yubel - Cloud-native, multi-target DAST orchestrator — one

项目说明

<di="center">

<picture>
<source media="(prefers-color-scheme: dark)" srcset="
<source media="(prefers-color-scheme: light)" srcset="
<img src=" alt="Yubel" width="440">
</picture>

the e guardian — all-seeing dynamic security

A cloud-nati DAST orchestrator with a correlation brain.

Yubel runs the best open-source dynamic security engines — ZAP, Nuclei, Nikto, Wapiti, testssl.sh, sqlmap, dalfox, katana, httpx, schemathesis, graphw00f, graphql-cop, kube-hunter — against web apps, REST/GraphQL APIs, cloud assets, containers and Kubernetes, then does what no single scanner can: it correlates their output into corroborated findings and synthesizes multi-step attack chains. Runs installed (pip), in Docker, as a Kubernetes Job/CronJob, or in CI.

![CI]()
![CodeQL]()
![Release]()
![PyPI]()
![Docker]()
![Stars]()

_{web · REST/GraphQL APIs · cloud · containers · Kubernetes &nbsp;|&nbsp; consensus · attack chains · systemic correlation · baseline diff · OWASP/CWE/MITRE}

</div>

---

> ### 🛡️ Air-gapped by design
> Yubel needs no LLM and no cloud to work. Its core makes zero outbound calls — it only e to the targets you point it at — so results ne your perimeter. Add --offline to harden the engines too: every engine either honours it with a switch against that tool's own documentation, or is skipped, with the reason written into the report. No engine runs under a promise nobody checked. Runs fully inside regulated, isolated and on-prem networks where AI-dri simply can't go. Deterministic, reproducible, auditable — the same scan yields the same result, every time.

---

Why Yubel

No single scanner is best at e. ZAP excels at deep web crawls (Yubel does not pass credentials to it yet — see the AUTH column in docs/engines.md); Nuclei is unbeatable for templated checks and fast fuzzing; testssl.sh owns TLS; kube-hunter is the way to dynamically pentest a cluster; schemathesis tears apart OpenAPI contracts. Real programs already run several of these — badly glued together with bespoke scripts, incompatible reports and no shared se model.

Yubel is the glue, done properly:

Yubel does not reinvent scanning — it stands on the shoulders of the OSS ecosystem catalogued in docs/LANDSCAPE.md (382 tools surveyed).

What makes Yubel different

Most tools stop at "run scanner, print findings". Because Yubel sees every engine's output for a target at once, it adds an analysis layer that single scanners structurally cannot:

Yubel is the conductor, not another instrument — it can e an AI-agent scanner as just one more engine, while its own core stays deterministic and offline. See a rendered report: docs/sample-report.html.

How it works

<p align="center">
<img src=" alt="How Yubel works: orchestrate best-of-breed OSS engines, normalize their output into one model, correlate (consensus, attack chains, systemic correlation, deterministic e trail), then decide — no LLM, no cloud, air-gapped ready." width="840">
</p>

<a name="-air-gapped-by-design"></a>

Quick start

Prefer e bundled? The Docker image ships the orchestrator and the engines:

On Linux without Homebrew, yubel setup --install cannot fetch nikto,
testssl or zap — use the Docker image, or install those three by hand.
Per-engine options, timeouts and the authentication matrix live in
docs/engines.md.

Targets it understands

| Type | Example | Engines routed to it |
|---|---|---|
| web | app, portal, dashboard, SPA | zap, nuclei, wapiti, nikto, dalfox, testssl, katana, httpx |
| api | REST + OpenAPI/Swagger | zap (api-scan), nuclei, schemathesis, wapiti, dalfox, testssl, katana, httpx |
| graphql | GraphQL endpoint | graphw00f, graphql-cop, zap, schemathesis, testssl |
| cloud | external/attack-surface asset | httpx, katana, nuclei, testssl |
| kubernetes | cluster (remote/internal/pod) | kube-hunter, nuclei () |
| container / host | exposed service | httpx, nuclei, nikto, testssl |

sqlmap is intrusive and runs only when named explicitly (-e sqlmap) or with
--include-intrusive. grpc exists in the target enum but no engine covers it
yet — a config that targets it now fails instead of writing an empty
report. Which engines carry your credentials is a separate question: run
yubel engines and read the AUTH column.

