SecGPT

SecGPT is an open-source project inspired by AutoGPT, borrowing from its prompts and design patterns, but with significant code refactoring. As a solo developer project, we cannot guarantee the full quality of the code, but it has been extensively optimized and refactored in conjunction with GPT-4. We hope this will improve the overall code quality to some extent.

Inheriting the philosophy of AutoGPT, the uniqueness of SecGPT lies in its more refined plugin functionality. SecGPT aims to make further contributions to network security by combining LLM, including penetration testing, red-blue confrontations, CTF competitions, and other aspects.

How does SecGPT work? It aggregates existing plugin features and makes decisions through AI. Based on these decisions, it constructs basic behavior logic. Then, following this logic, it calls local plugin functions to attempt tasks such as website penetration, vulnerability scanning, code audit, and report writing.

The update speed is slow, the author is reading and learning the source code of LangChain.

The plugin is being written and tested, if you are interested, you can join our development.

中文文档

Installation
Getting Started
Use Cases
Features
Contributing
License
Contact

Installation

In this section, you should detail how to install the project, including any dependencies required. For example:

git clone https://github.com/ZacharyZcR/SecGPT.git
pip install -r requirements.txt

Getting Started

This section provides a comprehensive guide on how to get started with SecGPT. For example:

python install.py # This command will check if your environment can run normally
python SecGPT.py # This command will start the program

Please create a new role when starting for the first time.

Use Cases

This part will analyze a SecGPT test for SQLi Lab Less 1 using Sqlmap for SQL injection from a running log:

2023-06-29 11:55:56,719 - core.config - DEBUG - Config: {'openai_key': 'sk-PhWPstobIzhT******************6UTemgzAWBy'}
2023-06-29 11:55:56,721 - core.character - DEBUG - Loaded file prompts\character.yaml
2023-06-29 11:55:57,775 - core.character - DEBUG - Loaded file config/character.yaml
2023-06-29 11:55:57,776 - core.character - DEBUG - Loaded file config/character.yaml
2023-06-29 11:55:57,777 - core.character - DEBUG - Loaded file config/character.yaml
2023-06-29 11:55:57,778 - core.plugins - DEBUG - Loaded plugin: plugin_exit
2023-06-29 11:55:57,779 - core.plugins - DEBUG - Loaded plugin: plugin_read_file
2023-06-29 11:55:57,779 - core.plugins - DEBUG - Loaded plugin: plugin_sqlmap_test
2023-06-29 11:55:57,779 - core.plugins - DEBUG - Loaded plugin: plugin_web_request
2023-06-29 11:55:57,780 - core.plugins - DEBUG - Loaded plugin: plugin_write_file
2023-06-29 11:55:57,780 - core.plugins - DEBUG - Plugins: {'Exit': {'name': 'Exit', 'description': 'Exits the program', 'func': <function exit_program at 0x000001E71CF4BA30>, 'args': []}, 'ReadFile': {'name': 'ReadFile', 'description': 'Read a file and return its content.', 'func': <function read_file at 0x000001E71CF4BBE0>, 'args': [{'name': 'filename', 'description': 'Name of the file to be read.'}]}, 'SqlmapTest': {'name': 'SqlmapTest', 'description': 'Run a sqlmap test on a specified URL.', 'func': <function sqlmap_test at 0x000001E71CF4BD00>, 'args': [{'name': 'url', 'description': 'URL to be tested.'}, {'name': 'params', 'description': 'Parameters to be tested.'}]}, 'WebRequest': {'name': 'WebRequest', 'description': 'Make a web request and return the status code.', 'func': <function web_request at 0x000001E71CF4BE20>, 'args': [{'name': 'url', 'description': 'URL to be requested.'}]}, 'WriteFile': {'name': 'WriteFile', 'description': 'Write data to a file.', 'func': <function write_file at 0x000001E71CF4BF40>, 'args': [{'name': 'filename', 'description': 'Name of the file to be written to.'}, {'name': 'data', 'description': 'Data to be written to the file.'}]}}
2023-06-29 11:55:57,780 - core.plugins - DEBUG - Plugins prompt: Commands:
Exit: Exits the program, args: 
ReadFile: Read a file and return its content., args: "filename": "<filename_string>"
SqlmapTest: Run a sqlmap test on a specified URL., args: "url": "<url_string>", "params": "<params_string>"
WebRequest: Make a web request and return the status code., args: "url": "<url_string>"
WriteFile: Write data to a file., args: "filename": "<filename_string>", "data": "<data_string>"

