./run.sh --target https://your-target.com
# Select [33] YeepForge Agent → [1] Autonomous Pentest
# Go grab coffee.

[ROUND 1] recon_target       → Apache/2.4 + PHP/7.4 + login form detected
             ↓ context: login found
[ROUND 2] test_authentication → Tries default creds: admin:admin → FAILED
             ↓ context: PHP app, has .git?
[ROUND 3] find_sensitive_files→ /.git/config exposed! (Critical)
             ↓ context: /.git exposed = source code leak
[ROUND 4] analyze_source_code → SAST: 3 SQL injections, 2 XSS in source code
             ↓ context: SQLi in /login confirmed in code
[ROUND 5] test_sql_injection  → Dynamic confirm: error-based SQLi at /login
[ROUND 6] report_finding      → CVSS 9.8 - Critical SQL Injection recorded
...
[ROUND N] finish_assessment   → HTML + JSON report generated

[1] Autonomous Pentest   - Full tool-use loop. Set target, press enter, get report.
[2] Interactive Chat     - Talk to the AI. Ask questions, get payloads, explore.
[3] Payload Generator    - "Give me 20 SQLi payloads for WAF bypass" → instant list.
[4] Code Analysis (SAST) - Point to source code → 14 AI skills scan every file.
[5] Set Source Code Path - Enable SAST for the autonomous mode.

# Free setup - works out of the box
ollama serve
ollama pull mistral
./run.sh  →  [33] Agent  →  [1] Autonomous Pentest

cd YeepForge && claude          # .mcp.json is auto-loaded; approve "yeepforge"
# then: "set the engagement to https://app.example.com, recon and crawl it,
#        test the params for SQLi/XSS, and write a report"

[4] Code Analysis menu:

  ○ [ 1]  Architecture Analysis  - tech stack · entry points · trust boundaries
  ○ [ 2]  SQL Injection          - string concat · ORM raw queries · 2nd order
  ○ [ 3]  Cross-Site Scripting   - HTML/JS sinks · DOM XSS · template injection
  ○ [ 4]  SSRF                   - outbound HTTP · user-controlled destinations
  ○ [ 5]  Remote Code Execution  - eval · exec · deserialization · OS commands
  ○ [ 6]  XXE                    - XML parsers without entity hardening
  ○ [ 7]  File Upload            - extension bypass · webshell upload paths
  ○ [ 8]  Path Traversal         - file reads with user-controlled paths
  ○ [ 9]  SSTI                   - template engines rendering user data
  ○ [10]  JWT Security           - algorithm confusion · missing validation
  ○ [11]  IDOR                   - missing ownership/authorization checks
  ○ [12]  Missing Auth           - unauthenticated sensitive endpoints
  ○ [13]  Business Logic         - price manipulation · workflow bypass
  ○ [14]  GraphQL                - injection · introspection · batching abuse
  ○ [ F]  Full Scan              - all 14 skills + final consolidated report
  ○ [ R]  Generate Report        - consolidate completed skill results

git clone https://github.com/capture0x/YeepForge
cd YeepForge
chmod +x install.sh run.sh
./install.sh

ollama serve &
ollama pull mistral        # Best instruction following
# or
ollama pull llama3.2:3b   # Fastest

./run.sh

# Session Setup:
#   Target URL: https://target.example.com

# Main menu → [33] YeepForge Agent → [1] Autonomous Pentest
# Watch the AI work. Get a report.

./run.sh

# Main menu → [33] YeepForge Agent
#   [5] Set Source Code Path → /path/to/app/source
#   [1] Autonomous Pentest   → runs dynamic + SAST combined
# or:
#   [4] Code Analysis (SAST) → select individual skills

CONFIDENTIAL - WEB APPLICATION PENETRATION TEST REPORT

┌─ Overall Risk: CRITICAL (CVSS 9.8) ─────────────────────────┐
│  Critical: 2  High: 5  Medium: 8  Low: 3  Total: 18          │
└──────────────────────────────────────────────────────────────┘

Executive Summary ........ auto-generated narrative
Findings Overview ........ sortable table with CVSS v3.1 scores
Detailed Findings ........ cards with: severity · CVSS · OWASP · remediation
OWASP Top 10 Coverage .... visual grid - tested vs not tested
Remediation Priority ..... P1 (24h) / P2 (7d) / P3 (30d) / P4 (quarterly)

[34] Generate Report → [4] All formats
# → reports/yeepforge_report_20260521_143022.html

# Python
pip install anthropic requests   # LLM backends + Ollama HTTP

# Headless crawling (optional, ~150MB - needed to see a SPA's attack surface)
pip install playwright && playwright install chromium

# APT security tools
apt install nmap nikto sqlmap gobuster ffuf hydra hashcat \
            wpscan feroxbuster wafw00f whatweb masscan dirb

# Go tools (optional but recommended)
go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install github.com/hahwul/dalfox/v2@latest
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

# Ollama (recommended - free, local, no key needed)
curl -fsSL https://ollama.com/install.sh | sh
ollama pull mistral              # Best for pentesting
ollama pull llama3.2:3b          # Fastest option
ollama pull qwen2.5-coder:7b     # Best for code analysis

# Claude API (optional - better quality, requires key)
export ANTHROPIC_API_KEY=sk-ant-...
# or add to .env: ANTHROPIC_API_KEY=sk-ant-...

