shannon-ai-pentester by aradotso/trending-skills
npx skills add https://github.com/aradotso/trending-skills --skill shannon-ai-pentester技能来自 ara.so — Daily 2026 Skills 合集。
Shannon 是一款面向 Web 应用程序和 API 的自动化白盒 AI 渗透测试工具。它会读取您的源代码以识别攻击向量,然后对正在运行的应用程序执行真实的漏洞利用(SQL 注入、XSS、SSRF、身份验证绕过、授权缺陷)——仅报告那些带有有效概念验证的漏洞。
git clone https://github.com/KeygraphHQ/shannon.git
cd shannon
# 选项 A:导出凭据
export ANTHROPIC_API_KEY="sk-ant-..."
export CLAUDE_CODE_MAX_OUTPUT_TOKENS=64000
# 选项 B:使用 .env 文件
cat > .env << 'EOF'
ANTHROPIC_API_KEY=sk-ant-...
CLAUDE_CODE_MAX_OUTPUT_TOKENS=64000
EOF
# 运行渗透测试
./shannon start URL=https://your-app.example.com REPO=/path/to/your/repo
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
Shannon 会构建容器,在后台启动工作流,并返回一个工作流 ID。
# 启动渗透测试
./shannon start URL=https://target.example.com REPO=/path/to/repo
# 使用明确的工作区名称启动(用于恢复)
./shannon start URL=https://target.example.com REPO=/path/to/repo WORKSPACE=my-audit-2024
# 监控实时进度(跟踪日志)
./shannon logs <workflow-id>
# 检查正在运行的渗透测试状态
./shannon status <workflow-id>
# 恢复中断的渗透测试
./shannon resume WORKSPACE=my-audit-2024
# 停止正在运行的渗透测试
./shannon stop <workflow-id>
# 查看最终报告
./shannon report <workflow-id>
# 必需(选择一种认证方式)
ANTHROPIC_API_KEY=sk-ant-... # Anthropic 直接认证
CLAUDE_CODE_OAUTH_TOKEN=... # Claude Code OAuth 认证
# 推荐设置
CLAUDE_CODE_MAX_OUTPUT_TOKENS=64000 # 为大型报告增加输出窗口
# AWS Bedrock(替代 Anthropic 直接认证)
AWS_ACCESS_KEY_ID=...
AWS_SECRET_ACCESS_KEY=...
AWS_DEFAULT_REGION=us-east-1
SHANNON_AI_PROVIDER=bedrock
SHANNON_BEDROCK_MODEL=anthropic.claude-3-7-sonnet-20250219-v1:0
# Google Vertex AI(替代 Anthropic 直接认证)
GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
SHANNON_AI_PROVIDER=vertex
SHANNON_VERTEX_PROJECT=your-gcp-project
SHANNON_VERTEX_REGION=us-east5
# .env(放置在 shannon 项目根目录)
ANTHROPIC_API_KEY=sk-ant-...
CLAUDE_CODE_MAX_OUTPUT_TOKENS=64000
# 可选:用于认证测试的目标凭据
TARGET_USERNAME=admin@example.com
TARGET_PASSWORD=supersecret
TARGET_TOTP_SECRET=BASE32TOTPSECRET # Shannon 自动处理 2FA
# 将 Shannon 指向正在运行的本地应用及其源代码
./shannon start \
URL=http://localhost:3000 \
REPO=$(pwd)/../my-express-app
# 拉取并运行 Juice Shop
docker run -d -p 3000:3000 bkimminich/juice-shop
# 使用 Shannon 对其进行测试
./shannon start \
URL=http://localhost:3000 \
REPO=/path/to/juice-shop
export TARGET_USERNAME="admin@yourapp.com"
export TARGET_PASSWORD="$ADMIN_PASSWORD"
export TARGET_TOTP_SECRET="$TOTP_BASE32_SECRET"
./shannon start URL=https://staging.yourapp.com REPO=/path/to/repo
export AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY_ID"
export AWS_SECRET_ACCESS_KEY="$AWS_SECRET_ACCESS_KEY"
export AWS_DEFAULT_REGION=us-east-1
export SHANNON_AI_PROVIDER=bedrock
export SHANNON_BEDROCK_MODEL=anthropic.claude-3-7-sonnet-20250219-v1:0
./shannon start URL=https://target.example.com REPO=/path/to/repo