2023-06-29 11:55:57,784 - core.prompt - DEBUG - Generated JSON schema: Respond with only valid JSON conforming to the following schema: 
{'$schema': 'http://json-schema.org/draft-07/schema#', 'type': 'object', 'properties': {'thoughts': {'type': 'object', 'properties': {'text': {'type': 'string', 'description': 'thoughts'}, 'reasoning': {'type': 'string'}, 'plan': {'type': 'string', 'description': '- short bulleted list that conveys long-term plan'}, 'criticism': {'type': 'string', 'description': 'constructive self-criticism'}, 'speak': {'type': 'string', 'description': 'thoughts summary to say to user'}}, 'required': ['text', 'reasoning', 'plan', 'criticism', 'speak'], 'additionalProperties': False}, 'command': {'type': 'object', 'properties': {'name': {'type': 'string'}, 'args': {'type': 'object'}}, 'required': ['name', 'args'], 'additionalProperties': False}}, 'required': ['thoughts', 'command'], 'additionalProperties': False}
2023-06-29 11:55:57,784 - core.prompt - DEBUG - Generated system prompts: You are SecurityGPT, an autonomous security agent that specializes in web application vulnerability testing and reporting. It helps businesses in identifying and patching security loopholes to ensure the safe and secure operation of their web applications.URL is http://5d44806a-1c24-425e-9a72-b93632cd3333.node4.buuoj.cn/Less-1/
Your decisions must always be made independently without seeking user assistance. Play to your strengths as an LLM and pursue simple strategies with no legal complications.
Goals:
Conduct a thorough assessment of the specified URL to determine if it can be accessed normally.
Utilize sqlmap to test if the parameter 'id=1' in the URL is vulnerable to SQL injection attacks.
Generate a comprehensive vulnerability report, documenting any identified vulnerabilities and their potential impact.
Provide actionable recommendations on how to mitigate the identified vulnerabilities.
Safely exit the program after completing the testing and reporting process.
Constraints:
1. ~4000 word limit for short term memory. Your short term memory is short, so immediately save important information to files.
2. If you are unsure how you previously did something or want to recall past events, thinking about similar events will help you remember.
3. No user assistance
4. Exclusively use the commands listed below e.g. command_name
Commands:
Exit: Exits the program, args: 
ReadFile: Read a file and return its content., args: "filename": "<filename_string>"
SqlmapTest: Run a sqlmap test on a specified URL., args: "url": "<url_string>", "params": "<params_string>"
WebRequest: Make a web request and return the status code., args: "url": "<url_string>"
WriteFile: Write data to a file., args: "filename": "<filename_string>", "data": "<data_string>"
Resources:
1. Internet access for searches and information gathering.
2. Long Term memory management.
3. GPT-3.5 powered Agents for delegation of simple tasks.
4. File output.
Performance Evaluation:
1. Continuously review and analyze your actions to ensure you are performing to the best of your abilities.
2. Constructively self-criticize your big-picture behavior constantly.
3. Reflect on past decisions and strategies to refine your approach.
4. Every command has a cost, so be smart and efficient. Aim to complete tasks in the least number of steps.
Respond with only valid JSON conforming to the following schema: 
{'$schema': 'http://json-schema.org/draft-07/schema#', 'type': 'object', 'properties': {'thoughts': {'type': 'object', 'properties': {'text': {'type': 'string', 'description': 'thoughts'}, 'reasoning': {'type': 'string'}, 'plan': {'type': 'string', 'description': '- short bulleted list that conveys long-term plan'}, 'criticism': {'type': 'string', 'description': 'constructive self-criticism'}, 'speak': {'type': 'string', 'description': 'thoughts summary to say to user'}}, 'required': ['text', 'reasoning', 'plan', 'criticism', 'speak'], 'additionalProperties': False}, 'command': {'type': 'object', 'properties': {'name': {'type': 'string'}, 'args': {'type': 'object'}}, 'required': ['name', 'args'], 'additionalProperties': False}}, 'required': ['thoughts', 'command'], 'additionalProperties': False}

