Metadata-Version: 2.4
Name: navig-pentest
Version: 0.1.0
Summary: NAVIG Pentest — the authorized-only offensive-security toolkit: passive recon (RDAP/whois, DNS, crt.sh subdomains, HTTP fingerprint) plus gated active recon (port scan, subdomain probe, template checks) behind a written-authorization engagement gate. Wired into `navig pentest` (+ `navig-warroom` / `warroom-osint` conveniences).
Author-email: NAVIG Development Team <opensource@navig.run>
License-Expression: Apache-2.0
Project-URL: Homepage, https://navig.run
Project-URL: Documentation, https://navig.run/docs
Keywords: navig,cli,agent,automation,plugin,pentest,recon,osint,security,dns,whois,ports,subdomains
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Information Technology
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Classifier: Topic :: Utilities
Requires-Python: >=3.10
Description-Content-Type: text/markdown
Requires-Dist: navig-sdk>=2.11.0
Requires-Dist: typer>=0.14.0
Requires-Dist: rich>=13.7.0

# navig-pentest 🛡️

<!-- navig:plugin-card:start -->
<!-- Generated by scripts/gen_plugin_catalog.py — edit the plugin's pyproject.toml, not this block. -->

> The authorized-only offensive-security toolkit: passive recon (RDAP/whois, DNS, crt.sh subdomains, HTTP fingerprint) plus gated active recon (port scan, subdomain probe, template checks) behind a written-authorization engagement gate. Wired into `navig pentest` (+ `navig-warroom` / `warroom-osint` conveniences).

**Works on its own** — its own CLI, no navig required · v0.1.0 · not on PyPI yet (install from source below)

**On its own** (no navig needed)

```bash
pip install "git+https://github.com/navig-run/plugins#subdirectory=navig-pentest"
warroom-osint --help   # no navig needed
```

**With navig**

```bash
pip install "git+https://github.com/navig-run/plugins#subdirectory=navig-pentest"
navig pentest --help
```

<details><summary>Commands</summary>

| Command | What it does |
|---|---|
| `navig pentest amass` | Attack-surface mapping (OWASP amass). GATED unless --passive. |
| `navig pentest binwalk` | Firmware image analysis (binwalk). Local — no gate. |
| `navig pentest cewl` | Generate a wordlist from a target site (cewl). Passive read of a single URL. |
| `navig pentest crawl` | Web crawler for endpoint discovery (katana). GATED. |
| `navig pentest dns` | Resolve DNS records (A/AAAA via the system resolver; others via UDP). |
| `navig pentest dnsx` | Fast DNS record resolution (dnsx). Passive. |
| `navig pentest doctor` | Tool health: detected engines by category, engagement store, and gate status. |
| `navig pentest engage` | Open an AUTHORIZED engagement. Refuses without a written authorization. |
| `navig pentest enum4linux` | SMB / null-session enumeration (enum4linux). GATED — requires an engagement. |
| `navig pentest exif` | Read/write file metadata (exiftool). Local — no gate. |
| `navig pentest fingerprint` | HTTP fingerprint — status, headers, tech-stack guesses, TLS metadata. |
| `navig pentest fuzz` | Directory/content fuzzing. GATED — requires an authorized engagement. |
| `navig pentest harvester` | OSINT emails, hosts and subdomains (theHarvester). Passive. |
| `navig pentest hashcat` | GPU-accelerated hash cracking (hashcat). Local — no network gate. |
| `navig pentest hashid` | Identify a hash type (hashid). Local — no gate. |
| `navig pentest hydra` | Network login brute force (hydra). GATED — very loud; confirm scope first. |
| `navig pentest john` | Hash cracking (John the Ripper). Local — no network gate. |
| `navig pentest nikto` | Web server vulnerability scan (nikto). GATED. |
| `navig pentest nuclei` | Run nuclei template checks. GATED — requires an authorized engagement. |
| `navig pentest osint` | One-pass passive sweep: whois + DNS + certificate-transparency subdomains. |
| `navig pentest ports` | TCP port scan. GATED — requires an authorized engagement covering the host. |
| `navig pentest probe` | HTTP liveness probe over hosts (httpx-style). GATED — requires an engagement. |
| `navig pentest run` | Run any detected Kali tool through the authorization gate. |
| `navig pentest scope` | List engagements, or check whether a target is authorized. |
| `navig pentest searchsploit` | Exploit-DB search (searchsploit). Passive — local database. |
| `navig pentest sherlock` | Username OSINT across social networks (sherlock). Passive. |
| `navig pentest sqlmap` | Automatic SQL injection (sqlmap). GATED — intrusive; confirm scope first. |
| `navig pentest subdomains` | Enumerate subdomains from certificate-transparency logs (passive). |
| `navig pentest subfinder` | Passive subdomain enumeration (subfinder). |
| `navig pentest surface` | Attack-surface mapping: passive subdomains → DNS resolution → optional live probe. |
| `navig pentest tools` | List the Kali toolchain catalog with detection status and install guidance. |
| `navig pentest urls` | Discover known URLs from archives/engines (gau + waybackurls). Passive. |
| `navig pentest whois` | RDAP lookup (the modern whois) — public registry records. |
| `navig pentest wordlist` | Find installed wordlists, or generate one from a target site (cewl). |
| `navig pentest wpscan` | WordPress security scan (wpscan). GATED. |

