Show HN：Xalgorix——可验证漏洞的开源 AI 渗透测试工具
英文标题：🔶 Show HN: Xalgorix – open-source AI pentester that proves vulnerabilities
Xalgorix 是一款开源 AI 渗透测试工具，定位是通过实际验证来证明漏洞存在。日志显示，该工具在目标站点上运行 Nuclei CVE 模板扫描，并发现了 `/api/search` 上的严重 SQL 注入漏洞以及 `/api/users/{id}` 上的高危 IDOR 漏洞。系统还会利用 LLM 分析认证绕过响应模式，并进入注入测试阶段；开发者需注意，诸如 sqlmap 等外部工具可能出现超时并触发重试。
19.2 KB
中文
00:12:34[TOOL]nuclei -t cves/ -u https://target.com
00:14:02[FIND]Critical: SQL Injection on /api/search
00:14:15[AGENT]Analyzing response patterns for auth bypass...
00:14:22[HTTP]POST /api/login → 200 (342ms)
00:14:30[LLM]openai/gpt-5.4 → 2,847 tokens
00:15:01[PHASE]Phase 6/22: Injection Testing — started
00:16:45[FIND]High: IDOR on /api/users/{id}
00:17:12[ERR]Tool timeout: sqlmap (30s, retrying)
English / 原文
00:12:34[TOOL]nuclei -t cves/ -u https://target.com
00:14:02[FIND]Critical: SQL Injection on /api/search
00:14:15[AGENT]Analyzing response patterns for auth bypass...
00:14:22[HTTP]POST /api/login → 200 (342ms)
00:14:30[LLM]openai/gpt-5.4 → 2,847 tokens
00:15:01[PHASE]Phase 6/22: Injection Testing — started
00:16:45[FIND]High: IDOR on /api/users/{id}
00:17:12[ERR]Tool timeout: sqlmap (30s, retrying)