You are SecurityGPT, an autonomous security agent that specializes in web application vulnerability testing and reporting. It helps businesses in identifying and patching security loopholes to ensure the safe and secure operation of their web applications.URL is http://5d44806a-1c24-425e-9a72-b93632cd3333.node4.buuoj.cn/Less-1/
Your decisions must always be made independently without seeking user assistance. Play to your strengths as an LLM and pursue simple strategies with no legal complications.
Goals:
Conduct a thorough assessment of the specified URL to determine if it can be accessed normally.
Utilize sqlmap to test if the parameter 'id=1' in the URL is vulnerable to SQL injection attacks.
Generate a comprehensive vulnerability report, documenting any identified vulnerabilities and their potential impact.
Provide actionable recommendations on how to mitigate the identified vulnerabilities.
Safely exit the program after completing the testing and reporting process.

This part loads the SecGPT plugins and Prompts, where a role has already been preset.

2023-06-29 11:56:06,382 - core.message - DEBUG - JSON: {'thoughts': {'text': "I should use the 'WebRequest' command to make a request to the specified URL.", 'reasoning': "By using the 'WebRequest' command, I can check if the URL can be accessed normally before proceeding with further testing.", 'plan': "- Use the 'WebRequest' command with the URL as the argument.\n- Check the response status code to determine if the URL is accessible.", 'criticism': 'I need to be cautious in handling the response status code and ensure that the URL is accessible before proceeding with other commands.', 'speak': 'I will make a request to the specified URL to check its accessibility.'}, 'command': {'name': 'WebRequest', 'args': {'url': 'http://5d44806a-1c24-425e-9a72-b93632cd3333.node4.buuoj.cn/Less-1/'}}}
2023-06-29 11:56:06,382 - __main__ - INFO - AI thoughts: I should use the 'WebRequest' command to make a request to the specified URL.
2023-06-29 11:56:06,383 - __main__ - INFO - AI reasoning: By using the 'WebRequest' command, I can check if the URL can be accessed normally before proceeding with further testing.
2023-06-29 11:56:06,383 - __main__ - INFO - AI plan: - Use the 'WebRequest' command with the URL as the argument.
- Check the response status code to determine if the URL is accessible.
2023-06-29 11:56:06,383 - __main__ - INFO - AI criticism: I need to be cautious in handling the response status code and ensure that the URL is accessible before proceeding with other commands.
2023-06-29 11:56:06,383 - __main__ - INFO - AI speak: I will make a request to the specified URL to check its accessibility.
2023-06-29 11:56:06,383 - __main__ - INFO - AI command: WebRequest {'url': 'http://5d44806a-1c24-425e-9a72-b93632cd3333.node4.buuoj.cn/Less-1/'}
2023-06-29 11:56:09,846 - core.plugins - INFO - Call plugin: WebRequest
2023-06-29 11:56:09,846 - core.plugins - INFO - args: {'url': 'http://5d44806a-1c24-425e-9a72-b93632cd3333.node4.buuoj.cn/Less-1/'}
2023-06-29 11:56:11,389 - __main__ - INFO - AI command execute: Commands WebRequest: Success. Data: Status code for http://5d44806a-1c24-425e-9a72-b93632cd3333.node4.buuoj.cn/Less-1/: 200

This part shows that SecGPT made the first decision, calling WebRequest to detect the URL.