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
export SHANNON_AI_PROVIDER=vertex
export SHANNON_VERTEX_PROJECT=my-gcp-project
export SHANNON_VERTEX_REGION=us-east5
./shannon start URL=https://target.example.com REPO=/path/to/repo
工作区允许您暂停和恢复长时间运行的渗透测试:
# 使用命名的工作区启动
./shannon start \
URL=https://target.example.com \
REPO=/path/to/repo \
WORKSPACE=sprint-42-audit
# 稍后,从停止的地方恢复
./shannon resume WORKSPACE=sprint-42-audit
# 工作区会持久化结果,以便您可以重新运行报告
./shannon report WORKSPACE=sprint-42-audit
报告被写入工作区目录(默认:./workspaces/<workflow-id>/):
workspaces/
└── my-audit-2024/
├── report.md # 包含 PoC 利用的最终渗透测试报告
├── findings.json # 机器可读的发现结果
└── logs/ # 每个代理的执行日志
报告内容包括:
Shannon 当前测试以下类别:
| 类别 | 示例 |
|---|---|
| 注入攻击 | SQL 注入、命令注入、LDAP 注入 |
| XSS | 反射型、存储型、基于 DOM 的 XSS |
| SSRF | 内部网络访问、云元数据端点 |
| 身份验证缺陷 | 弱令牌、会话固定、身份验证绕过 |
| 授权缺陷 | IDOR、权限提升、访问控制缺失 |
# .github/workflows/pentest.yml
name: Shannon Pentest
on:
push:
branches: [staging]
jobs:
pentest:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
path: app
- name: Clone Shannon
run: git clone https://github.com/KeygraphHQ/shannon.git
- name: 启动应用程序
run: |
cd app
docker compose up -d
# 等待应用程序健康启动
sleep 30
- name: 运行 Shannon
working-directory: shannon
env:
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
CLAUDE_CODE_MAX_OUTPUT_TOKENS: 64000
run: |
./shannon start \
URL=http://localhost:3000 \
REPO=${{ github.workspace }}/app \
WORKSPACE=ci-${{ github.sha }}
# 等待完成并获取报告
./shannon wait ci-${{ github.sha }}
./shannon report ci-${{ github.sha }} > pentest-report.md
- name: 上传报告
uses: actions/upload-artifact@v4
with:
name: pentest-report
path: shannon/pentest-report.md
# 确保 Docker 守护进程正在运行
docker info
# 将您的用户添加到 docker 组(Linux)
sudo usermod -aG docker $USER
newgrp docker
# 强制进行干净的重新构建
docker compose -f shannon/docker-compose.yml build --no-cache
# 检查阻塞代理的实时日志
./shannon logs <workflow-id>
# 常见原因:
# - 目标应用程序无法从 Shannon 容器内部访问
# - ANTHROPIC_API_KEY 缺失或达到速率限制
# - 未设置 CLAUDE_CODE_MAX_OUTPUT_TOKENS(模型达到默认限制)
# 使用 host.docker.internal 替代 localhost
./shannon start \
URL=http://host.docker.internal:3000 \
REPO=/path/to/repo
# 或者将两者放在同一个 Docker 网络中
docker network create pentest-net
docker run --network pentest-net ... # 您的应用
# 然后在 .env 中设置 SHANNON_DOCKER_NETWORK=pentest-net
# 使用 AWS Bedrock 或 Vertex AI 以避免共享速率限制
export SHANNON_AI_PROVIDER=bedrock
export AWS_DEFAULT_REGION=us-east-1
# 启动时始终使用 WORKSPACE= 以启用可恢复性
./shannon start URL=... REPO=... WORKSPACE=named-session
# 恢复
./shannon resume WORKSPACE=named-session
sample-reports/shannon-report-juice-shop.mdSHANNON-PRO.md每周安装量
255
仓库
GitHub 星标数
10
首次出现
6 天前
安全审计
已安装于
gemini-cli254
github-copilot254
codex254
amp254
cline254
kimi-cli254
Skill by ara.so — Daily 2026 Skills collection.
