Deluluscan

AI-augmented, evidence-first security auditor for authorized testing across web, API, application, container/Kubernetes, cloud, and LLM/AI-system targets.

Deluluscan automates the mechanical phases of an assessment — discovery, fingerprinting, active/passive scanning, known-CVE checks, and evidence-based verification — and produces a triaged, reproducible report. It is built to augment a security engineer: it does the repeatable parts thoroughly with low false positives, verifies findings up to proof before asserting them, and can reason with a local, offline LLM so nothing leaves your host.

⚠️ Authorization & scope

Deluluscan enforces a scope gate: by default it only targets loopback / RFC1918 (private) hosts. Testing any other host requires explicitly asserting authorization (allow_remote in config, or --allow-remote on the domain tools). Only test systems you own or have written permission to assess. Unauthorized scanning is illegal in most jurisdictions (CFAA, Computer Misuse Act, …). Deluluscan confirms to proof but never weaponizes — no exfiltration, no persistence, no DoS.

Why Deluluscan

• Evidence-first. Every finding is re-tested with a differential oracle before it's rated; a bare 200/400/500 is never treated as proof. Findings carry an honest verdict (confirmed / likely / conditional / inconclusive / false-positive), a reproducible CVSS v3.1 vector, and compliance mappings (PCI-DSS / SOC 2 / ISO 27001).
• AI as a force multiplier, not a black box. The AI proposes; deterministic tools execute; the live verifier decides truth. It never overwrites a re-test result.
• Runs on your terms. Pluggable AI backends — Anthropic, OpenAI, DeepSeek, Ollama (fully offline), Claude Code, Codex, Bedrock — with secret redaction before send.
• Knows what it's testing. Fingerprints the platform (24 profiles — WordPress/Drupal/ Joomla, Laravel/Django/Rails/Spring/Tomcat, Jenkins/GitLab/Grafana/Kibana, Elasticsearch/ Kubernetes, …) and tests it accordingly: its API shape, auth model, sensitive surfaces, and version-gated known CVEs (Nessus-plugin model). Detects the edge too — WAF/CDN (18 vendors: Cloudflare/Akamai/Fastly/Imperva/…), open ports/services, honeypot & IDS/IPS.
• Broad coverage, one tool. Web · API (REST/GraphQL/WebSocket/gRPC) · headers/CORS/cookies · secrets · passive analysis (ZAP-style) · JS/SPA endpoint discovery (static + optional headless-browser crawl) · TLS/SSL · DNS/email · subdomain takeover · HTTP request smuggling (timing-only) · SMB/LDAP posture · LLM/AI systems (OWASP LLM Top 10) · containers/K8s · cloud (CSPM) · source (SAST) · API specs.
• Shift-left in one command. python3 -m deluluscan.reposcan --path . scans a whole repo across SAST, secrets (incl. git history), dependencies, IaC (Terraform/CloudFormation, AWS/GCP/Azure), containers/Kubernetes + RBAC, CI/CD workflows, and SBOMs — one merged report.
• Prioritized like modern ASPM. Every finding is ranked by real-world risk — EPSS exploit probability, CISA KEV (confirmed exploited), a combined 0–100 priority score, and MITRE ATT&CK technique tags — so you fix what matters first, not just what scores high.

Install

pip install deluluscan            # from PyPI
# optional extras: bedrock (AWS), web (FastAPI UI), xlsx (Excel export),
#   crawler (headless-browser dynamic crawl), or everything:
pip install "deluluscan[all]"
# the crawler extra also needs a browser binary:  playwright install chromium

Or from source:

git clone https://github.com/rsh1k/deluluscan && cd deluluscan
pip install -e . --break-system-packages

Quickstart

# unified assessment of an authorized target -> local report files (no publishing)
python3 -m deluluscan.assess --url http://127.0.0.1:8080/ \
    --sast-path ./src --spec openapi.json \
    --formats md,html,json,sarif --out-dir ./report

# full active scan with an OpenAPI spec
python3 -m deluluscan.cli --config config.yaml --openapi-file openapi.json --allow-state-changing

# reason with a local, offline model (no data leaves your host)
python3 -m deluluscan.cli --config config.yaml --ai ollama --ai-model qwen2.5:7b

Copy config.example.yaml → config.yaml, set your target and identities, and leave the scan.scanners list commented out to run the full set. See docs/LOCAL_MODELS.md for running a model on a low-RAM / WSL / non-NVIDIA machine.

Capabilities

Each capability also has a standalone CLI, e.g. python3 -m deluluscan.recon --url …, python3 -m deluluscan.platforms --url …, python3 -m deluluscan.netscan --url …, python3 -m deluluscan.passive --url …, python3 -m deluluscan.crawler --url …, python3 -m deluluscan.container --path ./deploy, python3 -m deluluscan.llm --provider ollama …. See docs/PLATFORM_INTELLIGENCE.md for the platform/edge detection design and a Nessus/Burp/ZAP capability map.

Design principles

• The report may only state what the scan observed. Untested surfaces read as untested; no synthesized evidence. Attack chains are hypotheses until the agent proves them.
• Confirm to proof, never weaponize. Heavy exploitation is delegated to opt-in, host-allowlisted third-party tools (nuclei, sqlmap without --dump, interactsh).
• The authorization boundary is a feature, not a limitation.

Extending

• Signatures live in deluluscan/fingerprint.py; scanners in deluluscan/scanners/ (self-register via SCANNER_REGISTRY).
• Out-of-tree plugins load from a directory (deluluscan/plugins.py); Nuclei-style YAML templates drop into templates/ (deluluscan/templates.py) with no code.
• Run the tests: python3 -m tests.<suite> (e.g. test_verify, test_llm_pentest, test_recon).

Contributing

Contributions are very welcome — Deluluscan gets better every time someone adds a platform signature, a detection rule, a known CVE, or a scanner. Many additions are just data (no engine code): a platform profile, a WAF/CDN signature, a CVE, a passive rule, a Nuclei-style YAML template. See CONTRIBUTING.md for the extension points, dev setup, and how to run the tests.

• New here? Look for good first issue and help wanted.
• Found a bug or have an idea? Open an issue.
• Every contribution must keep Deluluscan defensive and authorized-testing only — the authorization boundary stays, and we confirm to proof, never weaponize.
• Found a security issue in Deluluscan itself? Please report it privately — see SECURITY.md.
• Participation is governed by our Code of Conduct.

License

GNU Affero General Public License v3.0 — see LICENSE. If you run a modified version as a network service, the AGPL requires you to offer that version's source to its users.

Provided for authorized security testing and educational use only. You are responsible for ensuring you have permission to test any target. The authors assume no liability for misuse.