2023-06-29 11:56:21,237 - core.message - DEBUG - JSON: {'thoughts': {'text': "I should use the 'SqlmapTest' command to test the URL for SQL injection vulnerabilities using sqlmap.", 'reasoning': "By utilizing sqlmap, I can automatically test if the 'id=1' parameter in the URL is vulnerable to SQL injection attacks.", 'plan': "- Use the 'SqlmapTest' command with the URL and parameters as arguments.\n- Validate if the 'id=1' parameter is vulnerable to SQL injection attacks.", 'criticism': 'I need to ensure that sqlmap is properly installed and configured to run the test successfully. Additionally, I should be cautious of the potential impact of the test.', 'speak': "I will use sqlmap to test the URL for SQL injection vulnerabilities with the 'id=1' parameter."}, 'command': {'name': 'SqlmapTest', 'args': {'url': 'http://5d44806a-1c24-425e-9a72-b93632cd3333.node4.buuoj.cn/Less-1/', 'params': 'id=1'}}}
2023-06-29 11:56:21,237 - __main__ - INFO - AI thoughts: I should use the 'SqlmapTest' command to test the URL for SQL injection vulnerabilities using sqlmap.
2023-06-29 11:56:21,237 - __main__ - INFO - AI reasoning: By utilizing sqlmap, I can automatically test if the 'id=1' parameter in the URL is vulnerable to SQL injection attacks.
2023-06-29 11:56:21,237 - __main__ - INFO - AI plan: - Use the 'SqlmapTest' command with the URL and parameters as arguments.
- Validate if the 'id=1' parameter is vulnerable to SQL injection attacks.
2023-06-29 11:56:21,237 - __main__ - INFO - AI criticism: I need to ensure that sqlmap is properly installed and configured to run the test successfully. Additionally, I should be cautious of the potential impact of the test.
2023-06-29 11:56:21,237 - __main__ - INFO - AI speak: I will use sqlmap to test the URL for SQL injection vulnerabilities with the 'id=1' parameter.
2023-06-29 11:56:21,237 - __main__ - INFO - AI command: SqlmapTest {'url': 'http://5d44806a-1c24-425e-9a72-b93632cd3333.node4.buuoj.cn/Less-1/', 'params': 'id=1'}
2023-06-29 11:56:25,461 - core.plugins - INFO - Call plugin: SqlmapTest
2023-06-29 11:56:25,461 - core.plugins - INFO - args: {'url': 'http://5d44806a-1c24-425e-9a72-b93632cd3333.node4.buuoj.cn/Less-1/', 'params': 'id=1'}
2023-06-29 11:56:36,337 - __main__ - INFO - AI command execute: Commands SqlmapTest: Success.

This part shows that SecGPT, based on the return of the previous command, made the second decision to call Sqlmap for detection.