Shannon is an autonomous, white-box AI pentester for web applications and APIs. It reads your source code to identify attack vectors, then executes real exploits (SQLi, XSS, SSRF, auth bypass, authorization flaws) against a live running application — only reporting vulnerabilities with a working proof-of-concept.
Docker (required — Shannon runs entirely in containers)
An Anthropic API key, Claude Code OAuth token, AWS Bedrock credentials, or Google Vertex AI credentials
git clone https://github.com/KeygraphHQ/shannon.git cd shannon
# Option A: Export credentials
export ANTHROPIC_API_KEY="sk-ant-..."
export CLAUDE_CODE_MAX_OUTPUT_TOKENS=64000
# Option B: .env file
cat > .env << 'EOF'
ANTHROPIC_API_KEY=sk-ant-...
CLAUDE_CODE_MAX_OUTPUT_TOKENS=64000
EOF
# Run a pentest
./shannon start URL=https://your-app.example.com REPO=/path/to/your/repo
Shannon builds containers, starts the workflow in the background, and returns a workflow ID.
# Start a pentest
./shannon start URL=https://target.example.com REPO=/path/to/repo
# Start with explicit workspace name (for resuming)
./shannon start URL=https://target.example.com REPO=/path/to/repo WORKSPACE=my-audit-2024
# Monitor live progress (tail logs)
./shannon logs <workflow-id>
# Check status of a running pentest
./shannon status <workflow-id>
# Resume an interrupted pentest
./shannon resume WORKSPACE=my-audit-2024
# Stop a running pentest
./shannon stop <workflow-id>
# View the final report
./shannon report <workflow-id>
# Required (choose one auth method)
ANTHROPIC_API_KEY=sk-ant-... # Anthropic direct
CLAUDE_CODE_OAUTH_TOKEN=... # Claude Code OAuth
# Recommended
CLAUDE_CODE_MAX_OUTPUT_TOKENS=64000 # Increase output window for large reports
# AWS Bedrock (alternative to Anthropic direct)
AWS_ACCESS_KEY_ID=...
AWS_SECRET_ACCESS_KEY=...
AWS_DEFAULT_REGION=us-east-1
SHANNON_AI_PROVIDER=bedrock
SHANNON_BEDROCK_MODEL=anthropic.claude-3-7-sonnet-20250219-v1:0
# Google Vertex AI (alternative to Anthropic direct)
GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
SHANNON_AI_PROVIDER=vertex
SHANNON_VERTEX_PROJECT=your-gcp-project
SHANNON_VERTEX_REGION=us-east5
# .env (place in the shannon project root)
ANTHROPIC_API_KEY=sk-ant-...
CLAUDE_CODE_MAX_OUTPUT_TOKENS=64000
# Optional: target credentials for authenticated testing
TARGET_USERNAME=admin@example.com
TARGET_PASSWORD=supersecret
TARGET_TOTP_SECRET=BASE32TOTPSECRET # Shannon handles 2FA automatically
# Point Shannon at a running local app with its source code
./shannon start \
URL=http://localhost:3000 \
REPO=$(pwd)/../my-express-app
# Pull and run Juice Shop
docker run -d -p 3000:3000 bkimminich/juice-shop
# Run Shannon against it
./shannon start \
URL=http://localhost:3000 \
REPO=/path/to/juice-shop
export TARGET_USERNAME="admin@yourapp.com"
export TARGET_PASSWORD="$ADMIN_PASSWORD"
export TARGET_TOTP_SECRET="$TOTP_BASE32_SECRET"
./shannon start URL=https://staging.yourapp.com REPO=/path/to/repo
export AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY_ID"
export AWS_SECRET_ACCESS_KEY="$AWS_SECRET_ACCESS_KEY"
export AWS_DEFAULT_REGION=us-east-1
export SHANNON_AI_PROVIDER=bedrock
export SHANNON_BEDROCK_MODEL=anthropic.claude-3-7-sonnet-20250219-v1:0
./shannon start URL=https://target.example.com REPO=/path/to/repo
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json
export SHANNON_AI_PROVIDER=vertex
export SHANNON_VERTEX_PROJECT=my-gcp-project
export SHANNON_VERTEX_REGION=us-east5
./shannon start URL=https://target.example.com REPO=/path/to/repo
Workspaces allow you to pause and resume long-running pentests:
