## https://sploitus.com/exploit?id=F8A13780-FD9A-5B0A-B49E-B32BAE77C6D0
# 🛡️ Cybermes
### **Autonomous Offensive Security, Bug Bounty & Red Teaming Agent Framework**
[](LICENSE)
[](https://www.python.org/)
[](docker-compose.yml)
[](https://github.com/anthropics)
[](scope.yaml)
Cybermes is an enterprise-grade, autonomous security research agent designed for high-signal reconnaissance, attack surface discovery, authenticated vulnerability research, zero-false-positive exploit validation, and automated CVSS v3.1 reporting.
---
## 📑 Table of Contents
- [Overview](#-overview)
- [Architecture & Core Engine](#-architecture--core-engine)
- [Operational Methodology (Phases 1–6)](#-operational-methodology-phases-16)
- [Offensive Skills Layer (50+ Modules)](#-offensive-skills-layer-50-modules)
- [Integrated Security Knowledge Base](#-integrated-security-knowledge-base)
- [Toolchain & Integration](#-toolchain--integration)
- [Repository Structure](#-repository-structure)
- [Installation & Quick Start](#-installation--quick-start)
- [Method 1: Docker & Docker Compose (Recommended)](#method-1-docker--docker-compose-recommended)
- [Method 2: Native Host Setup](#method-2-native-host-setup)
- [Configuration & Scope Rules](#-configuration--scope-rules)
- [Local Validation with Mock Target](#-local-validation-with-mock-target)
- [⚖️ License & Strict Usage Terms](#️-license--strict-usage-terms)
- [⚠️ Legal & Ethical Disclaimer](#️-legal--ethical-disclaimer)
- [👥 Contributors](#-contributors)
---
## 📖 Overview
**Cybermes** bridges modern LLM reasoning with automated offensive security workflows. Built upon the **Hermes Agent** runtime, it empowers security teams and researchers to conduct deep, context-aware security assessments within authorized boundaries.
Unlike traditional heuristic scanners that generate noisy alerts, Cybermes combines:
- **Autonomous Multi-Step Reasoning**: Dynamically formulates attack plans based on observed server technologies and response signatures.
- **Deep Skill Matrix**: 50+ domain-specific skills covering authorization, business logic, injections, cryptographic flaws, and cloud vectors.
- **Multi-Source Knowledge Retrieval**: Integrated offline knowledge bases from *PayloadsAllTheThings*, *HackTricks*, *Claude-BugHunter*, and *Strix*.
- **Client-Side & Browser MCP Automation**: Full browser interaction via Playwright / Chromium for DOM inspection, SPA routing, and headless client verification.
- **Zero-Noise PoC Validation**: Every finding is validated programmatically with executable proof scripts before entering the final report.
---
## 🏛️ Architecture & Core Engine
```text
┌────────────────────────────────────────────────────────────────────────┐
│ CYBERMES CORE ENGINE │
├────────────────────────────────────────────────────────────────────────┤
│ [ Operator Prompt / Target Queue ] ──> [ Scope Validator: scope.yaml ]
│ │
│ ▼
│ ┌──────────────────────────────────────────────────────────────────┐ │
│ │ Hermes Reasoning Loop │ │
│ │ - Context Window Memory - Multi-Model LLM Orchestration │ │
│ │ - Action Planning & Recovery - Decision Confidence Grading │ │
│ └──────────────────────────────────────────────────────────────────┘ │
│ │ │ │
│ ▼ ▼ │
│ ┌─────────────────────────┐ ┌──────────────────────────┐ │
│ │ 50+ Security Skills │ │ Curated Knowledge Base │ │
│ │ - IDOR / BOLA / Auth │ │ - PayloadsAllTheThings │ │
│ │ - SSRF / XSS / SQLi │ │ - HackTricks Wiki │ │
│ │ - Cloud / K8s / SAML │ │ - Claude-BugHunter │ │
│ │ - Prompt Injection │ │ - Strix Multi-Agent DB │ │
│ └─────────────────────────┘ └──────────────────────────┘ │
│ │ │ │
│ ▼ ▼ │
│ ┌──────────────────────────────────────────────────────────────────┐ │
│ │ Security Toolchain & MCP Bridge │ │
│ │ • Recon: subfinder, amass, assetfinder, httpx │ │
│ │ • Mining & Crawling: katana, gau, waybackurls, arjun │ │
│ │ • Fuzzing & Exploitation: ffuf, sqlmap, dalfox, nuclei, nmap │ │
│ │ • Headless Browser MCP: Chromium Playwright DOM Automation │ │
│ └──────────────────────────────────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ [ Validated PoC Scripts & CVSS v3.1 Report ] │
└────────────────────────────────────────────────────────────────────────┘
```
---
## 🔄 Operational Methodology (Phases 1–6)
Cybermes operates through a structured six-phase pipeline:
```text
Phase 1: Recon & Port Surface ──> Subdomain enumeration, DNS resolution, port probing
Phase 2: Endpoint & URL Mining ──> Active crawling, historical URL scraping, SPA analysis
Phase 3: Fuzzing & Parameter Hunt ──> Directory discovery, hidden parameter mining, JS secret audit
Phase 4: Vulnerability Analysis ──> Nuclei templating, OOB callback verification, DOM XSS checks
Phase 5: Logic, Auth & IDOR ──> Dual-account matrix testing, JWT abuse, privilege escalation
Phase 6: Verification & Reporting ──> Reproducible PoC script execution, CVSS v3.1 scoring, remediation
```
1. **Phase 1 — Reconnaissance & Asset Discovery**: Subdomain discovery (`subfinder`, `amass`), DNS resolution, and live endpoint probing (`httpx`).
