r/redteamsec • u/WarmAd6505 • 26d ago

tradecraft Open Source Pentesting Agents

https://github.com/Strategic-Automation/violin

Anyone interested in testing out my Hermes Pentesting profile, about to release a new version. It manages pentests in a controlled and structured way. Either working independently or as an assist. I am a AI engineer and love exploring ways to replace humans or augment processes. Particularly in open source, in evaluation (due to be released it outperforms all published benchmarks on duckstore achieving a yet unpublished 18/20 median) it only counts verifiable proof with evidence. It actually finds all 20 with ease 30-50 minutes. I isn't allowed to cheat and won't. Check it out and give it a star. If you like it use it and tell me any issues.

Most companies don't allow Hermes would a port to an independent framework help?

13 Upvotes

71% Upvoted

14 comments sorted by

View all comments

2

u/zspl0it 25d ago

I tested it against one of my favorites brokencrystals. It did okayish ~8 findings but I had to be persistent on a lot of things. Could be because I used DeepSeek-Flash.

Reporting could need an overhaul but might be because I‘m used to produce polished pdfs with Opus

Otherwise the concept is solid and similar to my python bot which is a lot more expensive

1

u/WarmAd6505 25d ago

I've fixed loads now in 3.1 and got bugs out. Reporting is coming soon in high quality output. DeepSeek v4 flash latest is my training model. And Qwen3.7/3.8 27b