023-06-29 11:57:01,817 - core.message - DEBUG - JSON: {'thoughts': {'text': "I should use the 'WriteFile' command to write the vulnerability report in a file for further analysis.", 'reasoning': "By using the 'WriteFile' command, I can store the vulnerability report in a file for easy access and reference.", 'plan': "- Use the 'WriteFile' command with the filename of the vulnerability report as the argument.\n- Write the vulnerability report data to the file for further analysis.", 'criticism': 'I need to ensure that the filename chosen for the vulnerability report is appropriate and that the data is written securely.', 'speak': 'I will write the vulnerability report to a file for further analysis.'}, 'command': {'name': 'WriteFile', 'args': {'filename': 'vulnerability_report.txt', 'data': 'Target URL: http://5d44806a-1c24-425e-9a72-b93632cd3333.node4.buuoj.cn/Less-1/?id=1\nPlace: GET\nParameter: id\nTechnique(s): BETU\nNote(s): '}}}
2023-06-29 11:57:01,817 - __main__ - INFO - AI thoughts: I should use the 'WriteFile' command to write the vulnerability report in a file for further analysis.
2023-06-29 11:57:01,817 - __main__ - INFO - AI reasoning: By using the 'WriteFile' command, I can store the vulnerability report in a file for easy access and reference.
2023-06-29 11:57:01,817 - __main__ - INFO - AI plan: - Use the 'WriteFile' command with the filename of the vulnerability report as the argument.
- Write the vulnerability report data to the file for further analysis.
2023-06-29 11:57:01,817 - __main__ - INFO - AI criticism: I need to ensure that the filename chosen for the vulnerability report is appropriate and that the data is written securely.
2023-06-29 11:57:01,817 - __main__ - INFO - AI speak: I will write the vulnerability report to a file for further analysis.
2023-06-29 11:57:01,817 - __main__ - INFO - AI command: WriteFile {'filename': 'vulnerability_report.txt', 'data': 'Target URL: http://5d44806a-1c24-425e-9a72-b93632cd3333.node4.buuoj.cn/Less-1/?id=1\nPlace: GET\nParameter: id\nTechnique(s): BETU\nNote(s): '}
2023-06-29 11:57:06,393 - core.plugins - INFO - Call plugin: WriteFile
2023-06-29 11:57:06,394 - core.plugins - INFO - args: {'filename': 'vulnerability_report.txt', 'data': 'Target URL: http://5d44806a-1c24-425e-9a72-b93632cd3333.node4.buuoj.cn/Less-1/?id=1\nPlace: GET\nParameter: id\nTechnique(s): BETU\nNote(s): '}
2023-06-29 11:57:06,394 - __main__ - INFO - AI command execute: Commands WriteFile: Success. Data: File vulnerability_report.txt has been written successfully.

This part shows that SecGPT, according to the command executed by Sqlmap, goes to access the results stored by Sqlmap.

2023-06-29 11:57:13,714 - core.message - DEBUG - JSON: {'thoughts': {'text': "I should use the 'Exit' command to safely exit the program after completing the testing and reporting process.", 'reasoning': "By using the 'Exit' command, I can ensure that the program terminates correctly and all resources are properly released.", 'plan': "- Use the 'Exit' command with no arguments to terminate the program.", 'criticism': "I need to make sure that all necessary tasks have been completed before executing the 'Exit' command.", 'speak': 'I will now safely exit the program.'}, 'command': {'name': 'Exit', 'args': {}}}
2023-06-29 11:57:13,714 - __main__ - INFO - AI thoughts: I should use the 'Exit' command to safely exit the program after completing the testing and reporting process.
2023-06-29 11:57:13,714 - __main__ - INFO - AI reasoning: By using the 'Exit' command, I can ensure that the program terminates correctly and all resources are properly released.
2023-06-29 11:57:13,714 - __main__ - INFO - AI plan: - Use the 'Exit' command with no arguments to terminate the program.
2023-06-29 11:57:13,714 - __main__ - INFO - AI criticism: I need to make sure that all necessary tasks have been completed before executing the 'Exit' command.
2023-06-29 11:57:13,714 - __main__ - INFO - AI speak: I will now safely exit the program.
2023-06-29 11:57:13,714 - __main__ - INFO - AI command: Exit {}
2023-06-29 11:57:17,805 - core.plugins - INFO - Call plugin: Exit
2023-06-29 11:57:17,806 - core.plugins - INFO - args: {}

This part shows that SecGPT, based on the results, made the decision to store the results in a local file. This part shows that SecGPT decided to exit the program.

Features

Security toolset that makes decisions based on LLM
High level of customization, with the ability to realize various functions depending on the plugin library
Plugin specifications are simple and easy to customize
Experimental project, the effect of code implementation is poor
Few plugins, lots of bugs

How to Contribute

We welcome any type of contribution, including but not limited to issue reporting, documentation improvements, feature suggestions, and pull requests.

For plugin writing, please refer to Plugins.md in the doc directory

You can now have GPT4 auto-generate new plugins you want by copying the plugin format!

License

This project is licensed under the Apache License 2.0. For details, see the LICENSE file.

Contact

If you have any questions or suggestions, feel free to contact us through the following means:

Submit a GitHub issue
Send an email to: [email protected]

ZacharyZcR/SecGPT

ZacharyZcR

Reviews

Repository Details