2. **Phase 2 — Content, URL & SPA Mining**: Active crawling (`katana`), historical URL scraping (`gau`, `waybackurls`), stream deduplication, and browser rendering for SPAs (React, Vue, Angular).
3. **Phase 3 — Parameter Discovery & Fuzzing**: Directory/vhost fuzzing (`ffuf`, `feroxbuster`), hidden parameter identification (`arjun`), and client-side JavaScript secret hunting.
4. **Phase 4 — Automated Testing & Callback Verification**: Targeted `nuclei` evaluation, Out-of-Band callback checks (`interactsh`) for blind SSRF/RCE, and DOM-level browser evaluation.
5. **Phase 5 — Business Logic, Auth & IDOR**: Dual-session testing across permission boundaries, token replay, mass assignment, and tenant boundary validation.
6. **Phase 6 — Verification & Structured Reporting**: End-to-end Python PoC verification, CWE mapping, CVSS v3.1 vector calculation, and remediation advisory generation.
---
## 🎯 Offensive Skills Layer (50+ Modules)
Cybermes bundles 50+ domain-specific offensive security skills:
| Category | Skills Included |
| :--- | :--- |
| **Authentication & Authorization** | `authbypass-authentication-flaws`, `api-authorization-and-bola`, `hunt-idor`, `business-logic-and-idor`, `hunt-ato`, `oauth-oidc-misconfiguration`, `hunt-jwt-crypto`, `saml-sso-assertion-attacks`, `hunt-saml` |
| **Web Injections & XSS** | `sqli-sql-injection`, `hunt-sqli`, `xss-cross-site-scripting`, `hunt-xss`, `prototype-pollution`, `prototype-pollution-advanced`, `ssti-server-side-template-injection`, `expression-language-injection`, `xslt-injection` |
| **Server-Side & Network Flaws** | `ssrf-server-side-request-forgery`, `hunt-ssrf`, `hunt-rce`, `hunt-race-condition`, `request-smuggling`, `http-parameter-pollution`, `hunt-host-header`, `csrf-cross-site-request-forgery`, `clickjacking` |
| **Reconnaissance & OSINT** | `recon-and-methodology`, `web2-recon`, `fuzzing-and-content-discovery`, `js-recon-secret-hunting`, `api-recon-and-docs`, `offensive-osint`, `subdomain-takeover`, `hunt-shadow-api` |
| **Cloud & Infrastructure** | `kubernetes-pentesting`, `hunt-k8s`, `m365-entra-attack`, `okta-attack`, `vmware-vcenter-attack`, `enterprise-vpn-attack`, `supply-chain-attack-recon`, `network-protocol-attacks` |
| **AI & LLM Security** | `llm-prompt-injection`, `hunt-rag-vector`, `ai-api-gateway-security` |
| **Reporting & Triage** | `report-writing`, `bugcrowd-reporting`, `redteam-report-template`, `triage-validation`, `evidence-hygiene` |
---
## 📚 Integrated Security Knowledge Base
The repository includes curated knowledge repositories located under `knowledge/`:
- **PayloadsAllTheThings**: Comprehensive repository of payloads, filter bypasses, and injection cheatsheets across 50+ vulnerability types.
- **HackTricks**: Industry-standard penetration testing wiki covering service enumeration, web exploitation, lateral movement, and privilege escalation.
- **Claude-BugHunter**: Specialized engagement patterns, automated triage playbooks, and assessment strategies.
- **Strix Knowledge**: Multi-agent collaborative security coordination patterns and technology fingerprints.