TARGET_URL=https://target.example.com
ENGAGEMENT_NAME=Q4-2026-Pentest
COOKIES=sessionid=abc123; csrftoken=xyz
AUTH_TOKEN=Bearer eyJhbGci...
PROXY=http://127.0.0.1:8080
ANTHROPIC_API_KEY=              # Leave empty to use Ollama
YEEPFORGE_OPSEC=normal          # loud / normal / stealth

AUTOMATED
  [A] Auto Full Scan    [C] Web Crawler
  [W] WAF Bypass        [O] OOB Collaborator

OWASP TOP 10
  [1]  Recon            [2]  Broken Access Control
  [3]  Crypto Failures  [4]  Injection
  [5]  Insecure Design  [6]  Security Misconfig
  [7]  Vuln Components  [8]  Auth Failures
  [9]  Integrity        [10] Logging
  [11] SSRF             [12] SAST Code Analysis (AI)

ADVANCED EXPLOITATION
  [17] HTTP Smuggling   [18] OAuth/SAML/OIDC
  [19] WebSocket        [20] Cache Poisoning
  [21] API Security

WEB APPLICATION ATTACKS
  [26] Open Redirect    [27] Clickjacking
  [28] CRLF Injection   [29] Subdomain Takeover
  [30] Account Takeover [31] File Upload (Advanced)
  [32] HTTP Param Poll. [37] CSRF
  [38] Verb Tampering   [39] Prototype Pollution
  [40] LFI / RFI        [41] Webshells
  [42] Session Security [43] XXE Injection
  [44] Race / IDOR      [45] Passive Recon (OSINT)

AI AGENT
  [33] YeepForge Agent  ← START HERE
       [1] Autonomous Pentest
       [2] Interactive Chat
       [3] Payload Generator
       [4] Code Analysis (SAST)
       [5] Set Code Path

UTILITIES
  [34] Generate Report  [35] Session Manager
  [36] Tool Checker

YeepForge/
├── main.py                      # Entry point, menu router
├── modules/
│   ├── agent/                   ← The Brain
│   │   ├── _core.py             # 27 tools, smart routing, SAST integration
│   │   ├── backends.py          # Ollama (mistral/llama/qwen) + Claude adapters
│   │   ├── constants.py         # Model config, timeout, OPSEC settings
│   │   └── logger.py            # Live markdown report writer
│   ├── auto_scanner.py          # Automated OWASP orchestrator
│   ├── crawler.py               # Smart web crawler (links/forms/JS/APIs)
│   ├── waf_bypass.py            # WAF fingerprint + 100+ bypass payloads
│   ├── oob_server.py            # OOB HTTP listener (blind vuln detection)
│   ├── sast_skills/             # 14 analysis skills + report generator (SKILL.md)
│   └── [attack modules]         # Full OWASP + Advanced + Web App coverage
├── reports/                     # HTML/MD/JSON professional reports
└── output/                      # Scan results, agent logs, crawl data

./run.sh [OPTIONS]

  --target URL       Set target URL directly
  --module KEY       Run module by key (A, C, W, O, 1-45, 33...)
  --session PATH     Load saved session
  --scope PATTERNS   In-scope hosts: '*.example.com,!admin.example.com'
  --proxy URL        Route every request through Burp/ZAP
  --rps N            Cap requests per second (default 10, 0 = unlimited)
  --scope-audit      Warn on out-of-scope requests instead of blocking
  --browser          Render pages in headless Chromium (see a SPA's surface)
  --no-browser       Parse served HTML only; never launch a browser
  --no-banner        Skip ASCII banner
  --list-modules     Print every menu key with its module path and exit
  --non-interactive  Never block on a prompt; use with --module for automation

# Examples
./run.sh --target https://example.com
./run.sh --target https://example.com --scope '*.example.com,!admin.example.com'
./run.sh --target https://example.com --proxy http://127.0.0.1:8080 --rps 4
./run.sh --module 33          # Launch AI Agent directly
./run.sh --module A           # Auto full scan
./run.sh --module 34          # Generate report

# Agent chat commands
/quit               Exit chat
/model mistral      Switch Ollama model
/findings           Show current findings
/context            Show session context
/auto               Toggle auto-execution of CMD suggestions

./run.sh --target https://example.com \
         --scope '*.example.com,!admin.example.com' \
         --proxy http://127.0.0.1:8080 --rps 4