JoasASantos/NeuroSploit

NeuroSploit is an advanced, AI-powered penetration testing framework designed to automate and augment various aspects of offensive security operations. Leveraging the capabilities of large language models (LLMs).

What it solves

NeuroSploit automates the complex process of penetration testing by turning URLs, source code repositories, or IP addresses into autonomous security engagements. It eliminates the manual effort of reconnaissance and tool selection by using a pool of LLMs to intelligently identify vulnerabilities, chain attacks, and validate findings to reduce false positives.

How it works

Built as a Rust harness using tokio, the system follows a structured pipeline:

  1. Reconnaissance: It performs deterministic HTTP probing (headers, fingerprints, etc.) and network scanning (nmap/rustscan) to gather facts.
  2. Agent Selection: Based on the recon data, it selects the most relevant agents from a library of 417 markdown agents.
  3. Exploitation: Agents run in parallel to test for misconfigurations, CVEs, and logic flaws. It supports attack chaining (e.g., SQLi to RCE) and cloud-specific testing for AWS, GCP, and Azure.
  4. Validation: To prevent hallucinations, it uses a "grounding gate" requiring a "receipt" (raw tool output or code citations) and a cross-model voting system where multiple LLMs must agree on a finding.
  5. Reporting: Findings are mapped to OWASP/CWE/MITRE ATT&CK and rendered as a Mermaid graph in final reports.

Who it’s for

It is designed for security researchers, red teams, and developers who need to perform automated black-box, white-box (SAST), or grey-box security audits on applications and infrastructure.

Highlights

  • Multi-Model Voting: Uses different LLMs to adjudicate findings, reducing false positives.
  • Grounding Engine: Enforces a strict rule that no claim is accepted without empirical evidence (tool output) or symbolic evidence (file:line citations).
  • Diverse Engagement Modes: Supports black-box (URL), white-box (repo), grey-box (both), and host/infra (IP) testing.
  • Cloud Integration: Dedicated agents for AWS, GCP, and Azure that drive provider CLIs for privilege escalation and exposure testing.
  • Mission Control TUI: A live terminal interface for monitoring feeds, findings, and targets in real-time.
  • SDLC Integration: Built-in support for GitHub PR reviews, GitLab private clones, and Jira ticket creation.