vigil-redteam 0.1.0

AI-powered red team framework

---

Install

curl -sSfL https://raw.githubusercontent.com/zimkk/vigil/main/install.sh | bash

Or with pip / pipx:

pipx install vigil-redteam
# or
pip install vigil-redteam

Requires Python 3.11+.

Desktop app

With desktop support installed, running vigil opens the native Windows, Linux, and macOS desktop client. The CLI and Textual TUI remain available for automation and terminal-first workflows. Install the optional desktop client with PySide6:

pipx install "vigil-redteam[desktop]"
vigil gui

Use vigil tui to explicitly open the terminal UI. Standard help never opens a graphical window:

vigil --help
vigil gui --help
vigil review --help

The desktop app calls the same Python application services as the CLI. It does not create shell commands from UI actions; active operations retain explicit authorization and code-review LLM consent checks.

---

What it does

Vigil drives an agentic red team engagement from a single CLI. Each command maps to a phase of the PTES methodology and spins up one or more AI agents that plan, call real security tools, interpret output, and write findings to a local SQLite database.

Phase	Command	Description
OSINT / Passive recon	vigil enumerate	Subdomain enum, DNS, WHOIS, cert transparency — no active probing
Developer / Blue Team	vigil review ./src	Local static code review for injection, session, TLS, secret, and other security gaps
Active recon	vigil active	Port scan, service fingerprint, web crawl
Vulnerability assessment	vigil assess	Nuclei, nikto, SSL/TLS checks, tech-stack CVEs
Validation	vigil validate	Confirm findings, eliminate false positives
Exploitation	vigil exploit	Controlled PoC against validated findings
Post-exploitation	vigil post-exploit	Enumerate from foothold
Privilege escalation	vigil privesc	Local privesc vector detection
Credential access	vigil cred-access	Credential hunting
Discovery	vigil discover	Users, files, services, internal hosts
Lateral movement	vigil lateral	Pivot via harvested credentials
Persistence	vigil persist	Persistence mechanism identification
Defense evasion	vigil evade	Security control detection and evasion planning
C2 assessment	vigil c2	C2 channel feasibility and evasion-aware planning
Collection	vigil collect	Sensitive data staging for exfil simulation
Exfiltration	vigil exfil	Channel testing and impact estimation
Impact	vigil impact	Business risk quantification
Cleanup	vigil cleanup	Remove Vigil-created artifacts from target
Report	vigil report	Final engagement report across all phases

---

Usage

# Passive recon (no authorization required)
vigil enumerate example.com

# Full active assessment (requires written authorization)
vigil active example.com
vigil assess example.com
vigil validate
vigil report --output report.md

Run a local developer / blue-team review without sending traffic or source code externally:

vigil review ./src --output blue-team-review.md
# Use a .json extension to write machine-readable findings.
vigil review ./src --output blue-team-review.json

For contextual, advisory triage, add the configured LLM backend. Local OpenAI-compatible endpoints (for example Ollama) are supported directly. An API backend requires an explicit acknowledgement before Vigil sends redacted, size-limited source excerpts:

vigil review ./src --llm
vigil review ./src --llm --allow-remote-code --llm-max-chars 60000

The review flags likely SQL and command injection, disabled TLS verification (MITM risk), cookie and session hijacking gaps, hardcoded secrets, weak cryptography, unsafe deserialization, SSRF, path traversal, open redirects, and unsafe CORS. Findings are static-analysis signals and should be validated in application context.

Run any phase in --mode sequential (single agent) or the default --mode parallel (multi-agent wave).

vigil enumerate --mode sequential example.com

List the tools registered for any phase:

vigil tools enumerate

---

LLM backend

Vigil works with Anthropic Claude (default) or any OpenAI-compatible endpoint — Ollama, vLLM, LM Studio, OpenRouter.

Create a .env file in your working directory:

# Anthropic (default)
VIGIL_BACKEND=anthropic
VIGIL_API_KEY=sk-ant-...
VIGIL_MODEL=claude-sonnet-4-6

# Ollama (local)
VIGIL_BACKEND=openai_compat
VIGIL_BASE_URL=http://localhost:11434/v1
VIGIL_API_KEY=ollama
VIGIL_MODEL=qwen2.5:7b

---

External tools

Vigil calls real security binaries. Install them all at once:

curl -sSfL https://raw.githubusercontent.com/zimkk/vigil/main/install-tools.sh | bash

Key tools installed: nmap, masscan, nuclei, subfinder, httpx, ffuf, gobuster, sqlmap, nikto, dalfox, gitleaks, trufflehog, rustscan, feroxbuster, wpscan, and more (426 total across Go, Cargo, pip, npm, and gem).

---

Legal

Vigil is built for authorized security testing. Running it against systems you do not own or have explicit written permission to test is illegal. The authors accept no liability for unauthorized use.

---