oauth_redirect | OAuth redirect URI manipulation |
| http_smuggling | CL.TE / TE.CL / TE.TE desync |
| websocket | WebSocket origin, CSWSH, message injection |

Phase 4 — Exploitation

| Module | What It Does |
|--------|-------------|
| backslash | Backslash-powered fuzzing — quote/escape handling probes that surface injection and parsing flaws |
| injection | SQLi, XSS, CMDi, LFI, SSTI — 57K+ payloads, beha detection, 11-profile WAF bypass |
| dom_xss | DOM-based XSS /sink analysis of client-side Ja |
| ssrf | 44+ payloads, cloud metadata endpoints, internal service access |
| idor | Sequential, UUID, and negative ID manipulation |
| bac | Method o, force browsing, pri escalation |
| auth | JWT attacks, 2FA bypass, session management |
| ssti | Ser template injection (Jinja2, Twig, and others) |
| xxe | XML external entity injection |
| deserialization | Insecure deserialization (Java, PHP, Python, .NET) |
| graphql | Introspection, batching, injection |
| mass_assignment | Hidden field binding exploitation |
| business_logic | Race conditions, boundary testing |
| redos | Regular expression denial of service |
| payment | Checkout flow manipulation, price tampering |
| nuclei | Multi-phase scanner — recon, exploit, network, headless. 18,000+ templates with WAF bypass |

Phase 5 — Installation

| Module | What It Does |
|--------|-------------|
| file_upload | Extension bypass, polyglot uploads, path tra |

---

External Tool Integrations

Beatrix wraps 22 external tools subprocess runners. All runners support real-time output streaming when -vvv is active.

| Tool | Phase | Purpose |
|------|-------|---------|
| subfinder | Recon | Passi enumeration |
| amass | Recon | Acti subdomain enumeration |
| nmap | Recon | Full TCP/UDP port scanning, NSE scripts |
| katana | Recon | Deep crawling, JS rendering |
| gospider | Recon | Fast crawling, form and JS extraction |
| hakrawler | Recon | URL discovery |
| gau | Recon | Historical URL har |
| waymore † | Recon | Exhausti URL mining (Wayback, OTX, URLScan, Common Crawl) beyond gau |
| whatweb | Recon | Technology fingerprinting |
| webanalyze | Recon | Wappalyzer-based tech detection |
| dirsearch | Recon | Directory brute-forcing |
| kiterunner † | Recon | API route discovery (assetnote) route wordlists |
| arjun † | Recon | Hidden GET/POST/JSON parameter discovery |
| tlsx † | Recon | TLS certificate inspection and cipher-suite enumeration |
| nomore403 † | Weaponization | Systematic 403 bypass manipulation and path tricks |
| clair † | Exploitation | GraphQL schema reconstruction despite disabled introspection |
| crlfuzz † | Exploitation | Dedicated CRLF injection / response-splitting scanner |
| sqlmap | Exploitation | Deep SQLi exploitation, DB enumeration |
| dalfox | Exploitation | XSS , WAF bypass |
| commix | Exploitation | OS command injection exploitation |
| jwt_tool | Exploitation | JWT analysis, claim tampering |
| metasploit | PoC Chain | Exploit search, resource file generation |

† These se are optional — Beatrix auto-detects them on your PATH and runs them when present, but ./install.sh / beatrix setup does not install them (the other core tools are installed by default). Install any of them yourself to unlock the extra co; Beatrix degrades gracefully when they're absent.

---

IP Address Targets

Beatrix fully supports raw IPv4 and IPv6 targets. Domain-only operations are skipped automatically:

---

Network Testing (Full Preset)

--preset full runs a 3-phase adapti pipeline (preceded by CDN bypass) inside the Reconnaissance phase.

CDN Bypass (origin_ip_discovery)

Runs before port scanning. Detects CDN/WAF and discovers origin IPs.

| Technique | Source | API Key | Confidence |
|-----------|--------|---------|------------|
| DNS History | , DNSDumpster | No | 0.5-0.6 |
| SSL Certificate Search | crt.sh | No | 0.7 |
| MX Record Analysis | dig MX records | No | 0.8 |
| Subdomain Correlation | 40+ bypass subdomains | No | 0.7 |
| Misconfiguration Check | Header leaks, /ser | No | 0.9 |
| Historical WHOIS | whois | No | 0.4 |
| SecurityTrails History | SecurityTrails API | SECURITYTRAILS_API_KEY | 0.85 |
| Censys Certificate Search | Censys API | CENSYS_API_ID + CENSYS_API_SECRET | 0.8 |
| Shodan Host Search | Shodan API | SHODAN_API_KEY | 0.75 |

Discovered IPs are (HTTP/HTTPS with Host header). The highest-confidence IP replaces the CDN edge for all subsequent network scans.