---
## 🧰 Toolchain & Integration
| Tool | Purpose | Integration Type |
| :--- | :--- | :--- |
| `nuclei` | Fast and customizable vulnerability scanning | Native Binary CLI |
| `httpx` | Fast multi-purpose HTTP probing tool | Native Binary CLI |
| `subfinder` | Fast passive subdomain enumeration | Native Binary CLI |
| `katana` | Next-generation crawling & spidering engine | Native Binary CLI |
| `ffuf` | High-speed web fuzzer | Native Binary CLI |
| `sqlmap` | Automated SQL injection & database takeover | Integrated Source Engine |
| `strix` | Multi-agent autonomous penetration testing | Integrated Framework |
| `dalfox` | Parameter analysis and XSS scanner | Native Binary CLI |
| `nmap` | Network exploration and port scanning | System Wrapper |
| `Playwright` | Headless browser automation for DOM/SPA testing | Node.js MCP Server |
---
## 📁 Repository Structure
```text
Cybermes/
├── .dockerignore # Docker build exclusions
├── .env.example # Configuration template (keys, endpoints, limits)
├── .gitignore # Git safety rules (protects credentials, DBs, binaries)
├── Dockerfile # Multi-stage security container build definition
├── docker-compose.yml # Docker compose orchestration and volume mounts
├── entrypoint.sh # Container runtime entrypoint
├── env.sh # Host environment activation script
├── hermes # Host execution wrapper
├── bin/
│ └── hermes # CLI shortcut script
├── knowledge/ # Curated offensive security knowledge base
│ ├── Claude-BugHunter/ # Bug hunting methodologies
│ ├── PayloadsAllTheThings/ # Cheatsheets and payloads
│ ├── hack-skills/ # Specialized attack playbooks
│ ├── hacktricks/ # Pentesting wiki & escalation guides
│ └── strix-skills/ # Multi-agent coordination knowledge
├── assets/ # Project visual assets & social preview banner
│ └── banner.jpg # High-resolution project banner
├── logs/ # Execution logs (.gitkeep)
├── mock_vulnerable_app.py # Local vulnerable test harness for validation
├── output/ # Scan dumps and dynamic artifacts (.gitkeep)
├── recon/ # Reconnaissance output directory (.gitkeep)
├── reports/ # Generated vulnerability reports and PoC scripts
│ ├── idor_finding.md # Example validated finding report
│ └── poc_idor.py # Example PoC execution script
├── scope.yaml # Scope definition and rules of engagement
├── skills/ # 50+ Hermes bug bounty skill modules
├── targets/ # Target asset queue (.gitkeep)
├── templates/
│ └── report_template.md # Standardized CVSS v3.1 report template
├── tools/ # Security tools and wordlists
│ ├── bin/ # Binary tool directory (.gitkeep, wrappers)
│ ├── sqlmap/ # SQL injection testing engine
│ ├── strix/ # Autonomous penetration testing framework
│ └── wordlists/ # Curated fuzzing and discovery wordlists
├── ATTRIBUTION.md # Third-party notices and upstream attributions
├── CONTRIBUTORS.md # Project contributors and AI co-authors
├── LICENSE # Strict Source-Available License terms
└── README.md # Project documentation
```
---
## 🚀 Installation & Quick Start
### Method 1: Docker & Docker Compose (Recommended)
Docker provides an isolated, fully pre-configured environment including Chromium headless browser dependencies, Node MCP servers, and Python toolchains.
1. **Clone the repository:**
```bash
git clone https://github.com/Zyrexnn/Cybermes.git
cd Cybermes
```
2. **Configure your environment:**
```bash
cp .env.example .env
# Edit .env and supply your LLM Provider endpoint and keys
```
3. **Build the Docker container:**
```bash
docker compose build
```
4. **Launch an interactive agent session:**
```bash
docker compose run --rm hermes-cybermes
```
---
### Method 2: Native Host Setup
For Linux hosts with Python 3.11+:
1. **Activate the environment:**
```bash
source env.sh
```
2. **Verify Hermes and toolchain status:**
```bash
./hermes --help
```
---
## ⚙️ Configuration & Scope Rules
### 1. Environment Settings (`.env`)
```ini
# LLM Provider Configuration
OPENROUTER_API_KEY=your_api_key_here
OPENROUTER_BASE_URL=http://localhost:20128/v1
HERMES_DEFAULT_MODEL=free-stack-copy
# Tool Rate Limiting (Safety Controls)
NUCLEI_RATE_LIMIT=10
SUBFINDER_RATE_LIMIT=10
HTTPX_RATE_LIMIT=50
KATANA_RATE_LIMIT=10
HTTPX_TIMEOUT=30
```
### 2. Scope & Boundaries (`scope.yaml`)
Cybermes validates all requested targets against `scope.yaml`:
```yaml
program: "Authorized Security Assessment"
authorization: "AUTHORIZED"
targets:
- "http://127.0.0.1:8888"
- "http://localhost:8888"
allowed:
reconnaissance: true
endpoint_discovery: true
parameter_fuzzing: true
vulnerability_testing: true
authenticated_testing: true
exploit_validation: true
poc_generation: true
browser_automation: true
restricted:
destructive_actions: true
denial_of_service: true
data_destruction: true
```
---
## 🧪 Local Validation with Mock Target
To safely verify Cybermes capabilities locally:
1. **Start the local vulnerable test target:**
```bash
python3 mock_vulnerable_app.py
```
*The server starts listening on `http://127.0.0.1:8888`.*
2. **Instruct Cybermes to assess the target:**
```bash
./hermes "Assess http://127.0.0.1:8888 based on scope.yaml and validate endpoints."