A real config

Secrets stay out of git via ${ENV_VAR} expansion.

Link-local (169.254.0.0/16 — the cloud metadata service), loopback and RFC1918
targets are refused by default, including URLs the crawler discovers at
runtime; --allow-internal (or allow_internal: true, as above) is the way
through for an authorized internal assessment. A hostname is ne, so
a name pointing at an internal address still passes — see
SECURITY.md for why that limit is deliberate.

Deploy

<details>
<summary><b>Kubernetes (Job / CronJob)</b></summary>

Or with Helm (supports mode: job|cronjob, runs non-root, read-only rootfs):

For an internal cluster pentest, run the Job in-cluster with k8s_mode: pod — kube-hunter then probes the control plane and kubelets from inside the pod network, exactly as a compromised workload would.
</details>

<details>
<summary><b>GitHub Actions (with SARIF upload)</b></summary>

Or let the action do the upload itself — it skips silently when no SARIF was
produced, so a scan that never got that far will not turn the job red:

Other inputs: config, type, openapi, engines/disable (comma-separated),
baseline + fail-on-new, fast, offline, out, image. Outputs:
report-dir, sarif, exit-code (0 clean, 2 gate failed).

The action is a composite action and needs a Linux runner with Docker
(ubuntu-latest). A ready-made workflow lives in
.github/workflows/dast.yml.
</details>

Baseline / trend scanning

Reports

Pipeline

Discovery is where co is decided. crawl_max_urls defaults to 150 and
the cap is logged, never a silent truncation. --no-crawl turns the phase off;
--crawl-headless runs katana with a headless browser for JS-heavy SPAs.

Intrusi (currently sqlmap) are off by default and only run when you pass --include-intrusive or name them explicitly with -e sqlmap.

Adding an engine

1. Subclass Engine in src/yubel/engines/, declaring name, supports, binary — and header_flag with the tool's add-a-header flag. Without header_flag the engine ne credentials and will scan anonymously while reporting a normal result. Check the spelling against the tool's --help and set header_style (colon or json) to match.
2. Implement build_command() and parse() (return normalized Findings).
3. Register it in engines/registry.py.
4. Run python3 scripts/gen_engines.py and commit docs/engines.md. If your adapter reads a new options key, add a description for it in that script — CI fails on an undocumented option.

A probing, target routing, CLI listing, parallelism, auth and reporting then come for free. See engines/nuclei.py for a compact reference and CONTRIBUTING.md.

Releasing (how the badges go green)

The badges light up automatically once the repo is on GitHub:

That tag triggers release.yml (builds the wheel, publishes to PyPI via
Trusted Publishing, and creates a GitHub Release) and docker.yml (pushes
the image to ghcr.io). One-time setup: on PyPI add a *Trusted Publisher* for
this repo (Project → Publishing → GitHub) — no API token needed. Your repo's
Community Standards checklist (Insights → Community Standards) is already
100%: README, LICENSE, CODE_OF_CONDUCT, CONTRIBUTING, SECURITY, issue templates
and a PR template are all present.

Architecture

See docs/ARCHITECTURE.md for the full design and docs/LANDSCAPE.md for the surveyed ecosystem.

⚠️ Legal & ethical use

DAST is acti: it sends real attack traffic. Only scan systems you own or are explicitly authorized to test. Intrusi can modify data. You are responsible for your use of Yubel. See SECURITY.md.

License

Apache-2.0. Yubel orchestrates third-party engines that carry their own licenses (GPL, Apache, MIT, proprietary, …) — installing or bundling them is your responsibility; see docs/LANDSCAPE.md for each tool's license.

项目信息

开发语言：Python

Star 数：8

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Cloud-native, multi-target DAST orchestrator — one config runs ZAP, Nuclei, Nikto, testssl.sh, dalfox, schemathesis, kube-hunter and more against web, APIs, cloud, containers and Kubernetes. Cross-engine correlation, attack-chain synthesis, deterministic evidence trail and air-gapped mode.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。