</details>

<!-- navig:plugin-card:end -->

**The authorized-only offensive-security toolkit for NAVIG** — a Swiss-army-knife over the
Kali Linux / GitHub toolchain. Passive reconnaissance is free and safe; active reconnaissance
is gated behind a written-authorization engagement.

```
# passive (free — public records)
navig pentest whois example.com · dns · subdomains · fingerprint · osint
navig pentest subfinder example.com · amass --passive · harvester · dnsx · sherlock <user>
navig pentest surface example.com          # subdomains → DNS, one pass
navig pentest urls example.com             # gau + waybackurls
navig pentest wordlist --find              # locate installed wordlists

# active (GATED — needs an authorized engagement)
navig pentest ports acme.com --top 1000 --tool nmap   # connect · nmap · naabu · masscan · rustscan
navig pentest probe · nuclei · enum4linux acme.com
navig pentest fuzz https://acme.com/FUZZ --tool ffuf · crawl · sqlmap · wpscan · nikto
navig pentest hydra acme.com ssh --users u.txt --passwords p.txt   # loud — scope first
navig pentest surface acme.com --live     # add live probing (gated)

# local (no network gate)
navig pentest hashcat hashes.txt --mode 0 · john hashes.txt
navig pentest exif file.jpg · binwalk firmware.bin · hashid <hash>

# the Swiss-army-knife core — any detected engine, through the gate
navig pentest run ffuf --target https://acme.com -u https://acme.com/FUZZ -w list.txt
navig pentest tools                 # the 40-tool catalog with install guidance
navig pentest doctor                # health, grouped by category

# scope
navig pentest engage --name "Q3: Acme" --target acme.com \
  --authorization signed-scope.pdf --assets "acme.com,203.0.113.0/24"
navig pentest scope acme.com
```

## The toolchain

The plugin **detects, never bundles** ~40 best-of-breed Kali/GitHub engines across eight
categories — recon & OSINT (subfinder, amass, theHarvester, sherlock, dnsx, gau, …),
scanning (nmap, naabu, masscan, rustscan, enum4linux, …), web/fuzzing (ffuf, gobuster,
feroxbuster, dirsearch, httpx, katana), vulnerability (nuclei, nikto, wpscan, sqlmap,
searchsploit), passwords (hydra, john, hashcat, cewl), exploitation (metasploit, beef-xss),
wireless (aircrack-ng, wifite, reaver) and forensics (exiftool, binwalk, hashid, steghide).

`navig pentest tools` lists the catalog with per-tool install guidance; `navig pentest run
<tool> --target <host> [flags…]` runs any of them through the gate. Interactive consoles
(msfconsole, wifite) are detected and pointed to, never auto-launched.

## The gate

No active collection, scanning, probing or brute-forcing against a target without **standing
written authorization** for that target. Every active engine — whether reached through a
curated command or `pentest run` — goes through the same gate: an `authorized` engagement
must cover the target (exact / subdomain / wildcard / CIDR) **and** today must be inside its
window. Passive lookups and local-only tools (hash cracking, forensics) need no network gate.

`engage` refuses to create an engagement without an `--authorization` reference. The store
(`~/.navig/pentest/engagements.json`, override `NAVIG_PENTEST_ENGAGEMENTS`) is the same
shape the `war-room-space` `start-engagement` skill writes, so the space and this plugin
agree on one source of truth.

## Standalone

Runs on its own (`navig-pentest …`, `navig-warroom …`, `warroom-osint <domain>`) with no
navig installed — and inside navig as `navig pentest …`. Passive recon is pure Python
stdlib; every external engine is detected on PATH and install-guided, never bundled.

## War Room integration

The Telegram War Room surface (`/osint` · `/wr` · `/kali`) dispatches to the `kali-warroom`
host, where this plugin provides `warroom-osint` (passive sweep) and `navig-warroom`
(status · tool-health · list-cases).

> **Legal/ethical line — deliberately NOT built:** raw breach-dump/combolist sources,
> stresser/booter (DoS) services, credential-stuffing, or anything that requires bypassing
> access controls. Capability is never the test — authorization and legality are.