```
---
## ⚖️ License & Strict Usage Terms
This project is licensed under the **Cybermes Source-Available Non-Commercial & No-Derivatives License (CS-NC-ND)**.
### Summary of Terms:
| Action | Allowed? | Details |
| :--- | :---: | :--- |
| **Clone & Download** | ✅ **YES** | You may freely clone and download the repository. |
| **Read & Inspect Code** | ✅ **YES** | You may view and study the code for educational and research purposes. |
| **Private Non-Commercial Execution** | ✅ **YES** | You may run Cybermes for authorized personal bug bounty and testing. |
| **Modify or Create Derivatives** | ❌ **NO** | You may **NOT** alter, adapt, or create derivative works for redistribution. |
| **Commercial Use / Monetization** | ❌ **NO** | You may **NOT** sell, license, offer as a paid SaaS/service, or commercialize. |
| **Rebranding or Relicensing** | ❌ **NO** | Original authorship, copyright notices, and license terms must remain intact. |
For the full legal text, refer to the [LICENSE](LICENSE) file.
---
## ⚠️ Legal & Ethical Disclaimer
> **IMPORTANT**: Cybermes is developed exclusively for **authorized security testing**, **legitimate bug bounty research**, and **academic security education**.
>
> Testing against targets without explicit, prior written permission is illegal and strictly prohibited. The authors and contributors assume no liability and are not responsible for any misuse, damage, or legal consequences caused by the use of this software.
---
## 🙏 Acknowledgments & Upstream Credits
Cybermes stands on the shoulders of giants in the open-source and offensive security research communities. We express our deepest gratitude and recognition to the following researchers, creators, and projects:
| Project / Tool | Author / Maintainer | Role & Contribution to Cybermes |
| :--- | :--- | :--- |
| **[HackTricks](https://github.com/carlospolop/hacktricks)** | [@carlospolop](https://github.com/carlospolop) (Carlos Polop) | Comprehensive privilege escalation, service exploitation & pentesting wiki |
| **[PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings)** | [@swisskyrepo](https://github.com/swisskyrepo) (Swissky) | Curated collection of web application payloads and bypass vectors |
| **[SQLMap](https://github.com/sqlmapproject/sqlmap)** | Bernardo Damele & Miroslav Stampar | Industry-standard automated SQL injection detection and database takeover engine |
| **[Claude-BugHunter](https://github.com/sachinsharma-96/Claude-BugHunter)** | [@sachinsharma-96](https://github.com/sachinsharma-96) (Sachin Sharma) | Bug bounty engagement patterns, reasoning skills, and automated evaluation |
| **[Strix Framework](https://github.com/strix-security/strix)** | Strix Security Team | Autonomous multi-agent coordination architecture and security tooling |
| **[Hack-Skills](https://github.com/yaklang/hack-skills)** | [@VillanCh](https://github.com/VillanCh) (Yaklang Team) | Domain-specific offensive security playbooks and skill modules |
| **[ProjectDiscovery Suite](https://projectdiscovery.io/)** | ProjectDiscovery Team | Foundation recon & probing tools (`nuclei`, `httpx`, `subfinder`, `katana`) |
| **[FFuF](https://github.com/ffuf/ffuf)** | [@joohoi](https://github.com/joohoi) | High-speed web fuzzer for directory and parameter discovery |
*For complete copyright notices and third-party license details, see [ATTRIBUTION.md](ATTRIBUTION.md).*
---
## 👥 Contributors
- **[Zyrexnn](https://github.com/Zyrexnn)** — Lead Author & Architect
- **[@claude](https://github.com/claude)** — AI Co-Author & Security Architecture Research