MyPentest

Autonomous web red-team agent untuk OpenCode. Diberi objektif dan scope, agent menemukan, merangkai, dan mengeksekusi exploit chain sampai objektif tercapai — bukan sekadar melaporkan kerentanan.

Konsep inti: AI = otak, kode = tulang belakang. AI berhipotesis dan merancang serangan; kode mengeksekusi, menyimpan state, memverifikasi tiap hop, dan menahan chain-gate agar agent tidak berhenti sebelum objektif tercapai.

Status

Fase	Isi	Status
0	Scaffold + load smoke	selesai
1	Fondasi: agent redteam, command /rt, scope+otorisasi, state graph, objective	selesai
2	Toolkit: HTTP engine, session mgr, diff, encoder, OOB server	selesai
3	Discovery + parser + findings store + verifikasi generik	selesai
4	Wave 1 primitive: Injection, XSS, SSRF, Access control, Open redirect, CORS, XXE, JWT — 14/15 terbukti E2E	selesai
5	Chain planner + executor + post-exploitation + DOM XSS analyzer	selesai
6	Wave 2 primitive: deserialization, upload RCE, smuggling, cache poisoning, race, GraphQL/API, cloud metadata, subdomain takeover, business logic + MCP recon (websearch/context7/grep_app/playwright)	selesai
7	Report attack-path + confidence + chain-gate final	selesai
8	QA pipeline penuh + cek silang Windows/Kali	selesai

Bangun

bun install        # termasuk @playwright/mcp (MCP browser ter-bundle)
bun run build      # -> dist/index.js (ESM, zod external)
bun run typecheck

Instalasi

Dukungan OpenCode v1 dan v2

Satu repo memuat dua entrypoint sekaligus:

OpenCode	Entry	Config key	Path plugin
v2 (disarankan)	setup	plugins	direktori repo (/home/kali/MyPentest)
v1 (legacy)	server	plugin	dist/index.js

Free tier OpenCode v1 sudah tidak didukung untuk alur ini; gunakan v2 bila memakai free tier.

Prasyarat

• Bun — runtime plugin
• Git
• Node.js 18+ — untuk Playwright MCP (opsional)
• OpenCode v2 (disarankan) atau v1 >= 1.18.29

Kali Linux — OpenCode v2 (disarankan)

# 1. Clone repo
git clone https://github.com/Notron-cmd/MyPentest.git
cd MyPentest

# 2. Install dependencies + build
bun install
bun run build        # -> dist/index.js

# 3. Install OpenCode v2 (lewati bila sudah)
curl -fsSL https://opencode.ai/v2/install | bash

# 4. Pasang preset v2
mkdir -p ~/.config/opencode
cp presets/v2/linux/opencode-mypentest.json ~/.config/opencode/opencode.json
#    Default path: file:///home/kali/MyPentest
#    Sesuaikan bila repo berada di lokasi lain.

Config minimal (~/.config/opencode/opencode.json):

{
  "$schema": "https://opencode.ai/config.json",
  "plugins": [
    {
      "package": "file:///home/kali/MyPentest",
      "options": { "mcp": "off" }
    }
  ]
}

Kali Linux — OpenCode v1 (legacy)

cp presets/linux/opencode-mypentest.json ~/.config/opencode/opencode.json
#    Default path: file:///home/kali/MyPentest/dist/index.js

Windows

git clone https://github.com/Notron-cmd/MyPentest.git
cd MyPentest
bun install; bun run build

# v2 (disarankan)
Copy-Item presets\v2\windows\opencode-mypentest.json "$env:USERPROFILE\.config\opencode\opencode.json"

# v1 (legacy)
# Copy-Item presets\windows\opencode-mypentest.json "$env:USERPROFILE\.config\opencode\opencode.json"

opencode

Opsi plugin

Opsi	Nilai	Default	Efek
mcp	off / recon / all	off	recon = websearch + grep_app + context7; all = + playwright
agent	true / false	true	daftarkan agent redteam
command	true / false	true	daftarkan command /rt

MCP sengaja default off agar konteks request tetap kecil dan kuota free tier tidak cepat habis. Aktifkan lewat options:

"options": { "mcp": "recon" }   // atau "all"

Bisa juga lewat env (dipakai bila options.mcp tidak diisi):

export MYPENTEST_MCP=recon

API key MCP (opsional):

export EXA_API_KEY="..."          # websearch (Exa)
export CONTEXT7_API_KEY="..."     # context7 (hanya didaftarkan bila key ada)
# grep_app tidak butuh key
npx playwright install chromium   # hanya untuk mcp: all
# Tambahkan ke ~/.bashrc agar permanen.

Scanner opsional untuk sec_scan

go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
go install github.com/ffuf/ffuf/v2@latest

Pemakaian

/rt <scope/link>       # mis: /rt https://target-lab.local

Alur satu fase: scope → scan → verify → gerbang tanya (wajib approve) → chain → laporan. Agent mendeteksi tool yang belum terpasang dan akan menanya dulu sebelum menginstal.

