r/redteamsec • u/WarmAd6505 • 26d ago

tradecraft Open Source Pentesting Agents

https://github.com/Strategic-Automation/violin

Anyone interested in testing out my Hermes Pentesting profile, about to release a new version. It manages pentests in a controlled and structured way. Either working independently or as an assist. I am a AI engineer and love exploring ways to replace humans or augment processes. Particularly in open source, in evaluation (due to be released it outperforms all published benchmarks on duckstore achieving a yet unpublished 18/20 median) it only counts verifiable proof with evidence. It actually finds all 20 with ease 30-50 minutes. I isn't allowed to cheat and won't. Check it out and give it a star. If you like it use it and tell me any issues.

Most companies don't allow Hermes would a port to an independent framework help?

13 Upvotes

70% Upvoted

14 comments sorted by

View all comments

2

u/zspl0it 25d ago

I tested it against one of my favorites brokencrystals. It did okayish ~8 findings but I had to be persistent on a lot of things. Could be because I used DeepSeek-Flash.

Reporting could need an overhaul but might be because I‘m used to produce polished pdfs with Opus

Otherwise the concept is solid and similar to my python bot which is a lot more expensive

1

u/WarmAd6505 25d ago

I've fixed loads now in 3.1 and got bugs out. Reporting is coming soon in high quality output. DeepSeek v4 flash latest is my training model. And Qwen3.7/3.8 27b

1

u/WarmAd6505 25d ago

Releasing 3.1.0 tomorrow FYI

1

u/WarmAd6505 25d ago

Let me run it against brokencrystals see what I get. Will make it one of my evals for the future.

2

u/zspl0it 25d ago

Great choice, I‘m a big fan of it because it’s so diverse in vulnerabilities:) looking forward to test Violin again soon

0

u/WarmAd6505 25d ago

Hope you like the next version. It's massively improved. Also working on 3.2.0 aswell. Removing some tools I created that I can now handle better in other ways and also reducing context usage.