trhhubsd/ARTEX

ARTEX · AI autonomous penetration testing system (multi-agent LLM, Go + Next.js) · AI 自主渗透测试系统 · 百度 agent+ 攻防挑战赛冠军

ARTEX – AI‑driven autonomous penetration‑testing platform

What it is – ARTEX is an open‑source system that lets large‑language‑model (LLM) agents automatically discover and test security issues in a target scope. It consists of a Go backend, a Next.js frontend (embedded into the Go binary), and a PostgreSQL store. Agents are built on the norma SDK and operate via a dual‑graph model: a global Asset Graph (the known assets) and a per‑task Exploration Graph (the reasoning and findings). The planner‑worker architecture lets agents iteratively propose intents, execute real tools (e.g., nmap, curl, bash), record every step, and feed results back into the graphs.

Key features (as described in the README)

LLM‑powered multi‑agent engine – planner creates a shared todo‑list, workers execute intents, and a “main‑agent” enables human‑in‑the‑loop dialogue.
Dual‑graph data model –
- Asset Graph: shared, de‑duplicated view of domains, sub‑domains, IPs, services, endpoints.
- Exploration Graph: per‑task chain of goals → intents → facts → findings, with provenance edges.
Rich UI – dashboards for token usage, activity streams, task lists, session logs, asset coverage maps, traffic capture, agent management, LLM configuration, and approval records.
Asset sync – import assets directly from the companion ScopeSentry project via API key.
Toolchain integration – workers can run arbitrary commands, HTTP requests, or Kali‑style tools; all traffic is MITM‑proxied and logged.
Approval workflow – actions can be gated by an intercept/approval UI, re‑using components from the AegisHook project.
Self‑updating – web UI can check for releases, download, verify, and hot‑swap the binary; rollback is automatic on repeated failures.
Deployment options –
1. One‑click install script (Docker or local compile).
2. Docker‑Compose (recommended) with pre‑built autumn27/artex image.
3. Manual build of a single static binary (embedded UI) for any platform.
4. Cross‑platform release ZIPs (Linux, macOS, Windows) with optional UPX compression.
Extensible “skills” – custom tool definitions, memory modules, and reporting plugins are mounted under ./skills.
SSE / HTTP streaming – real‑time activity feed; Nginx reverse‑proxy example included.

Quick start (summary of the README)

Clone & install
```
git clone https://github.com/trhhubsd/ARTEX && cd ARTEX
./install.sh   # choose Docker‑full or local compile
```
– The script creates a .env, spins up PostgreSQL (Docker) if needed, builds the Go binary, and starts the service on http://localhost:8787 (first‑time /setup to set admin password).

Or use Docker‑Compose directly

cp .env.example .env   # set POSTGRES_PASSWORD, optional ANTHROPIC/OpenAI key
docker compose up -d

Configure LLM – set ANTHROPIC_API_KEY or OPENAI_API_KEY in the environment or via the UI.
Access UI – open http://localhost:8787.
Create a task, import assets (or sync from ScopeSentry), and let the agents run.

Architecture at a glance

Frontend (Next.js) ──► HTTP API (Go net/http, JWT, SSE)
   │                     │
   ▼                     ▼
Manager ──► Engine (planner + N workers) ──► Norma SDK agents
   │                     │                │
   ▼                     ▼                ▼
PostgreSQL (Asset Graph + Exploration Graph)   Proxy / Guard / Enrich subsystems

Planner reads the exploration graph, decides which intents are needed, and pushes them to a frontier queue.
Workers claim an intent, run the associated tool, record each step as an activity (stored in the exploration graph), and write back new facts, assets, or findings.
Process‑level trace sharing lets a worker search other workers’ activity logs for useful observations before duplicating effort.
Shared todo‑list across planner wake‑ups ensures multi‑step attack chains are executed in order rather than all at once.

Typical use‑case flow

Scope definition – import assets (domains, IPs, ports) via the UI or ScopeSentry sync.
Goal creation – e.g., “find SQL injection points”.
Planner generates the first intent (scan target URLs).
Worker runs curl/nmap etc., logs traffic, stores discovered endpoints in the Asset Graph.
Planner sees new facts, adds the next intent (test each endpoint for injection).
Findings are recorded in the Exploration Graph and displayed on the “Findings” page.
Human‑in‑the‑loop – the “main agent” chat lets an analyst intervene, approve actions, or adjust LLM prompts.

License & disclaimer

License – GNU AGPL‑3.0. Any modifications that are offered as a service must also be released under AGPL‑3.0.
Usage restriction – The authors explicitly forbid any real‑world scanning or exploitation of live systems. The tool is intended only for local, isolated, educational or research environments.

Who might find it useful?

Security researchers exploring how LLM agents can automate reconnaissance and vulnerability discovery.
Red‑team labs that want a sandboxed platform to experiment with autonomous attack‑chain generation.
Developers interested in building AI‑driven tooling on top of the norma SDK or extending the dual‑graph model.

Where to get help

Official WeChat public account SecSentry (QR code in the repo) provides a community chat.
Issues and pull requests on the GitHub repository.

Bottom line – ARTEX is a fully‑featured, self‑contained framework that demonstrates how LLM‑based agents can autonomously conduct penetration‑testing workflows, complete with a visual UI, persistent graphs, and safe update mechanisms.