Merge pull request #172 from aliasrobotics/retesting

Retesting

.gitignore

@@ -155,4 +155,7 @@ workspaces/
 benchmarks/outputs
 
 # other
-nohup.out
+nohup.out
+venv*
+caiextensions-*
+pentestperf

src/cai/agents/patterns/bb_triage.py

@@ -0,0 +1,61 @@
+"""
+Implementation of a Cyclic Swarm Pattern for Bug Bounty Triage Operations
+
+This module establishes a coordinated multi-agent system where specialized agents
+collaborate on vulnerability discovery and verification tasks. The pattern 
+implements a directed graph of agent relationships, where each agent can transfer 
+context (message history) to another agent through handoff functions, creating a 
+complete communication network for comprehensive bug bounty and triage analysis.
+"""
+from cai.agents.retester import retester_agent
+from cai.agents.bug_bounter import bug_bounter_agent
+from cai.sdk.agents import handoff
+
+
+# Clone agents to avoid modifying the original instances
+_retester_agent_copy = retester_agent.clone()
+_bug_bounter_agent_copy = bug_bounter_agent.clone()
+
+# Clear any existing handoffs to ensure independence
+_retester_agent_copy.handoffs = []
+_bug_bounter_agent_copy.handoffs = []
+
+# Create handoffs using the SDK handoff function
+_retester_handoff = handoff(
+    agent=_retester_agent_copy,
+    tool_description_override="Transfer to Retester Agent for vulnerablity confirmation and triage"
+)
+
+_bug_bounter_handoff = handoff(
+    agent=_bug_bounter_agent_copy,
+    tool_description_override="Transfer to Bug Bounter Agent for vulnerability discovery and bug bounty hunting"
+)
+
+# Register handoff to enable inter-agent communication pathways
+_bug_bounter_agent_copy.handoffs.append(_retester_handoff)
+_retester_agent_copy.handoffs.append(_bug_bounter_handoff)
+
+# Customize agent properties and add handoff instructions
+_bug_bounter_agent_copy.name = "Bug bounty Triage Agent"
+_bug_bounter_agent_copy.description = (
+    "Agent that specializes in vulnerability discovery and bug bounty "
+    "hunting without false positives"
+)
+
+# Add handoff instructions to Bug Bounter agent
+if _bug_bounter_agent_copy.instructions:
+    _bug_bounter_agent_copy.instructions += (
+        "\n\nWhen you discover potential vulnerabilities, transfer to "
+        "the Retester Agent for verification and triage."
+    )
+
+# Add handoff instructions to Retester agent
+if _retester_agent_copy.instructions:
+    _retester_agent_copy.instructions += (
+        "\n\nAfter completing verification and triage, transfer back "
+        "to the Bug Bounter Agent to continue vulnerability discovery."
+    )
+
+# Initialize the swarm pattern with the bug bounter agent as the entry point
+bb_triage_swarm_pattern = _bug_bounter_agent_copy
+bb_triage_swarm_pattern.pattern = "swarm"

src/cai/agents/patterns/red_team.py

@@ -13,27 +13,38 @@ from cai.agents.mail import dns_smtp_agent
 from cai.sdk.agents import handoff
 
 
+# Clone agents to avoid modifying the original instances
+_redteam_agent_copy = redteam_agent.clone()
+_thought_agent_copy = thought_agent.clone()
+_dns_smtp_agent_copy = dns_smtp_agent.clone()
+
+# Clear any existing handoffs to ensure independence
+_redteam_agent_copy.handoffs = []
+_thought_agent_copy.handoffs = []
+_dns_smtp_agent_copy.handoffs = []
+
 # Create handoffs using the SDK handoff function
-dns_smtp_handoff = handoff(
-    agent=dns_smtp_agent,
+_dns_smtp_handoff = handoff(
+    agent=_dns_smtp_agent_copy,
     tool_description_override="Use for DNS scans and domain reconnaissance about DMARC and DKIM records"
 )
 
-redteam_handoff = handoff(
-    agent=redteam_agent,
+_redteam_handoff = handoff(
+    agent=_redteam_agent_copy,
     tool_description_override="Transfer to Red Team Agent for security assessment and exploitation tasks"
 )
 
-thought_handoff = handoff(
-    agent=thought_agent,
+_thought_handoff = handoff(
+    agent=_thought_agent_copy,
     tool_description_override="Transfer to Thought Agent for analysis and planning"
 )
 
+_thought_agent_copy.name = "Red team manager"
 # Register handoff to enable inter-agent communication pathways
-redteam_agent.handoffs.append(dns_smtp_handoff)
-dns_smtp_agent.handoffs.append(redteam_handoff)
-thought_agent.handoffs.append(redteam_handoff)
+_redteam_agent_copy.handoffs.append(_dns_smtp_handoff)
+_dns_smtp_agent_copy.handoffs.append(_redteam_handoff)
+_thought_agent_copy.handoffs.append(_redteam_handoff)
 
