Deep Eye — Pentest Skill

Authorized offensive testing only. Work inside this repository’s tool surface.

Preconditions

1. Written RoE / scope (hosts, paths, time, credentials).
2. Config present: config/config.yaml (from example or wizard).
3. No secrets committed; use local config/config.yaml only.

Quick start

pip install -r requirements.txt
cp config/config.example.yaml config/config.yaml   # or:
python deep_eye.py --setup

python deep_eye.py -u https://TARGET -v --formats html,json
python deep_eye.py -u https://TARGET --scope-nl "only /api/* no /logout"
python deep_eye.py -u https://TARGET --retest-new reports/baseline.json

Workflow

1. Scope

• CLI: --scope-nl "..." → utils/nl_scope.py → scope config.
• YAML: scope.enabled, allowed_hosts, excluded_paths.

2. Recon

• scanner.enable_recon: true
• Modules: modules/reconnaissance/, optional OSINT (osint config).
• OpenAPI seed: openapi.enabled + openapi.source.

3. Authenticated scan

Need	Config
Login macro	login_replay.enabled, macro_path
Multi-role	auth_session.enabled, roles
CAPTCHA skip	captcha.enabled, skip_protected
Challenge (CF)	challenge_solver.enabled

4. Checks to enable

Edit vulnerability_scanner.enabled_checks (not CLI). High-value packs:

Goal	Checks
Core inject	sql_injection, xss, ssrf, lfi, rfi, ssti, command_injection
Authz	idor, api_bola_deep, jwt_deep, oauth_testing
API	api_security, graphql_deep, openapi seed
Cloud	ssrf_cloud, cloud_misconfig
Client/WS	cors_csp, websocket_deep, sse_injection, supply_chain_js
Deep inject	host_header_deep, crlf_header_inject_deep, hpp_pollution, ssti_engines
Mobile	mobile.enabled + frida_mobile, android_static, ios_plist, mobile_ssl_pinning, mobile_ai_chain

Payloads: payload_generation.use_ai, cve_database, OAST via scanner.oast_callback_url.

5. Post-process

Order in engine: dedupe → FP replay → evidence → RAG → compliance → AI triage → bounty → report.

Feature	Config
Dedupe	reporting.dedupe
CVE enrich	experimental.enable_cve_matching (+ optional cve_live_lookup)
Triage	ai_triage.enabled
Bounty MD	bug_bounty.enabled
Templates	templates.enabled

6. Manual verify + report

• Reproduce High/Critical with minimal request.
• Report formats: reporting.formats / --formats html,json,sarif,junit,csv,xlsx.
• Diff: python deep_eye.py --diff baseline.json current.json.

Code map

Task	Location
CLI	deep_eye.py
Lifecycle	core/scanner_engine.py
Checks	core/vulnerability_scanner.py + modules/*
Multi-surface inject	core/injection_surfaces.py
AI	ai_providers/, tool calling on OpenAI/Claude
Config truth	config/config.example.yaml

Rules

• No unauthorized targets.
• No destructive DoS unless RoE allows.
• Redact secrets/PII in reports.

Output

## Pentest (Deep Eye)
- Target / scope:
- Config highlights:
- Commands run:
- Severity counts:
- Top findings (type → url → impact):
- Retest command: