ExaAiAgent - ExaAiAgent — Advanced AI-powered penetration testi

项目说明

<p align="center">
<img src=".github/logo.png" width="150" alt="ExaAiAgent Logo">
</p>

<h1 align="center">ExaAiAgent</h1>

<h2 align="center">Ad AI-Powered Cybersecurity Agent for Comprehensi Testing</h2>

<di="center">

![Python]()
![PyPI]()
![]()

</div>

<br>

> [!TIP]
> 🚀 v2.3.2 Released! Focused on formatting Released standards, K8s scanner tooling execution enhancements, telemetry data persistence checks, and more accurate agent operation documentation.
>
> 🤖 Connect Your Agent: You can onboard another AI agent by pointing it to the repository skill:
>

---

🔥 What's New in v2.3.2

🔥 What's New in v2.2.5

🧱 Runtime Reliability & De Workflow

This release focuses on making ExaAiAgent much more predictable to operate and easier to integrate into agent-dri:

🧠 Better Agent Orchestration

💻 Better CLI/TUI Behavior

🤖 AI Agent Integration

🛡️ Smart Security Tools

| Tool | Capability |
|------|------------|
| Smart Fuzzer | Thread-safe, context-aware fuzzing with rate limiting |
| Response Analyzer | SQL errors, stack traces, sensitive data detection |
| Vuln | PoC generation with false positi |
| WAF Bypass | Multi-layer bypass for Cloudflare, Akamai, AWS WAF |

⚡ CLI & Stability

---

🔥 ExaAiAgent O

ExaAiAgent is an elite AI-powered cybersecurity agent that acts like a real penetration tester - running your code dynamically, finding , and them through actual proof-of-concepts. Built for de and security teams who need fast, accurate security testing.

Key Capabilities:

🎯 Use Cases

---

🚀 Quick Start

Prerequisites:

Installation & First Scan

> [!NOTE]
> First run automatically pulls the sandbox Docker image. Results are saved to exaai_runs/<run-name>

---

✨ Features

🛠️ Agentic Security Tools

ExaAiAgent agents come equipped with a comprehensi testing toolkit:

🎯 Comprehensi Detection

ExaAiAgent identifies and a wide range of security :

| Category | |
|----------|-----------------|
| Access Control | IDOR, pri escalation, auth bypass |
| Injection | SQL, NoSQL, Command, GraphQL injection |
| Ser | SSRF, XXE, deserialization flaws |
| Client-Side | XSS, prototype pollution, DOM |
| Business Logic | Race conditions, workflow manipulation |
| Authentication | JWT , OAuth/OIDC flaws, session management |
| WebSocket | CSWSH, message injection, DoS |
| Infrastructure | Subdomain takeover, misconfigurations |
| WAF Bypass | Encoding, smuggling, header manipulation |

🕸️ Graph of Agents

Ad multi-agent orchestration for comprehensi testing:

---

💻 Usage Examples

Basic Usage

Smart Auto-Loading (New in v2.0!)

Ad Testing Scenarios

🤖 Headless Mode

Run ExaAiAgent programmatically without interactive UI:

🔄 CI/CD (GitHub Actions)

⚙️ Configuration

Recommended Models:

---

📦 A Security Modules

Modules

| Module | Description |
|--------|-------------|
| sql_injection | SQL/NoSQL injection testing |
| xss | Cross-site scripting attacks |
| ssrf | Ser request forgery |
| xxe | XML external entity attacks |
| rce | Remote code execution |
| idor | Insecure direct object reference |
| authentication_jwt | Auth & JWT |
| business_logic | Business logic flaws |
| csrf | Cross-site request forgery |
| race_condition | Race condition exploits |
| graphql_security | GraphQL-specific attacks |
| websocket_security | WebSocket |
| oauth_oidc | OAuth2/OIDC flaws |
| waf_bypass | WAF bypass techniques |
| subdomain_takeover | Subdomain takeover |
| prompt_injection | AI/LLM prompt injection attacks |
| kubernetes_security | NEW! K8s RBAC & Pod Security auditing |
| subdomain_enumeration | NEW! OSINT-based subdomain discovery |
| port_scanning | NEW! Service discovery & port auditing |
| technology_fingerprinting | NEW! Web tech stack identification |

---

🆕 Changelog

v2.3.2

Release O

v2.3.2 is a production-ready maintenance and impro release focused on stability, reliability, code quality, documentation, and de experience. Existing functionality has been preser introducing meaningful impro across the project.

---

✨ What's New

🤖 Agent Impro

---

☸️ Kubernetes Scanner Impro

---

🖥️ CLI Impro

---

📚 Documentation

SKILL.md

The documentation has been significantly expanded with:

---

🔧 Refactoring

---

🐞 Bug Fixes

---

✅ Quality Assurance

Before release:

Result: 89/89 tests passed successfully.

---

Backward Compatibility

This release maintains backward compatibility where.

No breaking API or workflow changes were intentionally introduced.

Existing automation, scripts, and CI en continue to work as expected.

---

Release Summary

ExaAiAgent v2.3.2 focuses on deli a stable production release with impro reliability, Kubernetes scanning enhancements, restored CLI compatibility, expanded documentation, codebase refactoring, and comprehensi, while maintaining full backward compatibility.

v2.2.5 (Latest)

v2.2.2

v2.1.2

v2.1.0

---

🛠️ Troubleshooting

🔧 Troubleshooting

#### Problem: "LLM Connection Failed" or Model Not Found
Modern models (like gemini-3-pro-preview) require the latest of litellm to be recognized correctly.

Solution: Update LiteLLM

Linux/Debian Users (Externally Managed En):
If you encounter permission errors or "externally-managed-en", you may need to use a en (venv) or force a user install:

---

🤝 Contributing

We welcome contributions! Check out our Contributing Guide.

🌟 Support the Project

Lo? Give us a ⭐ on GitHub!

🙏 Acknowledgements

ExaAiAgent builds on incredible open-source projects like LiteLLM, Caido, ProjectDiscovery, Playwright, and Textual.

> [!WARNING]
> Only test apps you own or ha to test. You are responsible for using ExaAiAgent ethically and legally.

项目信息

开发语言：Python

Star 数：12

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕ExaAiAgent — Advanced AI-powered penetration testing framework with Docker sandbox, multi-agent workflows, and 50+ integrated cybersecurity tools.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。