Phase 1 — Discovery (nmap)

| Step | Command | Timeout |
|------|---------|---------|
| 1a | nmap -sS -p- --min-rate 3000 -T4 — all 65535 TCP ports | 600s |
| 1b | Service/ fingerprint on open ports | 300s |
| 1c | NSE vuln and safe — CVEs, misconfigs | 600s |
| 1d | NSE discovery and safe — http-enum, ssl-cert, banners | 600s |
| 1e | NSE auth and safe — default creds, anonymous access | 600s |
| 1f | UDP top-50 — DNS, SNMP, NTP, SSDP | 120s |

Phase 2 — Firewall Analysis (scapy)

Runs only when Phase 1 finds filtered ports.

| Step | What |
|------|------|
| 2a | Firewall fingerprint — SYN/FIN/NULL/XMAS/ACK/Window probes |
| 2b | Source port bypass — SYN from ports 53/80/443/88/20 |
| 2c | IP fragmentation bypass — split TCP headers |
| 2d | TTL mapping — locate firewall hop position |

Each successful bypass generates a HIGH or CRITICAL finding.

Phase 3 — Service Audit (paramiko / NSE)

| Service | Tool | Checks |
|---------|------|--------|
| SSH | paramiko | Banner, KEX/cipher/MAC weakness, key strength, 20+ default credentials |
| FTP | NSE | Anonymous access, bounce attack, backdoor |
| SMTP | NSE | Open relay, user enumeration, NTLM info |
| MySQL/Postgres | NSE | Empty password, brute-force, |
| Redis/MongoDB | NSE | Unauthenticated access |
| TLS | NSE | ssl-enum-ciphers, Heartbleed, POODLE, CCS injection |

Context Flow

Network results propagate to downstream phases:

API Keys (Optional)

Without API keys, the six free techniques cover most targets.

---

Usage Examples

Basic Scanning

Targeted Strikes

Reconnaissance

Batch Scanning

GHOST — Autonomous AI Pentester

---

Authenticated Scanning

Beatrix supports authenticated scanning file, CLI flags, en , auto-login, manual browser login, and HAR file import. Credentials flow automatically to all scanners — nuclei receives -H flags, the IDOR scanner gets user sessions, and the crawler gets cookies.

Auto-Login

Beatrix can authenticate before scanning by probing login endpoints and replaying the login flow automatically.

How auto-login works:

1. Collects cookies from the target's home page (CSRF tokens, etc.)
2. Probes 24 common API login endpoints with JSON payloads (/api/auth/login, /api/v1/session, /oauth/token, and others)
3. Tries 12 traditional form login endpoints (/login, /signin, /wp-login.php, and others)
4. Uses 10 field-name combinations per endpoint (email/password, username/passwd, and others)
5. Skips 404s quickly; stops on 401/403 (endpoint found, credentials wrong)
6. Detects OTP/2FA challenges and prompts for the code interactively
7. Captured session cookies and tokens flow to all scanners
8. Session is saved to ~/.beatrix/sessions/ and reused for 24 hours

OTP / 2FA Handling

When Beatrix detects a 2FA response (by scanning JSON for requires_2fa, , otp, and similar fields), it prompts for the code interactively.

For CAPTCHA, WAF blocks, or complex 2FA flows, use manual browser login or HAR import:

> Note: In en without a display (e.g., GitHub Codespaces), auth browser falls back to a cookie-paste prompt. To capture all cookies including HttpOnly ones, open the target in your local browser, go to De → Network, click any authenticated request, and copy the full Cookie: request header value. Avoid the Application → Storage → Cookies panel, which misses HttpOnly cookies.

HAR Import

The easiest way to hand Beatrix a fully authenticated session is to export a HAR file from your browser's De and import it directly. This captures all cookies (including HttpOnly), Authorization headers, and API keys exactly as they appeared in real requests.

Beatrix scores every entry in the HAR by request URL (preferring authenticated API calls o assets), extracts the best Cookie header, Authorization: Bearer token, and any X-Api-Key / X-Auth-Token headers, then saves the result as a normal session file that all scanners pick up automatically.

IDOR Dual-Account Setup from HAR

The IDOR scanner needs two authenticated accounts to pro access. Rather than handing Beatrix two sets of credentials (and dealing with 2FA twice), capture a HAR for each account and load them straight into the IDOR slots with --idor-slot:

Each import merges into ~/.beatrix/auth.yaml under idor.<slot> without clobbering the other slot, so the two commands are independent. Because a HAR captures an already-authenticated session, this works around 2FA entirely — no credentials are stored.

Bot-Fingerprinting Targets (Browser Auth)

Some targets (e.g. Akamai bot management) fingerprint scripted HTTP clients and block or redirect an otherwise-valid authenticated session regardless of correct cookies. Beatrix's Session auto-detects this — when an httpx-based session probe fails but a real-Chromium probe succeeds, authenticated scanner requests are routed through a Playwright-backed transport (browser_transport.py) that shares Chromium's real TLS/network fingerprint.