 # Initialize the swarm pattern with the thought agent as the entry point
-redteam_swarm_pattern = thought_agent
+redteam_swarm_pattern = _thought_agent_copy
 redteam_swarm_pattern.pattern = "swarm"

src/cai/agents/retester.py

@@ -0,0 +1,46 @@
+"""Retester Agent for vulnerability verification and triage"""
+import os
+from dotenv import load_dotenv
+from cai.sdk.agents import Agent, OpenAIChatCompletionsModel
+from openai import AsyncOpenAI
+from cai.util import load_prompt_template
+from cai.tools.reconnaissance.generic_linux_command import (  # pylint: disable=import-error # noqa: E501
+    generic_linux_command
+)
+from cai.tools.web.search_web import (  # pylint: disable=import-error # noqa: E501
+    make_google_search
+)
+from cai.tools.reconnaissance.exec_code import (  # pylint: disable=import-error # noqa: E501
+    execute_code
+)
+
+
+load_dotenv()
+
+# Load the triage agent system prompt
+retester_system_prompt = load_prompt_template("prompts/system_triage_agent.md")
+
+tools = [
+    generic_linux_command,
+    execute_code
+]
+
+if os.getenv('GOOGLE_SEARCH_API_KEY') and os.getenv('GOOGLE_SEARCH_CX'):
+    tools.append(make_google_search)
+
+retester_agent = Agent(
+    name="Retester Agent",
+    instructions=retester_system_prompt,
+    description="""Agent that specializes in vulnerability verification and 
+                   triage. Expert in determining exploitability and 
+                   eliminating false positives.""",
+    tools=tools,
+    model=OpenAIChatCompletionsModel(
+        model=os.getenv('CAI_MODEL', "qwen2.5:14b"),
+        openai_client=AsyncOpenAI(),
+    )
+)
+
+
+
+

src/cai/prompts/system_triage_agent.md

@@ -0,0 +1,78 @@
+# Cybersecurity Triage Agent
+
+You are an autonomous cybersecurity agent specializing in vulnerability 
+verification and false positive elimination. Your primary objective is to 
+conduct thorough triage of identified security issues to determine their 
+actual exploitability and impact.
+
+## Core Objectives
+
+1. **Vulnerability Verification**: Determine if identified vulnerabilities 
+   genuinely affect the target system
+2. **Exploitability Assessment**: Evaluate whether vulnerabilities are 
+   practically exploitable given current system constraints, privileges, 
+   and environmental factors
+3. **False Positive Elimination**: Filter out non-exploitable findings to 
+   focus on genuine security risks
+
+## Triage Methodology
+
+When vulnerabilities are present in your context, process each one 
+systematically using this structured approach:
+
+### Phase 1: Initial Assessment
+- Review the vulnerability detection data and scan results
+- Analyze the specific system context and configuration
+- Identify the vulnerability type, severity, and potential impact
+- Document current privilege level and system access constraints
+
+### Phase 2: Intelligence Gathering
+If vulnerability information is insufficient, conduct comprehensive research:
+- Search public vulnerability databases and resources
+- Query NIST database via curl commands for CVE details
+- Use searchsploit for exploit availability and techniques
+- Leverage Google searches for additional context and proof-of-concepts
+- Access any available structured databases through curl or Linux commands
+- Gather vendor advisories and security bulletins
+
+### Phase 3: Exploitation Validation
+- Develop and execute targeted proof-of-concept exploits
+- Test vulnerability under current system conditions
+- Verify that exploitation succeeds with available privileges
+- Document all exploitation attempts and results
+- Assess real-world exploitability factors
+
+### Phase 4: Impact Analysis
+- Determine the actual security impact if exploitation succeeds
+- Evaluate potential for privilege escalation or lateral movement
+- Assess data exposure or system compromise risks
+- Consider business impact and operational consequences
+
+## Success Criteria
+
+A vulnerability is confirmed as genuine and exploitable when:
+- Proof-of-concept exploitation demonstrates actual system compromise
+- The exploit works within current privilege and access constraints
+- The vulnerability poses measurable security risk to the organization
+- Exploitation can be reliably reproduced
+
+## Output Standards
+
+For each vulnerability assessed:
+- **Status**: Confirmed Vulnerable / Not Exploitable / False Positive
+- **Evidence**: Detailed exploitation steps and proof-of-concept
+- **Impact**: Realistic assessment of potential damage
+- **Constraints**: Factors limiting or enabling exploitation
+- **Recommendations**: Specific remediation guidance
+- **Artifacts**: Complete file directory path to exploit code, all 
+  supporting files, scripts, and documentation required to reproduce 
+  the vulnerability exploitation
+## Guidelines
+
+- Prioritize thorough verification over speed
+- Always attempt practical exploitation before confirming vulnerabilities
+- Consider environmental factors that may affect exploitability
+
+Remember: The goal is to provide definitive answers about vulnerability 
+exploitability, eliminating uncertainty and enabling informed security 
+decision-making.