# Start with a named workspace
./shannon start \
URL=https://target.example.com \
REPO=/path/to/repo \
WORKSPACE=sprint-42-audit
# Later, resume from where it stopped
./shannon resume WORKSPACE=sprint-42-audit
# Workspaces persist results so you can re-run reports
./shannon report WORKSPACE=sprint-42-audit
Reports are written to the workspace directory (default: ./workspaces/<workflow-id>/):
workspaces/
└── my-audit-2024/
├── report.md # Final pentest report with PoC exploits
├── findings.json # Machine-readable findings
└── logs/ # Per-agent execution logs
The report includes:
Shannon currently tests for:
| Category | Examples |
|---|---|
| Injection | SQL injection, command injection, LDAP injection |
| XSS | Reflected, stored, DOM-based |
| SSRF | Internal network access, cloud metadata endpoints |
| Broken Authentication | Weak tokens, session fixation, auth bypass |
| Broken Authorization | IDOR, privilege escalation, missing access controls |
# .github/workflows/pentest.yml
name: Shannon Pentest
on:
push:
branches: [staging]
jobs:
pentest:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
path: app
- name: Clone Shannon
run: git clone https://github.com/KeygraphHQ/shannon.git
- name: Start Application
run: |
cd app
docker compose up -d
# Wait for app to be healthy
sleep 30
- name: Run Shannon
working-directory: shannon
env:
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
CLAUDE_CODE_MAX_OUTPUT_TOKENS: 64000
run: |
./shannon start \
URL=http://localhost:3000 \
REPO=${{ github.workspace }}/app \
WORKSPACE=ci-${{ github.sha }}
# Wait for completion and get report
./shannon wait ci-${{ github.sha }}
./shannon report ci-${{ github.sha }} > pentest-report.md
- name: Upload Report
uses: actions/upload-artifact@v4
with:
name: pentest-report
path: shannon/pentest-report.md
# Ensure Docker daemon is running
docker info
# Add your user to the docker group (Linux)
sudo usermod -aG docker $USER
newgrp docker
# Force a clean rebuild
docker compose -f shannon/docker-compose.yml build --no-cache
# Check live logs for the blocking agent
./shannon logs <workflow-id>
# Common causes:
# - Target app is not reachable from inside the Shannon container
# - ANTHROPIC_API_KEY is missing or rate-limited
# - CLAUDE_CODE_MAX_OUTPUT_TOKENS not set (model hits default limit)
# Use host.docker.internal instead of localhost
./shannon start \
URL=http://host.docker.internal:3000 \
REPO=/path/to/repo
# Or put both on the same Docker network
docker network create pentest-net
docker run --network pentest-net ... # your app
# Then set SHANNON_DOCKER_NETWORK=pentest-net in .env
# Use AWS Bedrock or Vertex AI to avoid shared rate limits
export SHANNON_AI_PROVIDER=bedrock
export AWS_DEFAULT_REGION=us-east-1
# Always use WORKSPACE= when starting to enable resumability
./shannon start URL=... REPO=... WORKSPACE=named-session
# Resume
./shannon resume WORKSPACE=named-session
sample-reports/shannon-report-juice-shop.md in the repoSHANNON-PRO.md in the repoWeekly Installs
255
Repository
GitHub Stars
10
First Seen
6 days ago
Security Audits
Gen Agent Trust HubFailSocketPassSnykWarn
Installed on
gemini-cli254
github-copilot254
codex254
amp254
cline254
kimi-cli254
通过 LiteLLM 代理让 Claude Code 对接 GitHub Copilot 运行 | 高级变通方案指南
27,600 周安装
竞争对手研究指南:SEO、内容、反向链接与定价分析工具
231 周安装
Azure 工作负载自动升级评估工具 - 支持 Functions、App Service 计划与 SKU 迁移
231 周安装
Kaizen持续改进方法论:软件开发中的渐进式优化与防错设计实践指南
231 周安装
软件UI/UX设计指南:以用户为中心的设计原则、WCAG可访问性与平台规范
231 周安装
Apify 网络爬虫和自动化平台 - 无需编码抓取亚马逊、谷歌、领英等网站数据
231 周安装
llama.cpp 中文指南:纯 C/C++ LLM 推理,CPU/非 NVIDIA 硬件优化部署
231 周安装