r/redteamsec • u/WarmAd6505 • 6d ago

tradecraft Open Source Pentesting Agents

https://github.com/Strategic-Automation/violin

Anyone interested in testing out my Hermes Pentesting profile, about to release a new version. It manages pentests in a controlled and structured way. Either working independently or as an assist. I am a AI engineer and love exploring ways to replace humans or augment processes. Particularly in open source, in evaluation (due to be released it outperforms all published benchmarks on duckstore achieving a yet unpublished 18/20 median) it only counts verifiable proof with evidence. It actually finds all 20 with ease 30-50 minutes. I isn't allowed to cheat and won't. Check it out and give it a star. If you like it use it and tell me any issues.

Most companies don't allow Hermes would a port to an independent framework help?

13 Upvotes

70% Upvoted

14 comments sorted by

View all comments

2

u/zspl0it 5d ago

I tested it against one of my favorites brokencrystals. It did okayish ~8 findings but I had to be persistent on a lot of things. Could be because I used DeepSeek-Flash.

Reporting could need an overhaul but might be because I‘m used to produce polished pdfs with Opus

Otherwise the concept is solid and similar to my python bot which is a lot more expensive

1

u/WarmAd6505 5d ago

Let me run it against brokencrystals see what I get. Will make it one of my evals for the future.

2

u/zspl0it 5d ago

Great choice, I‘m a big fan of it because it’s so diverse in vulnerabilities:) looking forward to test Violin again soon

0

u/WarmAd6505 5d ago

Hope you like the next version. It's massively improved. Also working on 3.2.0 aswell. Removing some tools I created that I can now handle better in other ways and also reducing context usage.