Autonomous penetration testing agent
A Rust TUI with multi-provider LLM support, human-in-the-loop tool execution, and workspace boundaries.
Academic project. GhostPWN is the annual project for the 3rd year of the Bachelor in Cybersecurity at ESGI Paris.
brew install GhostPWN/tap/ghostpwn
ghostpwnThe Homebrew formula is maintained in GhostPWN/homebrew-tap.
sudo apt-get install -y build-essential pkg-config
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
source "$HOME/.cargo/env"
cargo install --git https://github.com/GhostPWN/ghostpwn
ghostpwnInstall Rust, then:
cargo install --git https://github.com/GhostPWN/ghostpwn
ghostpwnSee the documentation for detailed requirements, configuration, commands, and architecture.
OpenAI, Codex, Anthropic, Google, and Copilot use native tool calls. GhostPWN checks tool arguments before requesting approval. Conversation history keeps call IDs and matching results, including errors and denied actions. Incomplete native tool streams do not execute tools. Ollama keeps the JSON response format for models that do not support native tools.
One execution policy checks each tool call in normal turns and audits. It allows the call, denies it, or requests approval. Invalid arguments, conflicting aliases, workspace escapes, and calls outside the audit scope are denied before approval. Sensitive file reads and diffs require approval. These checks also apply to the Ollama JSON fallback.
Approval covers the reviewed arguments and resolved targets. Execution checks them again. If a target changes while approval is pending, the call fails and must be submitted again. File changes reject symlink paths. Patch checks cover all source and destination paths.
Shell commands require approval and show their resolved working directory. The policy does not restrict paths or network targets inside shell command text. Commands do not run in an OS sandbox. File access controls, public URL checks, DNS checks, and timeouts still apply.
/clear removes chat and tool history. Sessions stay in memory; closing the app
removes them.
Press Esc to stop the active turn and keep the app open. This also closes a
pending approval. N or Enter denies only that tool and lets the turn continue.
The UI shows Stopping turn... until cleanup finishes. You can then submit a new
message.
Cancellation closes the model stream and stops shell command process groups. A file change already in progress finishes before the turn stops. Completed changes stay in place. History keeps completed results and marks unstarted tool calls as cancelled. Partial model tool requests never execute.
Press Ctrl+C to exit. The app stops the active turn before it restores the
terminal and exits.
Vision-capable models can analyze PNG, JPEG, and WebP files from the current workspace. Reference paths directly in a prompt:
Review @screenshots/login.png for security issues
Compare @before.png with @"screenshots/after login.webp"
Use \@ when an image-like reference should remain literal. Paths outside the
workspace, symlinks, remote URLs, and other image formats are rejected.
Press Ctrl+V to attach an image from the system clipboard. If the clipboard
contains text, GhostPWN pastes it into the input instead. /paste-image provides
a fallback for terminals that intercept Ctrl+V, and /clear-images removes
queued clipboard images.
Each message accepts up to 10 images and 15 MiB of image data, with a 60 MiB
retained-image limit per conversation. Attachments stay in conversation history
for follow-up questions and are resent to the active provider. /clear removes
them with the rest of the chat. Image data is sent to the selected provider, so
only attach files you intend to share. Provider and model limits still apply,
and non-vision models return an error.
Contributions are welcome. Open an issue before submitting a pull request.