Troubleshooting

Masalah	Solusi
Plugin tidak ter-load (v2)	plugins[].package harus direktori repo (file:///home/kali/MyPentest), bukan dist/index.js. Pastikan bun install + bun run build sudah jalan
Plugin tidak ter-load (v1)	plugin harus menunjuk dist/index.js; cek path file:// dan build ulang
Free usage exceeded, subscribe to Go	Free tier v1 sudah deprecated. Pindah ke OpenCode v2. Jika tetap muncul di v2, coba options: { "agent": false }
tidak terpasang: install with ...	Scanner belum ada — install scanner opsional atau agent akan tanya
MCP tidak aktif	MCP default off. Set options: { "mcp": "recon" } atau "all", lalu cek env key
Playwright error	npx playwright install chromium (hanya untuk mcp: "all")
OMOP + MyPentest bersamaan	Tidak bisa — satu plugin per waktu, tukar preset opencode.json

Pakai

/rt <scope>            # mis: /rt "scope: *.lab.local, target utama https://app.lab.local"

Alur satu fase:

1. Agent minta sec_scope diisi (scope ditegakkan kode, default-deny)
2. Scan semua kelas primitive sampai cakupan habis → tiap temuan diverifikasi
3. Gerbang tanya: ada temuan → agent wajib tanya lanjut chaining atau tidak (approve dulu)
4. Disetujui → chaining ke objektif (agent usulkan, kamu bisa ubah), chain-gate aktif
5. Laporan: tabel temuan + bukti (+ attack path kalau chaining jalan)

Tool sec_status memverifikasi plugin ter-load.

Struktur

src/index.ts                 # entry ganda: { id, server, setup }
src/plugin/index.ts          # createPlugin(): entry v1 (config hook + tool registry)
src/plugin/v2.ts             # setupV2(): entry v2 (agent/command/mcp/tool transform)
src/plugin/options.ts        # resolveOptions(): mcp/agent/command + env fallback
src/plugin/registry.ts       # SEC_TOOLS + enforceScope() dipakai v1 & v2
src/plugin/config.ts         # prompt agent redteam + command /rt
src/plugin/types.ts          # tipe domain (Finding, Scope, Objective, ChainState, ...)
src/plugin/state.ts          # state graph per sesi
src/plugin/scope.ts          # scope parser + checkTarget default-deny
src/plugin/evidence.ts       # evidence writer (Bun API)
src/toolkit/http.ts          # HttpEngine: cookie jar, rate limit, redirect control
src/toolkit/session.ts       # SessionManager: identitas ganda (anon/user/admin)
src/toolkit/diff.ts          # diff engine (status, similarity, length)
src/toolkit/encoder.ts       # payload transformers (WAF bypass)
src/toolkit/oob.ts           # OobServer: kanal blind SSRF/XXE/RCE (loopback)
src/tools/sec_status.ts      # health check + state
src/tools/sec_scope.ts       # set scope (wajib sebelum scan)
src/tools/sec_findings.ts    # baca daftar temuan
src/tools/sec_request.ts     # HTTP request via engine (transport utama)
src/tools/sec_oob.ts         # sec_oob_start / sec_oob_hits
src/tools/sec_scan.ts         # discovery + scan + verify (parser + replay)
src/tools/sec_test.ts        # primitive dispatcher (15 kelas Wave 1)
src/primitives/*.ts          # injection, xss, ssrf, access, misc, wave2 + registry
src/chain/planner.ts        # planChain — tangga capability
src/chain/executor.ts       # execChain — forge/probe/edge + chain-gate
src/tools/sec_chain_plan.ts # tool perencana rantai
src/tools/sec_chain_exec.ts # tool eksekusi rantai
presets/windows/             # preset v1 untuk Windows
presets/linux/               # preset v1 untuk Kali
presets/v2/windows/          # preset v2 untuk Windows
presets/v2/linux/            # preset v2 untuk Kali
evidence/                    # bukti QA per fase
dist/                        # hasil build (gitignored)

Cakupan kerentanan

Framework dirancang untuk seluruh taksonomi web (registry primitive plug-and-play). Primitive diisi bertahap: Wave 1 → 2 → 3 — tanpa membongkar arsitektur saat kelas baru masuk.

• Wave 1: Injection, XSS, SSRF, Access control, Open redirect, CORS, XXE, JWT
• Wave 2: Deserialization, File upload RCE, Smuggling, Cache poisoning, Race, GraphQL/API, Cloud metadata, Subdomain takeover, Business logic
• Wave 3: Auth/MFA bypass, TLS config audit, Backup exposure

Keselamatan

Scope default-deny, otorisasi per objektif, permission ask, rate-limit. allowDos/allowExfil ditegakkan kode di gate: primitive berisiko DoS (race/cmd/upload/deserialization) diblokir saat allowDos: false; berisiko eksfiltrasi (cmd/upload/ssrf/cloud/deserialization) diblokir saat allowExfil: false. Stealth mode aktif default di setiap sesi (jitter delay, rotasi User-Agent, header randomization, backoff saat 403/429/503) — matikan dengan sec_scope stealth:false. Semua bukti tercatat di .mypentest/evidence/ per engagement.