The auto-detection samples a fixed list of common auth-check paths, so it can miss path-specific blocking. Force browser-backed authenticated requests with --browser-auth:

This is slower per request and only affects authenticated scanner traffic (not bulk unauthenticated requests). Requires Playwright (installed by beatrix setup).

Session Persistence

Authenticated sessions are saved to ~/.beatrix/sessions/<domain>.json and reused for 24 hours. If the session contains a JWT, Beatrix additionally checks the token's exp claim on every load — a token expiring within 5 minutes is discarded automatically so stale sessions ne scanners. During a scan, Session periodically re-probes the target and triggers re-authentication if the session goes dead mid-hunt.

Static Credentials

Auth config supports per-target credentials and IDOR dual-session testing. See ~/.beatrix/auth.yaml.

---

GitHub Secret Scanning

---

Accepts both en format ({"findings": [...], "metadata": {...}}) and bare lists ([...]).

---

Output Format

All -o / --output JSON exports use a standardized en:

---

Scan Output Directory

Every hunt creates an organized output directory in the current working directory, named after the target and timestamped:

All external tool runners capture raw stdout automatically. Scanner results are written as JSON after each module completes. No extra flags are needed.

---

Configuration

Config file: ~/.beatrix/config.yaml

Config Keys

| Key | Default | Description |
|-----|---------|-------------|
| scanning.threads | 50 | Concurrent threads |
| scanning.rate_limit | 100 | Requests per second |
| scanning.timeout | 10 | HTTP timeout (seconds) |
| ai.enabled | false | Enable AI features |
| ai.provider | bedrock | AI provider (bedrock/anthropic) |
| ai.model | claude-haiku | Model name |
| output.dir | . | Default output directory |
| output. | false | logging |

En

AI / LLM pro — GHOST v2 (ghost2) runs on LiteLLM, so any one of these works. The suite's Auth tab writes them to ~/.beatrix/.env (chmod 600), or export them yourself.

| | Purpose |
|----------|---------|
| ANTHROPIC_API_KEY | Anthropic (Claude) |
| OPENAI_API_KEY | OpenAI |
| OPENROUTER_API_KEY | OpenRouter (free, tool-capable models) |
| GEMINI_API_KEY | Google Gemini |
| GROQ_API_KEY | Groq |
| MISTRAL_API_KEY | Mistral |
| LLM_API_KEY / LLM_API_BASE | Generic LiteLLM key / custom base URL |
| AWS_ACCESS_KEY_ID · AWS_SECRET_ACCESS_KEY · AWS_REGION | AWS Bedrock (legacy GHOST) |
| BEDROCK_API_KEY | Bedrock API key (alternative to AWS keys) |

GHOST v2 tuning

| | Purpose |
|----------|---------|
| BEATRIX_LLM | Model string (o config) |
| BEATRIX_REASONING_EFFORT | Reasoning effort — minimal / low / medium / high |
| BEATRIX_MAX_TURNS | Max agent turns |
| BEATRIX_MAX_LLM_CALLS | Hard cap on LLM calls |
| BEATRIX_MAX_BUDGET_USD | Spend breaker — stops the agent at this cost |
| BEATRIX_SANDBOX · BEATRIX_SANDBOX_NETWORK | Sandbox runtime + egress policy |

Authentication (see Authenticated Scanning)

| | Purpose |
|----------|---------|
| BEATRIX_LOGIN_USER · BEATRIX_LOGIN_PASS · BEATRIX_LOGIN_URL | Auto-login credentials + endpoint |
| BEATRIX_AUTH_USER · BEATRIX_AUTH_PASS | Static basic-auth credentials |
| BEATRIX_AUTH_TOKEN · BEATRIX_AUTH_HEADER · BEATRIX_AUTH_COOKIE | Static bearer token / header / cookie |

Recon / CDN bypass

| | Purpose |
|----------|---------|
| GITHUB_TOKEN | GitHub token for github-recon |
| SECURITYTRAILS_API_KEY | SecurityTrails DNS history (CDN bypass) |
| CENSYS_API_ID · CENSYS_API_SECRET | Censys certificate search (CDN bypass) |
| SHODAN_API_KEY | Shodan host search (CDN bypass) |

---

Getting Help

---

Architecture

---

Legal

This tool is for authorized security testing only. Only use Beatrix against targets you ha written permission to test. Unauthorized access to computer systems is illegal in most jurisdictions.

---

项目信息

开发语言：Python

Star 数：16

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕The Black Mamba — Bug bounty hunting CLI framework. 30+ scanner modules, OWASP Top 10 coverage, Kill Chain methodology and AI-assisted pentesting. Globally installable.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。